When I started Aurora Hub, the first irreversible decision was tenant isolation. Dealers, service teams, and admins all share one platform, but a dealer must never see another dealer’s customers. This article walks through the actual strategy running in production.

Three isolation models, one winner

Database-per-tenant: strongest isolation, but operationally heavy — migrations multiply by tenant count.

Schema-per-tenant: middle ground, but connection pooling and cross-tenant reporting get awkward fast.

Shared schema + tenant_id column with row-level security: one migration path, native Postgres enforcement.

I chose the shared schema with row-level security (RLS). The deciding factor was not performance — it was that RLS moves the isolation guarantee from application code into the database itself.…