Command Palette

Search for a command to run...

Hectal
Phase 14Advanced15 of 18 in Database Design

Security, Privacy and Multi-Tenancy

Database authentication, least-privilege roles and row-level security, TLS and encryption at rest with key rotation, SQL injection defence, PII protection, audit trails and the right to deletion, and multi-tenant isolation models.

Databases hold the data attackers want. This phase is defensive: how access is granted, how data is protected in transit and at rest, how to prevent injection, how to handle personal data lawfully, and how to keep tenants isolated.

0/3 · 0%
3 topics ~26 min 5 code blocks & diagrams
Start with the first topic
1
14.1

Authentication, Authorisation, Encryption and SQL Injection

Authenticate every client with strong methods (SCRAM passwords from a secrets manager, IAM tokens, or client certificates). Authorise with least-privilege roles, row-level security and column privileges. Encrypt with TLS in transit and storage encryption at rest with managed, rotated keys. Prevent SQL injection with parameterised queries everywhere.

9 min 2 code practice

2
14.2

PII, Data Privacy and Audit Trails

Classify data (public, internal, confidential, PII, sensitive PII), minimise what you collect, and protect PII with masking, tokenisation and field-level encryption. Support retention limits and the right to deletion across every copy. Keep append-only audit trails recording actor, action, time, before and after values, and request and trace IDs.

8 min 1 code practice

3
14.3

Multi-Tenant Database Design

Multi-tenant SaaS stores many customers' data with one of four models: shared schema with a tenant_id column (cheapest, needs strict isolation), schema per tenant, database per tenant, or cluster per tenant (strongest isolation, highest cost). Most platforms mix them: pooled tenants in shared tables, big or regulated tenants isolated. Noisy neighbours, quotas, migrations and deletions must be designed in.

9 min 1 diagram 1 code practice