Multi-tenant cloud architecture for SaaS: public and private SaaS

As your SaaS product grows, you eventually face the same question: do we run every customer in a single environment, or do we give some customers an environment of their own? The answer shapes more than your software architecture. It affects cost, your security commitments and your sales process.

In this post we compare the two common models, public SaaS and private SaaS, and show how you can run both together on Bulutlan Edge Cloud.

Public SaaS: one environment, many customers

In the public SaaS model, all customers share the same application and infrastructure. Customers are usually separated at the application and database layer by a tenant identifier.

The strengths of this model are clear:

• A single environment is easier to update, monitor and scale.
• Resources are shared across customers, so unit cost goes down.
• Adding a new customer requires no extra infrastructure work.

There are trade-offs too. Heavy usage by one customer can affect the others. And some enterprise customers will not accept their data living in the same environment as other companies' data.

Private SaaS: a dedicated environment per customer

In the private SaaS model, you set up a separate environment for specific customers. The application is the same, but servers, networking and storage are dedicated to that customer.

This model is usually chosen for:

• customers in regulated industries such as finance, healthcare or the public sector,
• enterprise accounts that require physical or logical isolation in their security review,
• customers who want their own maintenance window or release schedule.

Private SaaS carries more revenue potential, but building each new environment by hand quickly increases operational load. What makes private SaaS sustainable is automation.

Running both models on one platform

For most SaaS companies the right answer is not one or the other, but both. Small and mid-sized customers run in the public environment, while large enterprise customers get their own isolated environment.

The Multi-Tenancy capability in Bulutlan Edge Cloud is designed for exactly this. You can create fully isolated cloud accounts (projects) in one click. In a sample scenario from our infrastructure partner RNG Technology, a software company runs "Public SaaS", "Private SaaS 1" and "Private SaaS 2" projects side by side under the same account.

Role-based access control

You can assign detailed role-based permissions to each project, using Edge Cloud rules and AWS API policies. That way, only the team responsible for a customer can manage that customer's environment.

Multi-factor authentication and visualization

Edge Cloud offers multi-factor authentication for additional security. Its infrastructure visualization shows how resources relate to each other, per project and per object. As the number of environments grows, that visibility matters more and more to your operations team.

Isolation at the storage layer

One of the questions enterprise customers ask most often is where their data physically lives and what it shares hardware with. VPSA (Virtual Private Storage Array) technology gives a strong answer: it creates a storage array fully dedicated to your business on the public cloud, with resources isolated from other VPSAs even at the physical layer.

You can use a dedicated VPSA for private SaaS customers and shared storage for your public environment. Businesses can use their own SSL certificates and create their own keys with AES-256.

The network layer

Thanks to an AWS-like network architecture, each project can have its own VPC, subnets and firewall rules. Some enterprise customers want to connect to your SaaS environment from their own network. That is where SSL VPN, IPSec and Layer 2 or Layer 3 connectivity options come in.

Automating customer onboarding

Building a new private SaaS customer environment by hand can take days, and small differences creep in every time. When you define projects, networks, servers, storage and load balancers as code with Terraform, a new customer environment comes up from the same template in minutes. Human error goes down, and every customer environment stays on the same standard.

The cost side

Private environments consume more resources. Hourly billing makes that easier to manage: resources are billed by the hour, and CPU and RAM of stopped servers are not billed. By running customer-specific test and staging environments only when needed, you can lower your total cost.

Where to start

1. Group your existing customers by their isolation needs.
2. Build a scalable baseline architecture for your public environment.
3. Define a single private SaaS customer environment with Terraform and turn it into a template.
4. Settle the permission model across projects and your storage isolation approach.
5. Write a short document that explains your isolation model to enterprise customers.

None of these steps requires a large migration project. Having a template ready when your first private SaaS customer arrives lets you answer security and isolation questions quickly and clearly during the sales process.

For more, see Multi-Tenancy and For SaaS Companies, or talk to one of our experts about your architecture.