Multi-Tenant SaaS Penetration Testing
CREST-accredited penetration testing for multi-tenant SaaS, white-label platforms and shared-database products. We test whether one customer can read, change or delete another customer’s data through the app, the API, exports, background jobs and your database’s row-level security. Fixed quote in 24 hours.
- Unlimited retesting
- Unlimited pre-retesting
- No hidden fees
“I would highly recommend EJN Labs to any organisation seeking reliable, detailed, and well-managed penetration testing services, particularly for government or enterprise-level projects.”
“There wasn’t another company we could find that could deliver what we needed in the timeframe we needed. The client loved it, and we got instant ROI from the engagement.”
tenants, each with at least two roles, is the minimum test setup we ask for. Without a second tenant, isolation cannot be tested at all.
Tenant Isolation Is the Test Your Customers Care About
What isolation means. Every request has to be checked against the tenant that owns the data, not just the user who is logged in. We test object IDs, API filters, search, exports, file storage, shared caches and background jobs, because a single path that forgets the tenant check is enough to expose another customer.
Row-level security. Platforms built on PostgreSQL, Supabase or Firebase often push tenancy into database policies. We test the policies themselves, how tenant and role claims reach them, and the server-side functions and service keys that bypass them.
Why buyers ask. Enterprise customers ask about tenant isolation in security questionnaires, and SOC 2 auditors commonly expect a recent third-party test. The AICPA criteria list penetration testing as one example of an evaluation (CC4.1) rather than a requirement, so the test is how you evidence the control, not a box on its own.
Who we test for. B2B and vertical SaaS vendors, white-label platforms with custom domains, and products where customers invite their own users and appoint their own administrators. See our SaaS penetration testing page for the wider picture.
SCOPE
What We Test in a Multi-Tenant Platform
Cross-Tenant Reads & Writes
Swapping object, organisation and file IDs between tenants, across every role. Reads, updates, deletes and state changes, not just page views.
Row-Level Security Policies
PostgreSQL and Supabase policies, Firebase rules, JWT tenant and role claims, and every server-side path that runs with elevated keys.
Tenant-Scoped APIs
Broken object-level authorisation, list endpoints that ignore the tenant filter, GraphQL resolvers, bulk and export endpoints, API keys scoped to one tenant.
SSO, Invites & Provisioning
Organisation invites, SAML and OIDC login, just-in-time and SCIM provisioning, account linking and custom domains. Can someone join the wrong organisation?
Delegated Admins & Support Access
Customer administrators, your own support staff and impersonation features. What an admin in one tenant can do to another, and what your staff can see.
Exports, Jobs & Caches
Scheduled reports, CSV exports, webhooks, search indexes and caches that run outside the request and can lose the tenant context.
Shared Infrastructure
Storage buckets, queues and secrets shared between tenants, and the IAM that separates them.
OUR PROCESS
From Scope to Attestation in 4-6 Weeks
Scoping Call
30-minute call to map tenants, roles and the objects each role can touch. Fixed-price quote within 24 hours.
Test Tenants
You provide at least two tenants with two roles each in a staging environment that mirrors production tenancy.
Active Testing
3-15 days of hands-on testing by CREST-certified pen testers, crossing every tenant and role boundary. Live findings in your client portal.
Report & Retest
CVSS-scored report with a tenant and role matrix, walkthrough call, free retest and a letter of attestation for customers and auditors.
CREDENTIALS
Verified Accreditations Auditors Accept
Every credential below is independently verifiable. UK procurement teams, FCA supervisors, ISO 27001 / SOC 2 auditors, and cyber insurance underwriters all recognise these standards.
GET YOUR QUOTE
Get a CREST multi-tenant SaaS pen test quote in 24 hours
A fixed-price quote back in one business day, from a named CREST assessor. No sales pipeline, no chasing.
- CREST and IASME accredited. Testing your auditors and clients already recognise.
- Fast-track testing within 24 hours where required. Free retest of every fix included.
- Live findings via your client portal, not a four-week PDF.
- Fixed price from £3,500 for a single-role, single-app scope, agreed up front. Most engagements run £5,000 and up. No day-rate surprises.
