What is tenant isolation?

Tenant isolation is how a shared software service keeps each customer's data and resources walled off from every other customer's. In software-as-a-service, many customers, or tenants, use the same application and often the same infrastructure. Microsoft's architecture guidance calls it "One of the biggest considerations in multitenant architecture design", and adds: "Instead of viewing isolation as a discrete property, consider it a spectrum." Some services share everything but the data rows; others give each customer separate databases or servers.

Not the same as general security

An archived AWS whitepaper on SaaS architecture makes a distinction worth keeping: "tenant isolation is separate from general security mechanisms". Strong passwords, single sign-on and encryption stop outsiders. Isolation stops one legitimate customer from reaching another's data, whether through a bug, a misconfiguration or a crafted request. A filter in application code that adds "this customer only" to each query is the weakest form, because one missed filter exposes everything.

In a timber business

Timber data is commercially sensitive: stumpage prices, log costs, customer pricing, contract terms. Competitors, suppliers and customers may use the same software.

AI adds layers to check: the text and embeddings built from your documents, search indexes, caches and prompts. Training matters too. IBM, which sells security services, reports that breaches through AI model inversion, attacks that recover training data, cost on average about 20% more than breaches overall, by our arithmetic from its 2026 figures. So ask whether any model trained on your data serves anyone else.

What to ask

How far does isolation run: storage, processing, application, AI features? Is it enforced by the system or by application code alone? Answers like these can't be checked from outside, so ask for independent evidence too: audit reports, certification scope and penetration test summaries.

What it isn't

Isolation isn't encryption, though encryption can support it. A separate login screen for each customer isn't isolation if the data underneath is shared without controls.

Quarri's security page sets out how customer data is isolated, encrypted and audited.

Quarri is an AI-native data platform for the timber supply chain. It connects buying, production, sales and inventory for forest management, sawmill, wood products and pulp, paper and packaging operators.