Multi-tenant isolation,
blast-radius mapped, audit-chained.
30 synthetic tenants across T1 Enterprise / T2 Mid / T3 SMB tiers · 6 boundary-anomaly patterns · isolation control matrix · ed25519-signed cross-tenant audit chain. The buyer-diligence surface that B2B SaaS vendors hand to enterprise procurement.
Tenant inventory — Helix Cloud Platform
30 synthetic tenants across T1 Enterprise / T2 Mid / T3 SMB tiers. 1 tenant is RLS-missing (Mariner Coffee — critical), 1 tenant is partial-RLS (Zenith). 4 audit findings currently open across cross-tenant access events, token replay, DR-drill mount, partial RLS.
| Tenant | Tier | Blast radius | Isolation controls | Status | Users | Findings |
|---|---|---|---|---|---|---|
| AcmeCorp Industries | T1 Enterprise | Dedicated | Dedicated DB + dedicated schema + RLS | Complete | 4,421 | — |
| Globex Holdings | T1 Enterprise | Dedicated | Dedicated DB + dedicated schema + RLS | Complete | 8,712 | — |
| Northwind Federal | T1 Enterprise | Dedicated | Dedicated DB + dedicated schema + RLS + dedicated KMS | Complete | 12,104 | — |
| Pinnacle Health Systems | T1 Enterprise | Dedicated | Dedicated DB + RLS + HIPAA-aligned encryption boundary | Complete | 6,809 | — |
| Quincy Maritime | T1 Enterprise | Dedicated | Dedicated DB + dedicated schema + RLS | Complete | 3,122 | — |
| Ravenwood Defense | T1 Enterprise | Dedicated | Air-gapped dedicated infra + dedicated network segment | Complete | 1,804 | — |
| Sapphire Insurance | T1 Enterprise | Dedicated | Dedicated DB + RLS | Complete | 4,988 | 1 open |
| TriCity Bank | T1 Enterprise | Dedicated | Dedicated DB + RLS + dedicated KMS | Complete | 7,211 | — |
| Vector Bio Diagnostics | T2 Mid | Schema-isolated | Shared DB + per-tenant schema + RLS | Complete | 2,104 | — |
| Whitestone Pharma | T2 Mid | Schema-isolated | Shared DB + per-tenant schema + RLS | Complete | 1,772 | — |
| Yellowstone Logistics | T2 Mid | Schema-isolated | Shared DB + per-tenant schema + RLS | Complete | 988 | — |
| Zenith Manufacturing | T2 Mid | Schema-isolated | Shared DB + per-tenant schema + partial RLS | Partial RLS | 1,145 | 1 open |
| Apex Sports Media | T2 Mid | Schema-isolated | Shared DB + per-tenant schema + RLS | Complete | 612 | — |
| Beacon Energy | T2 Mid | Schema-isolated | Shared DB + per-tenant schema + RLS | Complete | 1,488 | — |
| Citadel Hospitality | T2 Mid | Schema-isolated | Shared DB + per-tenant schema + RLS | Complete | 778 | — |
| Delta Legal Holdings | T2 Mid | Schema-isolated | Shared DB + per-tenant schema + RLS + privilege-tier | Complete | 411 | — |
| Edenfield Real Estate | T2 Mid | Schema-isolated | Shared DB + per-tenant schema + RLS | Complete | 644 | — |
| Fenway Education Network | T3 SMB | Shared-prefix | Shared DB + shared-prefix only | Shared-prefix only | 122 | 2 open |
| Granite Trade | T3 SMB | Shared-prefix | Shared DB + shared-prefix only | Shared-prefix only | 88 | 1 open |
| Highland Property Co | T3 SMB | Shared-prefix | Shared DB + shared-prefix only | Shared-prefix only | 67 | — |
| Indigo Studios | T3 SMB | Shared-prefix | Shared DB + shared-prefix only | Shared-prefix only | 144 | — |
| Junction Robotics | T3 SMB | Shared-prefix | Shared DB + shared-prefix only | Shared-prefix only | 92 | — |
| Karma Wellness Co | T3 SMB | Shared-prefix | Shared DB + shared-prefix only | Shared-prefix only | 78 | 1 open |
| Lyric Bookstores | T3 SMB | Shared-prefix | Shared DB + shared-prefix only | Shared-prefix only | 41 | — |
| Mariner Coffee | T3 SMB | Shared-prefix | Shared DB + shared-prefix only — RLS DISABLED | RLS MISSING | 88 | 3 open |
| NovaWave Apparel | T3 SMB | Shared-prefix | Shared DB + shared-prefix only | Shared-prefix only | 56 | — |
| Olympia Print Co | T3 SMB | Shared-prefix | Shared DB + shared-prefix only | Shared-prefix only | 39 | — |
| Plumeria Spa Group | T3 SMB | Shared-prefix | Shared DB + shared-prefix only | Shared-prefix only | 67 | — |
| Quanta Auto Parts | T3 SMB | Shared-prefix | Shared DB + shared-prefix only | Shared-prefix only | 78 | — |
| Riverstone Bistro | T3 SMB | Shared-prefix | Shared DB + shared-prefix only | Shared-prefix only | 22 | — |
Boundary anomalies — 6 patterns
B2B SaaS multi-tenant isolation fails in 6 distinct ways: RLS removed during a migration, partial RLS on newer tables, cross-tenant queries by privileged support staff, JWT replay across tenants, shared resources without per-tenant namespacing, and DR-drill cross-mounts.
