4 ms·
The issue is backups. We're a B2B/Enterprise SaaS and most tenants require that we erase all their data at the end of the contract. Some require customer-manag
by e1g 5y ago
The issue is backups.
We're a B2B/Enterprise SaaS and most tenants require that we erase all their data at the end of the contract. Some require customer-managed encryption keys. The only way to meet this requirement is to have every tenant isolated in their own database (and their own S3 bucket etc). If data is mixed, when one tenant leaves you must go through all copies of all backups, purge their rows, then re-save the cleaned up backups. Nearly impossible in practice.
- chromanoid 5y agoCrypto-shredding is not an option? https://en.wikipedia.org/wiki/Crypto-shredding https://en.wikipedia.org/wiki/Crypto-shredding
- e1g 5y agoIn practice, I'm not sure where to begin with that strategy if you have a single .sql dump file with ~10 tables containing sensitive data from 50 different tenants. Even if theoretically possible, I'll take 50 files like tenantN.sql for both saving and restoring sanity.