Data Protection Strategy for Multi-Tenant SaaS

This technical report outlines the data protection strategy implemented by a cloud-based software-as-a-service (SaaS) provider for managing sensitive financial documents in a multi-tenant environment. The organization utilizes Amazon Aurora to host MySQL databases, employing a multi-tenant architecture for efficiency. To enhance security, the company adopted a modern microservices architecture, requiring a data protection solution that supports customer-owned Bring Your Own Key (BYOK) capabilities. The report details the implementation of Baffle Data Protection, which applies row-level encryption to segment customer data, ensuring that each customer has their own encryption key. Customers can manage their Key Encryption Keys (KEK) and Data Encryption Keys (DEK), allowing them to control their data security. The solution has been successfully deployed, protecting terabytes of customer data and achieving high customer satisfaction. Future plans include advancing to Hold Your Own Key (HYOK) and developing a data storage agnostic platform.