Routine database maintenance. One table. Took 90 seconds. But it locked the entire system. Every customer—from the smallest startup to the Fortune 500 account—sat frozen for those 90 seconds. Multi-tenancy became personal that day. It's not a technical detail. It's a strategic decision that either multiplies growth or multiplies risk.
Why this matters
Investors evaluate whether companies can "add customers without linearly adding cost and risk." The fundamental question: If your largest customer runs a heavy batch job tonight, what happens to your smallest customer's response times?
Three isolation models
- Shared Database/Schema: Fast and cost-effective, but wide blast radius. Enterprise customers typically reject it for compliance reasons.
- Shared Infrastructure, Separate Schemas/Databases: Balanced approach offering stronger isolation with reasonable operational overhead.
- Full Silo Deployment: Maximum isolation and customization, but multiplies operational complexity rapidly.
Critical evaluation areas
- Blast Radius Controls: Rate limiting, query timeouts, and resource quotas must be architectural features, not afterthoughts. Noisy neighbor problems are architectural, not operational.
- Data Isolation: Physical boundaries matter more than logical filters. Row-level security, scoped tokens, and encryption keys signal enterprise readiness.
- Operational Maturity: Single-tenant restore capabilities, schema migration procedures, and tenant-independent onboarding processes demonstrate architectural soundness.
Stage-specific expectations
- Seed/Early A: Demonstrate awareness of trade-offs
- Series B/Growth: Evidence of blast radius controls and documented isolation strategy
- Acquisition/Control: Detailed technical validation including query audits and restore testing
Red flags for dealmakers
- Application-only isolation enforcement
- Absence of per-tenant rate limiting
- Shared downtime requirements for all tenants
- Reliance on history rather than technical controls
Multiple concerns trigger pricing adjustments or post-close remediation requirements.
Your turn
What noisy neighbor incident bit you hardest? A runaway query from one customer taking down the whole system? A maintenance window that couldn't account for tenant-specific configurations? Share the scar.
Originally published on the Tech Due Diligence Playbook newsletter on LinkedIn.