Single-Tenant

General definition

Single-Tenant architecture gives each customer a separate, dedicated copy of an application and its supporting infrastructure. The application code may be identical across customers, but the running instance, the database, the storage buckets and the configuration belong to one organisation only. Nothing is partitioned by a tenant identifier because there is only one tenant.

• Physical data boundary: the customer’s data lives in its own database and storage, which is easy to show to an auditor
• Independent configuration: retention periods, integrations, upgrade timing and region are chosen per customer
• Blast radius: an incident, a noisy neighbour or a misconfiguration in one instance cannot affect another customer
• Cost and operations: every instance needs its own monitoring, patching and backups, so single-tenant costs more to run than a shared platform

The opposite model is multi-tenancy, where one deployed instance serves many customers and software-enforced isolation keeps their data apart. Multi-tenant SaaS is cheaper and faster to provision; single-tenant is chosen when a regulation, a procurement policy or a risk assessment requires a boundary that can be inspected rather than trusted. Single-tenant instances are typically delivered as a dedicated server in the vendor’s cloud, inside the customer’s own cloud account, or on-premise.

Single-tenant is not the same as self-managed. A vendor can operate a single-tenant instance on the customer’s behalf (managed dedicated hosting, or bring your own cloud), which keeps the isolation benefits without the customer running the software themselves. It also does not imply data residency on its own; the region still has to be chosen deliberately.

In the Ethora ecosystem

Ethora offers both models. The managed cloud at app.chat.ethora.com is multi-tenant: every customer project is an App, an isolated server-side container with its own users, files, chats and data, and many Apps share one managed cluster. A dedicated server is single-tenant: Ethora TechOps run a separate instance inside the customer’s own AWS, DigitalOcean or other cloud account, or on-premise, and no other organisation shares it.

Regulated buyers in healthcare, finance and insurance usually pick the single-tenant option because it pairs with a BAA on Enterprise plans, a DPA, region choice for data residency (EU-only is possible) and an audit trail that covers one organisation only. Teams that want the isolation without the operations can also self-host the open-source server with Docker on their own infrastructure.