Mariner Coffee · row-level security disabled
Mariner Coffee (T3 SMB) is on the shared SaaS DB cluster with shared-prefix isolation BUT row-level-security policy was removed during a recent migration. Any application bug or SQL injection could surface cross-tenant rows. Re-enable RLS within 24h.
Zenith Manufacturing · 4 of 9 tables missing RLS
Zenith Manufacturing has RLS on critical tables (customers, invoices, payments) but 4 newer tables (telemetry events, feature flags, audit logs, billing notifications) were created without RLS. Backfill RLS policies + add CI gate.
Internal admin queried wrong tenant rows
Internal support admin support-eng@helix.cloud queried AcmeCorp customer table via shared support tool but session context was for Globex. SOC 2 CC6.7 violation. Auto-escalate + force re-justification.
JWT issued for T1 reused on T2 endpoint
Single JWT issued for Northwind Federal session was replayed against Zenith Manufacturing API endpoint. Token validation accepted because tenant_id wasn't bound to JWT payload. Add JWT aud claim binding + reject mismatched tenant.
Redis cluster shared without per-key namespacing
Cache layer (Redis Cluster, 4 nodes) is shared across all T3 SMB tenants without per-tenant key namespacing. Keys like session:user_42 can clash. Surface as audit finding even if no exploit observed — failure mode is silent data poisoning.
T2 backup mounted in T1 restore drill
During DR drill, a Whitestone Pharma (T2) backup snapshot was accidentally mounted into Pinnacle Health Systems (T1) staging environment for 14 minutes before being unmounted. No data was queried but the mount event is in the audit chain. HIPAA-relevant for Pinnacle.
Isolation control matrix
Each isolation control has a binary state (active/missing) and a coverage scope (which tenants are protected). T1 Enterprise gets the full stack — dedicated DB, dedicated KMS, dedicated VPC peering. T2 Mid gets schema-level isolation + RLS. T3 SMB gets RLS + shared-prefix only. The gap that becomes a buyer finding is when T3 isolation degrades silently (a missing RLS policy on a new table, a Redis cluster without namespacing).
| Control | Status | Coverage | Refresh / SLA | Note |
|---|---|---|---|---|
| RLS policy on tenants_isolation_check | Active | 32 tenants · 30 enforced | Refresh interval 60s | All Tier1+Tier2 PASS |
| JWT tenant_id binding | Active | all sessions audited | Last incident 14d ago | 1 false positive in 30d |
| Per-tenant KMS key | T1 Only | 8/8 T1 tenants | — | T2/T3 use shared KMS |
| Network segmentation (VPC peering) | T1 Only | 8/8 T1 tenants | Refresh on tenant change | T2/T3 share single VPC |
| Per-tenant audit-stream | Active | 30/30 tenants | <1s lag p99 | ed25519-signed |
| Cross-tenant access alerts | Active | 1 open finding | Trigger: same JWT, 2 tenant_id | Auto-PagerDuty |
| Tenant deletion grace (30d) | Active | 0 in grace | — | Tombstone + scheduled purge |
| Shared resource namespace check | Partial | Redis MISSING | CI gate available | Fix in roadmap |
Tenant boundary audit chain
Every event that touches a tenant boundary — RLS policy missing, cross-tenant access, token replay, DR-drill mount, KMS rotation, VPC peering validation, tenant lifecycle — is hash-chained. Buyer-side diligence teams can verify the chain in their own environment via the audit_chain_verify MCP tool.
Why this surface exists
When an enterprise buyer evaluates a multi-tenant B2B SaaS vendor, the question is no longer are you SOC 2 Type II — that's table stakes — it's show me the evidence that another tenant's bug or insider cannot reach my data. This surface is the vendor's pre-built answer to that question, in the same shape as the Trust Center evidence rooms and Security Posture public artifacts.
Buyer: B2B SaaS CTOs · Platform leads · CISOs at vendors selling to enterprise buyers who run vendor-isolation diligence.
Regulatory anchors: SOC 2 Type II CC6.1/CC6.6/CC6.7 · ISO 27001 A.13.1 · NIST 800-53 SC-4/SC-7 · GDPR Art 32 · CCPA · HIPAA Security Rule §164.312(a)(1) · PCI DSS scope segregation.
KG Suite tie-back: Every operator decision on this surface emits an audit-stream event (hash-chained, ed25519-signable). Vault-contract data classification follows the Decision Card v0.3 pattern (data_vault_targets + retention_envelope). Incident escalations match the AI Incident Card profile shape. Evidence bundles align with the AI Evidence Format spec.
Static-only doctrine: No backend. No login. No telemetry. All synthetic data is baked into this HTML page as JavaScript constants. Nothing leaves the tab. Frame as readiness / evidence / posture / controls / scaffolding — never "compliant" or "certified" without an externally-attested audit.