The failure mode
When one customer's documents appear in another customer's AI answer, it is a data breach, not a model error. In SaaS, the retrieval layer must enforce the same tenant boundaries as the database.
Three isolation models
Shared index with tenant filters is cheapest, but every query must apply the filter server-side, never from model output. Index per tenant gives stronger isolation and simple deletion at higher cost. Hybrid models keep large or regulated tenants in dedicated indexes and smaller ones in a shared pool.
Choose per tenant tier, the same way you choose database isolation.
Permissions inside a tenant
Tenant isolation is not enough when users inside a company have different access. Carry document-level permissions into the index and filter by the requesting user's rights at query time.
Re-index when permissions change, or check permissions again after retrieval.
Testing it
Add cross-tenant leakage tests to your evaluation suite: seed distinctive facts per tenant and assert they never appear elsewhere. Run them on every release, just like other security tests.
Have a project like this in mind?
Talk To Our Team →
