WeAreDevelopers Logo WeAreDevelopers
Sign in
For You LIVE
World Congress 2026 Europe - Virtual Stage • Jul 1, 2026 • Session details

We Gave Every Tenant a Postgres Connection String

Mert Ersoy

How do you give SaaS tenants a raw Postgres connection string without leaking shared metadata? Learn how a custom TCP proxy achieves virtual single tenancy at the protocol level.

Pause
Mute Enter Fullscreen
#1 about 2 min

Giving multi-tenant customers direct Postgres connections

Connecting to a shared database natively exposes schemas across tenants, creating a security issue that requires a proxy solution.

#2 about 2 min

Why data workflows require raw SQL over REST APIs

Providing direct database access prevents customers from self-hosting by allowing custom joins and aggregations directly in standard tooling.

#3 about 3 min

Native Postgres security gaps in multi-tenant environments

Traditional read-only roles and row-level security still expose global system catalogs to all tenants on a shared server.

#4 about 1 min

The operational cost of single-tenant databases

Provisioning isolated databases for individual customers creates significant overhead for infrastructure setup, idle computing, and backup management.

#5 about 3 min

Implementing virtual single tenancy via TCP proxying

A man-in-the-middle TCP proxy sits between clients and the database to rewrite traffic and provide catalog isolation.

#6 about 2 min

Processing client connections and mapping workspace identifiers

The proxy reads initial connection configurations to validate customer records and logically route traffic to the correct underlying physical database.

#7 about 3 min

The proxy pipeline for parsing and rewriting queries

Incoming requests are checked against a configured blocklist, parsed into syntax trees, and injected with subqueries to hide unauthorized tables.

#8 about 1 min

Handling the Postgres prepared statement protocol

Reassembling and reframing cross-packet execution steps is necessary to properly intercept and modify persistent database statements.

#9 about 2 min

Failing closed to prevent undiscovered security bypasses

Rejecting unrecognized query shapes and strictly dropping administrative functions eliminates privilege escalation and internal reconnaissance risks.

#10 about 2 min

Enforcing query limits and execution timeouts per session

Applying strict rate limits and layered transaction timeouts ensures public SQL endpoints remain cheap to run and resistant to abuse.

#11 about 1 min

Configuring native Postgres roles for read-only workspaces

Revoking default permissions and explicitly granting selective schema access acts as a secure native backup layer behind the TCP proxy.

#12 about 1 min

Seamless business intelligence integration with raw connections

Providing standard protocol credentials allows external utilities to immediately analyze database records without specialized SDKs or data pipelines.

#13 about 3 min

Identifying technical tradeoffs in database proxy architectures

Enforced catalog isolation breaks standard dump utilities and requires ongoing parser maintenance whenever new Postgres protocol surfaces are released.

#14 about 3 min

Choosing pragmatic proxy architectures to retain cloud customers

Accepting minor capability gaps over perfect database isolation successfully prevents customer churn while providing practical analytics integrations.

Matching moments

1:40 min

Deployment architectures for scalable multi-tenant database environments

Alper Ebicoglu Alper Ebicoglu · World Congress 2025

5:53 min

Choosing relational databases over NoSQL for most workloads

Josip Stuhli Josip Stuhli · World Congress 2026 Europe

2:09 min

Migrating moving data targets without disrupting active engineering teams

Max Fischer Max Fischer +1 · World Congress 2026 Europe

1:39 min

Making Postgres databases stateless using cloud-native storage systems

Nikita Shamgunov Nikita Shamgunov · World Congress 2024

5:55 min

Advantages and challenges of multi-tenant application architecture

Alper Ebicoglu Alper Ebicoglu · World Congress 2025

2:05 min

Embracing high opinionation to simplify web application architecture

Daniel Hepper · LIVE

More from World Congress 2026 Europe - Virtual Stage

One Does Not Simply Make Architecture Decisions Alone thumbnail
36:15
about 2 months ago

One Does Not Simply Make Architecture Decisions Alone

Vladas Diržys

From Black Box to Glass Box : Bedrock AgentCore Observability thumbnail
21:15
2 months ago

