Dedicated database per store: what tenant isolation means for your data
Multi-tenant platforms can separate stores in three ways. Learn how a database per store compares with shared tables, what it protects and what it does not.
By Orvexa TeamUpdated 3 min read
- Platforms keep many stores in one system, and the isolation method decides how far a bug or breach can spread
- A dedicated database per store gives the strongest separation, simpler exports and cleaner deletion
- Isolation helps but does not replace access controls, patching and good practice
Behind every online store platform, many merchants share the same software. That is called multi-tenancy. How the platform separates each merchant's data is one of the most important security decisions it makes, and few merchants ever ask about it.
Three common designs
| Design | How it works | Isolation |
|---|---|---|
| Shared tables | All stores' data sits in the same tables, tagged with a store ID | Lowest. One query mistake can expose other stores' rows |
| Separate schema | One database, but each store has its own set of tables | Medium |
| Separate database | Each store has its own database | Highest |
Orvexa uses the third model: every store runs in its own dedicated database.
What stronger isolation gives you
- Smaller blast radius. A bug or a compromised credential in one store is much less likely to reach another's data.
- Cleaner privacy handling. Exporting or deleting one store's data is a database-level operation, which helps with requests under privacy laws (DPDP, GDPR).
- Independent backups and restores, so one store can be restored without touching others.
- Fewer noisy-neighbour effects, because a very busy store is less likely to slow down the rest.
- Easier data residency choices, in principle, if a store needs its data in a particular region.
What it does not do
Isolation is a foundation, not a guarantee. You still need:
- Strong access control, so only the right people in the right store can log in.
- Multi-factor authentication and good passwords.
- Patching and monitoring of the platform.
- Encryption in transit and secure handling of secrets.
- Careful third-party apps, because an app you install can see what you permit.
A dedicated database can also cost the platform more to run and manage, which is why many platforms avoid it. It is a sign of investment in security, not magic.
Questions to ask any platform
- How is my store's data separated from other merchants'?
- Who at the platform can access it, and is that logged?
- Can I export all my data at any time?
- How do you handle deletion requests and backups?
- Where is data stored, and which sub-processors touch it?
- How are payments handled? Do card details ever touch your servers?
- Do you publish your security and privacy terms?
Our approach
Each Orvexa store has its own database, payments run in Razorpay's hosted checkout so that card and UPI details are not stored by us, and payment events are verified before they change anything. Security is the baseline of every plan, not an add-on. See our security checklist for store owners.
Related reading
What to do next
Ask your current platform the questions above and write down the answers. Vague replies are themselves an answer.
Frequently asked questions
Is a shared database unsafe?
Not necessarily. Well-engineered shared systems can be secure, but the margin for error is smaller, so ask how the platform tests for cross-tenant leaks.
Does a dedicated database slow my store?
Not by itself. Performance depends on design and load. In many cases isolation reduces interference from other stores.
Can I take my data with me?
You should be able to. Confirm the export options, formats and any limits before you sign up, so that leaving later is a routine task rather than a negotiation. See our switching guide for what to export.
Keep reading
Cookie consent for e-commerce sites: what you need and how to do it well
Which cookies need consent, how to build a fair banner, what India’s DPDP Act and Europe’s rules expect, and how to keep measuring without annoying shoppers.
3 min read
GDPR for Indian D2C brands that sell to Europe
When the EU’s GDPR applies to an Indian store and how to comply: lawful basis, notices, rights, processor contracts, transfers and breach reporting.
3 min read
India's DPDP Act for online stores: a practical guide for D2C brands
What India’s Digital Personal Data Protection Act means for a store: consent, notices, purpose limits, security, breaches and rights. General information.
3 min read