Designing Multi‑tenant SaaS for Kenyan Banking Compliance

What you need to decide up front

You have three viable ways to isolate tenants in a banking SaaS platform:

1. Separate instances, each bank gets its own full stack (database, container, VM).
2. Separate schemas, a single database server hosts a distinct schema per bank.
3. Shared schema with tenant_id, all banks share tables, and every row carries a tenant identifier.

Your choice drives cost, operational complexity, and how easily you can prove compliance with Kenya’s Data Protection Act 2019 and any KYC regulations that apply.

How the options line up against Kenyan banking constraints

If the bank’s regulator demands hard isolation for KYC records, separate instances are the safest bet. If the budget is tight and the regulator accepts technical controls (row‑level security, immutable audit logs), a shared schema can work.

Building the compliance foundation

1. Pin data to Kenya

Select a cloud provider that offers a Kenya region or a local colocation partner. In Pulumi, you would set the region explicitly:

import * as aws from "@pulumi/aws";

const db = new aws.rds.Instance("bank-db", {
    engine: "postgres",
    instanceClass: "db.t3.medium",
    allocatedStorage: 100,
    region: "af-south-1", // replace with Kenya region when available
    storageEncrypted: true,
});

The region field guarantees that the underlying storage lives in Kenya. Include this requirement in the procurement contract.

2. Encrypt KYC fields

All KYC attributes must be encrypted at rest. Use PostgreSQL’s pgcrypto extension for column‑level encryption:

CREATE EXTENSION IF NOT EXISTS pgcrypto;

ALTER TABLE customers
    ALTER COLUMN id_document TYPE bytea
    USING encrypt(id_document::bytea, gen_salt('bf'), 'bf');

Transport encryption is mandatory; enforce TLS 1.2+ on every API endpoint and database connection.

3. Identity and access management

Keycloak is the open‑source choice we use for multi‑tenant identity. For banking, configure realms per tenant when you need strong isolation, or client scopes with fine‑grained role mappings for shared‑schema setups. The guide we published on Keycloak tenancy walks through both patterns: Saa S Multi Tenant Approaches Using Keycloak

4. Auditing and monitoring

Regulators expect immutable logs of who accessed which KYC record and when. Deploy Grafana + Prometheus dashboards that capture:

• Authentication events from Keycloak
• Database query logs filtered by tenant_id
• Alert rules for anomalous access patterns

Our system‑orchestration service sets up this stack and hands over a runbook: system orchestration

The delivery rhythm that keeps compliance on track

Afriq Silicon runs every project in two‑week sprints. The first sprint after kickoff is always a compliance sprint that produces:

• Architecture diagram locked to Kenya region
• Terraform/Pulumi code for encrypted storage
• Keycloak realm or client‑scope configuration
• A minimal audit‑log test suite

Subsequent sprints add business features while the compliance artefacts remain immutable. This approach matches the discovery‑proposal‑milestone flow described on our process page: how we work

When you need to switch tenancy models later

If you start with a shared schema and later need stronger isolation, plan a migration sprint:

1. Export each tenant’s data to CSV (or Parquet) using COPY TO.
2. Spin up a new instance or schema.
3. Load data with COPY FROM.
4. Update the API gateway to route the tenant to its new backend.

Because the migration is a bounded sprint, you can include it in the original proposal as an optional phase.

Checklist for the procurement team

• Confirm that the cloud contract guarantees data residency in Kenya.
• Require encryption of all KYC columns and TLS 1.2+ for APIs.
• Ask the vendor to show Keycloak realm or client‑scope design.
• Insist on immutable audit logs and a Grafana dashboard for regulator review.
• Include a migration clause if you might change tenancy models later.

If you follow this checklist and align the architecture with the three isolation options, you’ll have a SaaS platform that meets Kenyan banking compliance without surprise later.

Ready to turn these notes into a production system? Talk to our team about it.

Photo by Christina Morillo on Pexels.