Rebuilding tenancy and billing without a migration weekend.

The challenge

The product had grown from a single-customer deployment into a multi-customer platform without the data model catching up. Tenant separation was enforced in application code rather than at the database boundary, and invoicing was a monthly script that had begun to require manual correction.

The product was live and could not take scheduled downtime, existing customers were on bespoke pricing that had to be preserved exactly, and enterprise prospects were asking security questions the team could not answer well.

Our approach

1. STEP 1 · DISCOVERY

   Audited every query path

   Produced a map of where tenant scoping was missing, which turned an open-ended risk into a finite list of 27 tables.

2. STEP 2 · FOUNDATIONS

   Moved isolation into the database

   Row-level security in Postgres, proven in staging before the application-level checks were removed.

3. STEP 3 · MIGRATION

   Migrated table by table behind flags

   Dual-write and shadow reads made each step independently reversible. Billing moved to an event-sourced service, replayed against twelve months of past invoices before switchover.

4. STEP 4 · HANDOVER

   Modelled legacy pricing explicitly

   Grandfathered plans rather than special cases in code, documented for the customer's own engineers.

The outcome

The platform has since passed four enterprise security reviews, billing questions are answered by replaying the log rather than by inspection, and the cutover completed without a single customer noticing. Dual-write plus shadow reads roughly doubles the work of each step, but it is what let a live platform change its isolation model without a migration weekend.