The short answer
Standard multi-tenancy protects stored data. AI features add paths where one customer's information can reach another: shared caches, retrieval indexes, context construction and anything trained or tuned on customer data.
Those paths need deliberate design, and buyers will ask about them during due diligence.
The AI-specific leakage paths
| Path | Risk |
|---|---|
| Shared retrieval index | Retrieval returns another tenant's content |
| Response caching | A cached answer built from other data is served |
| Context construction | A bug includes the wrong tenant's records |
| Fine tuning on customer data | Information becomes part of the model |
| Logs and traces | Customer content in shared observability |
The fourth is the one to decide policy on early. Training on customer data is difficult to reverse and buyers ask about it directly.
Enforce tenancy at the lowest level
- Carry tenant identity through every layer, never inferred from the request body.
- Filter at the data layer, not in application code that can be bypassed.
- Include the tenant in every cache key, without exception.
- Partition retrieval indexes or filter at query time with tests proving it.
- Test cross-tenant access deliberately, as part of the suite.
Point five is what actually catches regressions. A test that asserts tenant A cannot retrieve tenant B's content should fail loudly when someone refactors retrieval.
What buyers will ask
- Is our data used to train or improve models
- Where is it processed and stored
- Which subprocessors see it
- How long is it retained, including in logs
- Can we get it deleted, and is that verifiable
Have written answers before the first serious buyer asks. Improvising during a security review costs deals.
Dedicated instances are a business decision
Larger customers sometimes require dedicated infrastructure. That is a pricing and operations decision more than a technical one, because it changes deployment, upgrades and support.
Decide whether you will offer it before a large prospect asks, rather than agreeing under deal pressure and discovering the cost afterwards.