How we rebuilt a multi-tenant analytics layer in place — no big-bang rewrite.

One schema, every tenant, all the problems.

Every customer's data lived in one shared schema. As the biggest tenants grew, their queries slowed everyone else down — classic noisy neighbour — and a near-miss where one tenant's filter almost returned another's rows had made data isolation an executive-level worry.

A flag-day rewrite was off the table: the platform ran customers' live dashboards, and there was no maintenance window big enough to be safe.

Strangler pattern, one tenant a week.

We put a facade API in front of the data layer so callers stopped touching the schema directly. Behind it, we built the new per-tenant isolated path, then migrated tenants onto it a handful at a time on a weekly cadence — dual-writing and verifying before flipping reads, with a per-tenant rollback the whole way.

Nobody got a “we're migrating this weekend” email. Each Friday a few more tenants moved over and nothing visibly changed, which was the entire point.

The isolation, the migration, the safety net.

1. Put a facade API in front of everything.

   Callers moved to a single tenant-scoped API, decoupling them from the storage layout so we could change it underneath them.

2. Built per-tenant isolation.

   Each tenant got its own isolated schema with tenant-scoped indexes, enforced at the data layer so cross-tenant reads are impossible, not just discouraged.

3. Dual-wrote and backfilled.

   New writes went to both paths while we backfilled history, with a reconciliation job proving the two matched before any cutover.

4. Made cutovers boring.

   A migration tool flipped reads per tenant after verification, with an instant rollback if a single check failed.

5. Retired the old path on a schedule.

   Once every tenant was verified on the new path, we removed the shared-schema reads entirely and handed over the runbook.

Isolated, faster, and migrated by Friday habit.

Query p95 dropped 62%, cross-tenant leakage became structurally impossible, and the full migration landed in eleven weeks with zero downtime. The team kept the cutover tooling and the playbook for the next big architectural move.