WeAreDevelopers Logo WeAreDevelopers
Sign in
For You LIVE
World Congress 2026 Europe - Virtual Stage • Jul 1, 2026 • Session details

We Gave Every Tenant a Postgres Connection String

Mert Ersoy

How do you give SaaS tenants a raw Postgres connection string without leaking shared metadata? Learn how a custom TCP proxy achieves virtual single tenancy at the protocol level.

Pause
Mute Enter Fullscreen
#1 about 2 min

Giving multi-tenant customers direct Postgres connections

Connecting to a shared database natively exposes schemas across tenants, creating a security issue that requires a proxy solution.

#2 about 2 min

Why data workflows require raw SQL over REST APIs

Providing direct database access prevents customers from self-hosting by allowing custom joins and aggregations directly in standard tooling.

#3 about 3 min

Native Postgres security gaps in multi-tenant environments

Traditional read-only roles and row-level security still expose global system catalogs to all tenants on a shared server.

#4 about 1 min

The operational cost of single-tenant databases

Provisioning isolated databases for individual customers creates significant overhead for infrastructure setup, idle computing, and backup management.

#5 about 3 min

Implementing virtual single tenancy via TCP proxying

A man-in-the-middle TCP proxy sits between clients and the database to rewrite traffic and provide catalog isolation.

#6 about 2 min

Processing client connections and mapping workspace identifiers

The proxy reads initial connection configurations to validate customer records and logically route traffic to the correct underlying physical database.

#7 about 3 min

The proxy pipeline for parsing and rewriting queries

Incoming requests are checked against a configured blocklist, parsed into syntax trees, and injected with subqueries to hide unauthorized tables.

#8 about 1 min

Handling the Postgres prepared statement protocol

Reassembling and reframing cross-packet execution steps is necessary to properly intercept and modify persistent database statements.

#9 about 2 min

Failing closed to prevent undiscovered security bypasses

Rejecting unrecognized query shapes and strictly dropping administrative functions eliminates privilege escalation and internal reconnaissance risks.

#10 about 2 min

Enforcing query limits and execution timeouts per session

Applying strict rate limits and layered transaction timeouts ensures public SQL endpoints remain cheap to run and resistant to abuse.

#11 about 1 min

Configuring native Postgres roles for read-only workspaces

Revoking default permissions and explicitly granting selective schema access acts as a secure native backup layer behind the TCP proxy.

#12 about 1 min

Seamless business intelligence integration with raw connections

Providing standard protocol credentials allows external utilities to immediately analyze database records without specialized SDKs or data pipelines.

#13 about 3 min

Identifying technical tradeoffs in database proxy architectures

Enforced catalog isolation breaks standard dump utilities and requires ongoing parser maintenance whenever new Postgres protocol surfaces are released.

#14 about 3 min

Choosing pragmatic proxy architectures to retain cloud customers

Accepting minor capability gaps over perfect database isolation successfully prevents customer churn while providing practical analytics integrations.

Matching moments

1:40 min

Deployment architectures for scalable multi-tenant database environments

Alper Ebicoglu Alper Ebicoglu · WWC 2025

5:53 min

Choosing relational databases over NoSQL for most workloads

Josip Stuhli Josip Stuhli · WWC Europe 2026

2:09 min

Migrating moving data targets without disrupting active engineering teams

Max Fischer Max Fischer +1 · WWC Europe 2026

1:39 min

Making Postgres databases stateless using cloud-native storage systems

Nikita Shamgunov Nikita Shamgunov · WWC 2024

5:55 min

Advantages and challenges of multi-tenant application architecture

Alper Ebicoglu Alper Ebicoglu · WWC 2025

2:05 min

Embracing high opinionation to simplify web application architecture

Daniel Hepper · LIVE

More from World Congress 2026 Europe - Virtual Stage

One Does Not Simply Make Architecture Decisions Alone thumbnail
36:15
28 days ago

One Does Not Simply Make Architecture Decisions Alone

Vladas Diržys

From Black Box to Glass Box : Bedrock AgentCore Observability thumbnail
21:15
about 1 month ago

From Black Box to Glass Box : Bedrock AgentCore Observability

Yasemin Aktürk

Leading in Rhythm: How Women Make Better Decisions with Biological Intelligence thumbnail
30:41
about 1 month ago

Leading in Rhythm: How Women Make Better Decisions with Biological Intelligence

Julia Grosse

Better Together: Leveraging Your Observability Tools as a SIEM thumbnail
39:06
about 1 month ago

Better Together: Leveraging Your Observability Tools as a SIEM

Mathias Palmersheim

ChatGPT Apps: From Chat to Checkout thumbnail
30:29
about 1 month ago

ChatGPT Apps: From Chat to Checkout

Aaron Koivunen

Interior Decorating (TypeScript Decorators) thumbnail
29:22
about 1 month ago

Interior Decorating (TypeScript Decorators)

Michael Dowden

Upcoming sessions on this topic

Open session

World Congress 2026 North America

Testing React Backends Like a Pro: Mocking Databases with SQLite

David Morris

Solution Architect

David Morris
Open session

World Congress 2026 North America

Fault Tolerance and Consistency at Scale: Harnessing the Power of Distributed SQL Databases

Wei Hu

Senior Vice President of Research and Development

Wei Hu
Open session

World Congress 2026 North America

Boring Failover: Predictable Region Recovery Across 5,000 Microservices

Sahil Sabharwal, Garvit Kataria

Sahil Sabharwal
Garvit Kataria
Open session

World Congress 2026 North America

From Cloud Native to Multi-Cloud Native: Write Once, Deploy Anywhere

Sandeep Pal

Principal Member of Technical Staff at Salesforce

Sandeep Pal
Open session

World Congress 2026 North America

Chat with Your Data: From Natural Language to SQL

Alper Ebicoglu

Co-founder of Volosoft

Alper Ebicoglu
Open session

World Congress 2026 North America

Databases in the Agent Era

Monica Sarbu

Founder and CEO of xata.io

Monica Sarbu

Related videos

Swapping a Data Warehouse at Runtime: Zero-Downtime Migration Without Changing a Single Client thumbnail
30:28
WWC Europe 2026 • about 1 month ago

Swapping a Data Warehouse at Runtime: Zero-Downtime Migration Without Changing a Single Client

Max Fischer, Michael O'Toole

Optimizing Discovery: PostgreSQL's Role in Transforming GetYourGuide's Search thumbnail
26:04
WWC 2025 • 12 months ago

Optimizing Discovery: PostgreSQL's Role in Transforming GetYourGuide's Search

Dharin Shah

Building Multi-Tenant ASP.NET Core Applications: Best Practices and Real-World Solutions thumbnail
28:44
WWC 2025 • 12 months ago

Building Multi-Tenant ASP.NET Core Applications: Best Practices and Real-World Solutions

Alper Ebicoglu

How building an industry DBMS differs from building a research one thumbnail
30:34
WWC 2023 • almost 3 years ago

How building an industry DBMS differs from building a research one

Markus Dreseler

Rate-limiting using eBPF and Istio: How to protect your SaaS customers from themselves thumbnail
31:32
WWC Europe 2026 • about 1 month ago

Rate-limiting using eBPF and Istio: How to protect your SaaS customers from themselves

Jan Mensch

Rapid GraphQL API Development with PostGraphile thumbnail
46:47
WWC 2021 • about 5 years ago

Rapid GraphQL API Development with PostGraphile

Ruwan Xaviour Fernando

Related articles

From learning to earning

Jobs that call for the skills explored in this talk.