multi-tenant-architecture
Plan a multi-tenant SaaS platform by choosing between Cloudflare Workers and Vercel, then work through tenant identification, isolation, routing, context propagation, and custom domain support. Maps platform limits to pricing tiers and covers domain strategy decisions including PSL submission.
Multi-tenant-architecture guides you through designing isolated SaaS platforms on Cloudflare or Vercel with proper routing and domain strategy.
AI-generated summary based on this skill's SKILL.md
Decision gist · record as of 2026-07-26
Multi-tenant-architecture guides you through designing isolated SaaS platforms on Cloudflare or Vercel with proper routing and domain strategy. Plan a multi-tenant SaaS platform by choosing between Cloudflare Workers and Vercel, then work through tenant identification, isolation, routing, context propagation, and custom domain support. Maps platform limits to pricing tiers and covers domain strategy decisions including PSL submission.
Use it when
- multi-tenant-architecture compares both platforms for multi-tenant deployments.
- multi-tenant-architecture covers custom domain implementation by routing tenant requests through DNS CNAME records pointing.
Verify before relying
Read SKILL.md below before installing (7 files). Open directory: indexed for reading, not audited.
Install
mblode/agent-skills/multi-tenant-architecture · repository language: Shell
Open directory. Skills are indexed for reading, not audited. Review a skill's body before installing it.
Frequently asked questions
AI-generated answers based on this skill's SKILL.md and metadata
How do I build a multi-tenant SaaS app with proper tenant isolation?
multi-tenant-architecture guides you through designing a multi-tenant SaaS platform with robust tenant isolation. Start by choosing your hosting layer—Cloudflare Workers or Vercel—then implement tenant identification via subdomain or custom domain routing. Establish clear isolation boundaries at the database, cache, and file storage layers. Use middleware to extract tenant context from the request and propagate it through your application stack, ensuring data and resources remain segregated per tenant.
What's the difference between Cloudflare and Vercel for multi-tenant hosting?
multi-tenant-architecture compares both platforms for multi-tenant deployments. Cloudflare Workers excel at edge-level tenant routing and request transformation with minimal latency, ideal for high-volume subdomain-based architectures. Vercel offers integrated middleware for tenant identification and works seamlessly with Next.js applications, providing simpler setup for custom domain support and per-tenant static assets like robots.txt and sitemaps. Choose Cloudflare for performance-critical edge routing; choose Vercel for rapid Next.js-based SaaS development.
How do I add custom domains to my multi-tenant app?
multi-tenant-architecture covers custom domain implementation by routing tenant requests through DNS CNAME records pointing to your platform. Generate SSL certificates for each tenant domain—either via wildcard certificates for subdomains or individual certificates for custom domains. Map the incoming domain to your tenant identifier in middleware, then route requests to the correct tenant context. For scale, consider PSL (Public Suffix List) submission to enable proper cookie isolation across tenant domains.
How do I route tenants by subdomain with SSL certificates?
multi-tenant-architecture explains subdomain-based tenant routing by extracting the subdomain from incoming requests in your edge layer or middleware. Use wildcard SSL certificates (*.yourdomain.com) to cover all subdomains with a single certificate. Extract the subdomain in your routing logic, map it to a tenant ID, and propagate that context through your application. This approach scales efficiently and keeps tenant identification simple, though it locks tenants to your primary domain.
How do I map platform limits to pricing tiers in a multi-tenant SaaS?
multi-tenant-architecture connects resource limits to billing plans by defining per-tenant quotas—API rate limits, storage, concurrent users, or feature flags—tied to each pricing tier. Store these limits in your tenant configuration, then enforce them at request time via middleware or application logic. Track usage per tenant and trigger billing events when thresholds are crossed. This approach ensures fair resource allocation and creates natural upgrade incentives as tenants grow.
What are multi-tenant architecture best practices for tenant isolation?
multi-tenant-architecture emphasizes isolation at multiple layers: use separate database schemas or row-level security per tenant, isolate cache keys with tenant prefixes, and segregate file storage by tenant directory. Implement tenant context propagation through middleware so every request carries tenant identity. Avoid cross-tenant data leaks by validating tenant ownership on every query. Test isolation boundaries regularly and use audit logs to track cross-tenant access attempts.
SKILL.md
Rendered from the published skill. Quoted content, verbatim.
Multi-Tenant Platform Architecture (Cloudflare or Vercel)
- IS: domain strategy, tenant identification and isolation, subdomain routing, custom domains, white-label setup, and plan/limit mapping on Cloudflare or Vercel.
- IS NOT: general app folder structure or module boundaries (use
define-architecture), scaffolding a new repo (usescaffold-nextjs), or the content of per-tenant SEO artifacts once routing serves them dynamically: sitemap entries, canonical URLs, structured data, indexing
(truncated - see the full file via the links below)
File tree — 7 files
skills/multi-tenant-architecture/SKILL.md
skills/multi-tenant-architecture/agents/openai.yaml
skills/multi-tenant-architecture/references/cloudflare-platform.md
skills/multi-tenant-architecture/references/limits-and-quotas.md
skills/multi-tenant-architecture/references/psl.md
skills/multi-tenant-architecture/references/vercel-domains.md
skills/multi-tenant-architecture/references/vercel-platform.md
Let your AI agent find skills like this
Example. Real query, live index.
You found this page by searching. An agent finds it by wishing: SkillFed indexes 56,283 agent skills by what they can do, searchable in plain language.
wish › “Design a multi-tenant SaaS platform with proper tenant isolation and routing”
Give your agent the search over MCP, or paste the wish link into any chat. No install? Search from any chat →
Related skills
Learn which Qdrant multitenancy approach fits your deployment: payload partitioning for many similar tenants, tiered sharding for mixed sizes, or separate collections for heterogeneous data. The guide covers isolation levels, performance trade-offs, and when to promote tenants to dedicated resources.
Master multi-tenant SaaS design with three isolation models—shared database with shared schema, schema-per-tenant, or dedicated databases. This skill covers tenant context management, middleware routing, automatic query scoping, and per-tenant configuration in TypeScript and Python.
This skill explains how to architect Qdrant for multiple tenants at scale. It covers payload-based filtering for smaller deployments, custom sharding to localize tenant data across 100k+ tenants, and tiered multitenancy for uneven tenant sizes. It also clarifies when strict isolation via separate collections is justified and what practices to avoid.
This skill encodes security-first isolation patterns for RAG systems serving multiple tenants, customers, or permission scopes. It teaches agents to enforce tenant filtering at the vector store query boundary—the only place where isolation truly matters—and pairs vendor-specific primitives (Pinecone namespaces, Weaviate multiTenancy, Qdrant payload filters, pgvector RLS) with framework adapters like LlamaIndex and LangChain. Activate when designing, reviewing, or debugging any retrieval pipeline where the corpus spans more than one tenant.
Build shared LLM inference platforms that safely serve multiple teams or customers without compromising security or performance. This skill covers tenant identity enforcement, per-tenant API keys, namespace isolation, quota configuration, request routing, and cost attribution—enabling you to run efficient, governed multi-tenant deployments on Kubernetes with vLLM and API gateways.
Build multitenant applications with three isolation tiers—from cost-effective shared schema to enterprise-grade dedicated databases—each with automatic tenant filtering and PostgreSQL Row-Level Security. Covers RBAC/ABAC patterns, field-level encryption for sensitive data, and critical anti-patterns to avoid cross-tenant data leaks.