What this covers
In a multi-tenant SaaS product, many customers share one system. The most damaging defects are the ones that let a tenant, role, or session cross a boundary it shouldn't.
Focus areas
- Tenant isolation. One tenant must not be able to read, change, or infer another tenant's data, through the UI or directly through the API.
- RBAC. Each role gets exactly the permissions it needs. I build a role-by-action permission matrix and test every cell that matters.
- Access boundaries. Direct object references, guessed IDs, and hidden endpoints.
- Authentication and session persistence. Whether sessions end when accounts are deactivated, roles change, or passwords reset.
- Cross-tenant access. Including what status codes reveal: a "forbidden" response can confirm a record exists where "not found" would not.
- Business logic. Tenant-specific pricing, promotions, limits, and workflows.
- Financial reconciliation. Totals, invoices, and ledgers checked across partial payments, cancelled and re-created batches, and returns.
- Audit and logging. Whether logs expose credentials, session tokens, or verification codes to users who can read them.
- Data integrity. Imports that drop rows, deletes that leave orphaned records, and duplicates.
Example findings
From Lead QA on PharmaConnect, a multi-tenant B2B pharmaceutical distribution platform tested across 6 user roles:
- A distributor manager able to perform the driver's full delivery workflow
- Deactivated users still able to log in, and unverified accounts authenticating without OTP or admin approval
- Audit logs exposing password hashes, session tokens, and live verification codes
- Overpayments accepted beyond the outstanding balance, corrupting invoice and revenue totals
- Expired promotional pricing still honored at checkout
- The API returning "forbidden" instead of "not found" for another tenant's orders
These came from 80+ documented defects, 11 of them P1, across 15 modules.
Common questions
How do you test multi-tenant SaaS?
Set up at least two tenants with every role, then try to cross every boundary: tenant to tenant, role to role, and UI to API. Check responses, stored data, and sessions, and record each attempt in a permission matrix so coverage is visible.
Can you test authentication and authorization?
Yes. That includes session lifecycle, deactivated and changed accounts, role permissions at the API level, and access to other tenants' records.