How Do You Test Tenant Isolation in SaaS Data Exports?
Tenant isolation is more than filtering the screen by customer. Export queries, background tasks, file storage and download links must enforce the same customer authorisation. Tests must…
What’s in this article?
Short answer
Tenant isolation is more than filtering the screen by customer. Export queries, background tasks, file storage and download links must enforce the same customer authorisation. Tests must separately verify that one customer’s report identifier cannot provide access to another customer’s file.
Isolation must continue in the report queue
Do not trust a tenant parameter selected by the user as an identity. The server must check which reports that user may create in the customer space. Queued tasks need tenant identity, report scope and authorisation context; workers must query within that boundary. Authorisation at task creation does not justify publicly downloadable output.
A filename or hard-to-guess URL does not replace access control. Verify current user permissions again at download time. If temporary links are used, define sharing risks, validity periods and revocation requirements. Acceptance tests must cover attempted downloads through old links by users whose access has been revoked.
Make report scope visually checkable
Show the selected period, customer space and creation time in the file. These details facilitate operational checks; they are not security mechanisms. A cache key without tenant identity may return a report to the wrong customer. Identical report parameters used by two tenants therefore require a specific test.
Temporary support access must also be reflected in the report system. Record delegated permissions or exception roles explicitly; a generic “admin” label must not make unrestricted customer-file downloads the default. OWASP’s object-level authorisation approach can guide checks of report and file identifiers.
Make negative tests a delivery requirement
Create differently marked sample records in two test tenants. Have the first user attempt the second tenant’s report ID, file URL and filter parameters. Verify preservation of tenant context in queued tasks and separation of cache keys. Output must not contain the other tenant’s marker. Run these tests separately for every report type and role.
Implementation checklist
- Is tenant identity verified on the server?
- Does the worker use the same data boundary?
- Is download authorised separately?
- Is the cache separated by customer context?
- Were negative tests run with another tenant’s identity?
Frequently asked questions
Does using UUIDs provide isolation?
It may make guessing harder; it does not replace authorisation checks.
What if access is revoked while the report completes?
Check current access at download time; previous creation permission must not grant unlimited download rights.
Scope and limitations
These tests cover a particular export workflow. Verify tenant isolation separately across all APIs, files and background operations.
Sources and currency
Source review: 7 October 2026. Linked document versions and provider terms may change. Check the current version of the relevant source before implementation.