From Black Box to Glass Box : Bedrock AgentCore Observability

Yasemin Aktürk

Leading in Rhythm: How Women Make Better Decisions with Biological Intelligence thumbnail
30:41
2 months ago

Leading in Rhythm: How Women Make Better Decisions with Biological Intelligence

Julia Grosse

Better Together: Leveraging Your Observability Tools as a SIEM thumbnail
39:06
2 months ago

Better Together: Leveraging Your Observability Tools as a SIEM

Mathias Palmersheim

ChatGPT Apps: From Chat to Checkout thumbnail
30:29
2 months ago

ChatGPT Apps: From Chat to Checkout

Aaron Koivunen

Interior Decorating (TypeScript Decorators) thumbnail
29:22
2 months ago

Interior Decorating (TypeScript Decorators)

Michael Dowden

Upcoming sessions on this topic

Open session

World Congress 2026 North America

September 25, 2026 · 10:20–10:50

Stage 9

Testing React Backends Like a Pro: Mocking Databases with SQLite

David Morris

Solution Architect

David Morris
Open session

World Congress 2026 North America

September 24, 2026 · 12:50–13:20

Stage 3

Fault Tolerance and Consistency at Scale: Harnessing the Power of Distributed SQL Databases

Wei Hu

Senior Vice President of Research and Development

Wei Hu
Open session

World Congress 2026 North America

September 24, 2026 · 14:10–14:40

Stage 3

Real-Time Data Platforms at Trillion-Event Scale

Diptamay Sanyal

Principal Engineer | Data, AI & Cybersecurity Platforms

Diptamay Sanyal
Open session

World Congress 2026 North America

September 25, 2026 · 14:10–14:40

Stage 3

Hacking MSSQL on Cloud. All of them. How I became sysadmin on Azure, AWS, GCP and Alibaba.

Fabiano Amorim

Fabiano Amorim – Chief Technology Advisor – PowerTuning

Fabiano Amorim
Open session

World Congress 2026 North America

September 25, 2026 · 16:50–17:20

Stage 4

Engineering Moneyball: How We Benchmarked Google vs Meta

Jirka Bachel

Co-Founder & CEO

Jirka Bachel
Open session

World Congress 2026 North America

September 24, 2026 · 17:30–18:00

Stage 4

Boring Failover: Predictable Region Recovery Across 5,000 Microservices

Garvit Kataria, Sahil Sabharwal

Garvit Kataria
Sahil Sabharwal

Related videos

Swapping a Data Warehouse at Runtime: Zero-Downtime Migration Without Changing a Single Client thumbnail
30:28
World Congress 2026 Europe • about 2 months ago

Swapping a Data Warehouse at Runtime: Zero-Downtime Migration Without Changing a Single Client

Max Fischer, Michael O'Toole

Tracking vehicles at scale thumbnail
30:33
Europe 2026 Virtual • 2 months ago

Tracking vehicles at scale

Thorsten Riess

Optimizing Discovery: PostgreSQL's Role in Transforming GetYourGuide's Search thumbnail
26:04
World Congress 2025 • about 1 year ago

Optimizing Discovery: PostgreSQL's Role in Transforming GetYourGuide's Search

Dharin Shah

Building Multi-Tenant ASP.NET Core Applications: Best Practices and Real-World Solutions thumbnail
28:44
World Congress 2025 • about 1 year ago

Building Multi-Tenant ASP.NET Core Applications: Best Practices and Real-World Solutions

Alper Ebicoglu

How building an industry DBMS differs from building a research one thumbnail
30:34
World Congress 2023 • almost 3 years ago

How building an industry DBMS differs from building a research one

Markus Dreseler

Rate-limiting using eBPF and Istio: How to protect your SaaS customers from themselves thumbnail
31:32
World Congress 2026 Europe • about 2 months ago

Rate-limiting using eBPF and Istio: How to protect your SaaS customers from themselves

Jan Mensch

Related articles

From learning to earning

Jobs that call for the skills explored in this talk.