Multi-Tenant Capacity Planner
Estimate steady and peak request rates, headroom, monthly transfer, and twelve-month primary storage.
Plan a workload →
Guides for multi-tenant software teams
How multi-tenant systems fail, and how to test your design
Velynoriva explains tenant isolation, billing pipelines, enterprise identity, and cloud operations for engineers who build shared platforms. Guides cite primary documentation, and many include a runnable Go lab with the output we recorded, so you can check the claim instead of trusting it.
Calculate with your own assumptions
Architecture Planning Tools
Three free calculators turn your workload, isolation, and cost assumptions into estimates you can discuss in a design review. Each shows its formula and what it leaves out.
Tenant Isolation Decision Planner
Compare shared tables, separate schemas, and dedicated databases against six operational constraints.
Compare models →Tenant Unit Economics Calculator
Allocate shared infrastructure by measured usage and calculate tenant COGS, margin, and target price.
Calculate COGS →
Run it yourself
Recent lab findings
Each lab is a complete Go program printed in its guide, with the exact output recorded when we ran it.
FIFO vs. a published DRR dispatcher vs. corrected DRR
FIFO: 24.9 s. The published dispatcher never ran the other tenants' jobs and then looped forever. Corrected DRR: 40 ms.
Read the lab →One hypothetical month, three allocation rules
One tenant ranged from a 54% margin to -245%. An equal split showed small tenants at -40% as a group. Keeping idle capacity separate removed $11,400 from tenant costs.
Read the lab →One waiting ALTER TABLE and the lock queue
No lock_timeout: 7,500 of 12,000 queries failed. A 500 ms lock_timeout with retries: none failed, worst wait 490 ms, migration done 2.5 s after the report.
Read the lab →
Start here
Featured guides
Per-Tenant Cost Attribution on Shared Infrastructure: Rules, Idle Capacity, and Reconciliation
Attributing shared cloud cost to tenants is a set of choices. A worked lab shows one tenant's margin moving from 54% to -245% depending only on the allocation rule.
Status Pages and SLA Reporting: Independent Hosting, Real Probes, and Gap-Free Credit Tables
Host the status page outside your failure domain, probe what customers actually do, and measure availability as the contract defines it. A lab finds a gap in a common credit table.
Fair Background Job Queues for Multi-Tenant Systems: Testing Deficit Round-Robin
Why one tenant's batch delays everyone in a shared queue, how deficit round-robin fixes it, and a lab in which a commonly published DRR dispatcher never served a second tenant.
Tenant-Aware Observability with OpenTelemetry: Baggage, Spans, and Metric Cardinality
Put the tenant ID on traces and logs, keep it out of metric labels, and know that baggage does not reach your spans by itself, as a Go lab with OpenTelemetry shows.
Topics
Browse by topic
Cloud Observability, Performance & Operations
Running a shared platform once customers depend on it: per-tenant visibility, fair background work, online migrations, availability reporting, and cost.
Enterprise Security, Identity & Compliance
The controls enterprise security reviews ask about: single sign-on, authorization, sessions, customer-managed keys, and audit logs.
Multi-Tenant Architecture & Data Isolation
Where the tenant boundary sits, how each request finds its tenant, and what keeps one tenant's data and load away from another's.
Subscription Billing, Metering & Entitlements
Following money through a subscription product: usage measurement, payment-provider events, plan entitlements, proration, and failed payments.
Library
View Full Archive →
More guides
PostgreSQL Schema Changes Without Downtime: Locks, the Lock Queue, and Expand-Contract
Which PostgreSQL changes block reads or writes, why a fast ALTER TABLE can stall an application for minutes, and how to stage column changes safely.
RBAC and ABAC for Multi-Tenant Products: Custom Roles and Tested Rego Policies
When roles are enough, when to add attribute rules, how customers can define roles, and a lab that parses and tests a tenant-aware OPA policy in Rego v1.
Tamper-Evident Audit Logs: What a Hash Chain Detects and What It Misses
A hash chain stored next to the data proves consistency, not integrity. A lab tampers with a 1,000-record chain six ways and shows what external checkpoints add.
Enterprise SSO with SAML and OIDC: Validation, Account Linking, and Offboarding
The SSO bugs that cause incidents happen after the library says 'valid'. How to link logins to users by issuer and subject, map roles, and end access when people leave.
Session Revocation and Refresh Token Rotation: Where the Design Breaks
Short access tokens and rotating refresh tokens only protect you if rotation is atomic. A lab shows a read-then-write store missing about 72% of simultaneous token replays.
Customer-Managed Encryption Keys: Envelope Encryption and Real Revocation Time
How envelope encryption with a customer's KMS key works, how long revocation really takes, and a lab measuring AES-GCM cost and what associated data prevents.
Entitlements for Subscription Plans: Data Model, Caching, and Stale Permissions
Move plan checks into data, cache them safely, and enforce seat limits where they cannot be exceeded. A lab shows how long one lost invalidation message keeps a server wrong.
Failed Payments and Dunning: Declines, Retries, Access States, and a Tested Policy
Which declines to retry, how to limit access while a payment is overdue, what to tell customers, and a tested Go state machine that handles duplicate payment events.
Usage Metering Without Lost or Double-Billed Events: Where to Deduplicate
Design a metering pipeline from event to invoice, and see a lab in which the popular 'set a Redis marker first' pattern lost about 1% of billable usage.
Looking for a specific architecture or topic?
Explore Full Guide Library
Maintained publication
See what changed and how corrections work
Material tool, policy, source, and technical changes are recorded publicly.