Multi-tenant B2B data integration
Governed partner-data integration, isolated per tenant.
Partners deliver data over REST, secure file transfer, or upload. IntegraHive infers the schema, versions the contract, stages the records, applies governance, quarantines what breaks the contract, and flags anomalies — with tenant isolation enforced in the database, not in application code.
Tenant isolation enforced by database row-level security, not application filters
The pipeline
Seven stages between a partner file and trusted data
Each stage is observable and reversible. Nothing is silently dropped: records that break the contract are quarantined with a reason, not discarded.
1. Land
Capture intact
Data arrives in a tenant-isolated landing zone. A manifest and SHA-256 checksum are recorded; duplicate payloads are caught on arrival.
2. Infer
Read the real shape
The landed file is profiled to infer columns, types, and structure — without assuming the partner sent what was agreed.
3. Register
Version the contract
The inferred schema is registered as a version against the dataset contract, so every change is diffable and auditable over time.
4. Stage
Parse and prepare
Records are parsed and staged. Run status moves received → landed → parsed → loaded, with row counts tracked at each step.
5. Govern
Apply policy
Schema-drift policy (auto, review, block), field masking, and retention rules are enforced before data is accepted downstream.
6. Quarantine
Isolate, never drop
Records that breach the contract are quarantined with a reason code and diagnostic context — kept for review rather than silently discarded.
7. Detect
Surface drift
Statistical and ML detectors raise events for schema drift, value outliers, and threshold breaches, with severity surfaced to operators.
Intake
Partners deliver data the way they already work
Three intake paths converge on one governed pipeline, so behaviour does not fork by channel.
REST push
Partner-initiated
Partners POST CSV, JSON, or XML to a keyed ingestion endpoint. Every upload is checksummed and lands in a tenant-isolated zone.
REST pull
Scheduled
The platform pulls from a partner source on a schedule, with configurable auth, headers, and pagination.
Managed file transfer
SFTP and object stores
Secure transfer between sources and targets — SFTP, blob, and object stores — with credentials held in a managed vault and never in config.
Isolation
The boundary lives in the database
Application-level tenant filtering fails the moment one query forgets its WHERE clause. Moving the boundary into the database makes that class of bug unrepresentable.
Row-level security
Enforced by the database
Tenant isolation is a database policy bound to a least-privilege runtime role, not a WHERE clause the next query might forget. A missed filter in application code cannot cross the boundary.
Workload identity
No credentials in code
Secrets live only in a managed vault, referenced by workload identity. CI guards assert that a credentialed connection string cannot appear in infrastructure variables.
Fail-closed CI guards
Regressions break the build
Tests parse the Terraform variable files directly and assert the wiring: no password as a plain variable, no key in two maps at once, no development identifier reaching production config.
Reconstructable history
Built for audit
Schema versions, approvals, and access are logged, so what happened and when can be reconstructed after the fact.
Status: the control is implemented; end-to-end verification is still in progress. How it is being proved.
Engineering
Problems worth writing up
Notes from building it — including the parts that did not work the first time.
Proving an isolation control is harder than shipping it
The row-level-security probe ran and passed — but the one-shot pod was garbage-collected before its result envelope could be captured, so the run proved nothing. The gap between a control that works and evidence that a control works, and how the probe was redesigned to bind its verdict to durable evidence from the run that produced it. That redesign has not yet produced a clean passing run: the control is implemented, the end-to-end proof is still in progress.
The environment variable that did nothing
A public site URL was set as a runtime container variable. The framework inlines that class of variable at build time, and the page was statically prerendered — so the deployed configuration was inert and the live page served a stale hostname while the infrastructure config insisted otherwise.
A mutant killed by a timeout is not a passing test
In mutation testing, distinguishing a legitimate kill (the targeted assertion failed) from an accidental one (timeout, teardown, leftover state). Counting accidental kills as proof hides exactly the coverage gaps the campaign was run to find.
The long-form treatment is in the architecture whitepaper.