Stop writing brittle hand-crafted SQL export scripts. TenantPorter parses your schema DAG, enforces write-freezes, packages records & files into encrypted .tpbundle archives, and verifies zero foreign tenant records leaked.
Extract & Move Tenants in Seconds
TenantPorter operates directly inside your infrastructure. Multi-tenant database credentials and raw records never leave your VPC.
Generates tenantporter.config.json, validates foreign-key dependency DAG, and applies column redaction policies.
name: Continuous Multi-Tenant Isolation Check
on:
schedule:
- cron: '0 * * * *' # Hourly
jobs:
isolation-audit:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
- name: Verify Tenant Boundaries & Check Leakage
uses: subash-thiruppathi/TenantPorter@v1
with:
app-id: saas-production
config: ./tenantporter.config.json
slack-webhook: ${{ secrets.SLACK_WEBHOOK }}
license-key: ${{ secrets.TENANTPORTER_LICENSE_KEY }}Continuously audits schema migrations in CI to prevent cross-tenant foreign-key leaks before deployment.
[](https://tenantporter.spekra.in)
Embed live tenant isolation verification badges on your repository proving zero cross-tenant row leakage.
Scans database schemas, SQL files, and ORM models for missing tenant discriminators and unredacted customer PII. Outputs a 0-100 Isolation Score.
Simulate moving a VIP tenant (Acme Corp, ID: tenant_acme_42) out of a shared multi-tenant database to a dedicated private cluster.
Embed Real-Time Tenant Isolation Proofs
Prove strict zero cross-tenant row leakage to customers, enterprise prospects, and compliance auditors.
The Tenant Map DSL
Define ownership predicates once. TenantPorter compiles the DAG, verifies foreign keys, and redacts credentials automatically.
Tables containing direct tenant_id column.
tenants:
policy: root
key: id
organizations:
policy: direct
tenantKey: tenant_idChild tables joined through parent foreign keys without tenant_id.
invoices:
policy: related
foreignKey: org_id
parentTable: organizationsGlobal reference tables safely copied or referenced at target.
plans:
policy: shared
action: copy_catalog
allowlist: [id, name, tier]Tenant Portability for Every Scale
Customer-operated runners execute inside your VPC. Zero raw customer data leaves your boundary.
Open-source CLI for manual tenant export investigation.
Continuous tenant portability for growing multi-tenant applications.
Automated isolation verification and GDPR / SOC 2 compliance bundles.
High-concurrency multi-region tenant sharding with zero-knowledge keys.
TenantPorter runs Tarjan's strongly connected components algorithm during schema compilation. If circular dependencies exist, it raises a diagnostic error showing the cycle path, allowing engineers to declare nullable deferred foreign key boundaries.
After importing into the destination database, the Portability Verifier executes an exhaustive isolation audit. It scans all imported rows across every table and asserts that 100% of rows contain either the target tenant_id or are approved catalog reference records. If a single foreign ID is found, the transaction is immediately aborted.
No. Only the specific tenant being migrated is placed in maintenance mode via the Write Freeze Adapter. All other 12,000+ tenants continue writing and reading without interruption.
Get instant access to automated Kahn foreign key extraction, PII column redaction, cross-tenant isolation audits, and SOC 2 / GDPR packs.