Dan WilcocksonFounder, CelloriUnder NDA Further named references available on a scoping call.
- We reply within one business day with a fixed-price quote from a named CREST assessor.
- You approve the scope and we book a start date, usually within 24 hours.
- Live findings land in your client portal as we test, with a free retest of every fix.
Get your fixed pen test quote in 24 hours
Quote request received
We will reply within one business day with your fixed-price quote from a named CREST assessor.
Your data stays with us. No newsletter signup.
or book a 20-min scoping call first
We reply within one business day. Your data stays with us. No newsletter signup.
COMPLIANCE READY
Reports Aligned to Every Framework
Findings map to specific control references in each framework, so your audit team submits the report directly without translation work.
SOC 2
Evidence for the evaluations your auditor reviews under CC4.1.
ISO 27001
Annex A 8.8 technical vulnerability management, once you declare that control applicable.
OWASP ASVS
Access control findings mapped to the Application Security Verification Standard.
OWASP API Top 10
Broken object-level authorisation and related API findings mapped by category.
UK GDPR
Article 32(1)(d) evidence that you regularly test the effectiveness of your security measures.
Customer Questionnaires
An independent report you can attach to enterprise security questionnaires.
PRICING
Transparent Multi-Tenant SaaS Pen Testing Pricing
Pricing depends on the number of roles, tenant-scoped objects and integrations in scope. The day count flexes; the included deliverables stay the same across all engagements.
Depends on app complexity
Single user role, basic CRUD application, marketing website with auth. Around 5 working days from kickoff to report.
Get a fixed quoteDepends on app complexity
Multi-role SaaS, business application with payment integration. Around 8 to 12 working days from kickoff to report.
Get a fixed quoteDepends on app complexity
Multi-tenant platform, complex authorisation matrix, integration-heavy applications. Around 15 to 20 working days from kickoff to report.
Get a fixed quoteWHY EJN LABS
What You Get From Multi-Tenant SaaS Penetration Testing
Six concrete differentiators competitors don’t all match.
CREST-Certified Testers, Verifiable
Every test by a CREST-certified pen tester (CRT, CCT APP, CCT INF where applicable). Verify our company status at crest-approved.org.
24-Hour Startup, Where Required
From signed scope to active testing in a single business day for incident response, audit deadlines, or regulator-driven timelines.
Live Findings, Not 4-Week PDFs
Critical issues reported during testing through your client portal. Your team remediates while testing continues.
Audit-Ready Reports
Executive summary plus full technical report with CVSS scores and explicit framework mappings (ISO 27001, SOC 2, PCI DSS, FCA SYSC).
Free Retests, Standard
Verify remediation of every finding before close-out. Letter of attestation for audit submission included. Most competitors charge £1,500-£3,000 per retest.
UK-Based CREST Testers
Every engagement performed by vetted, UK-based CREST-certified testers, matched to your needs, security clearance, and compliance scope.
FAQ
Frequently Asked
What is tenant isolation testing?
Testing whether one customer of your platform can read, change or delete another customer’s data. We cross every tenant and role boundary through the user interface, the API, exports, files and background jobs, and report each path that leaks.
What do you need from us?
A staging environment with at least two tenants and two roles in each, API documentation if you have it, and a note of any features that run outside the request, such as scheduled exports or webhooks.
Do you test Supabase and PostgreSQL row-level security?
Yes. We test the policies, how tenant and role claims reach them, and the server-side functions and service keys that bypass them. See our Supabase and Firebase pages.
Does SOC 2 require a penetration test?
No. SOC 2 lists penetration testing as one example of an evaluation under CC4.1, not a requirement. In practice auditors commonly expect a recent third-party test, and enterprise customers often ask for one directly.
Can you test a white-label platform with custom domains?
Yes. We test how custom domains map to tenants, whether sessions or cookies cross between them, and whether branding or configuration from one tenant can affect another.
Can you test in production?
We prefer staging with production-like tenancy. If production is the only option, we agree limits on destructive actions and use test tenants you create for us.
What’s in the report?
Executive summary (board-ready), technical report with CVSS 3.1 scores, a tenant and role matrix, reproduction steps, screenshots, specific remediation guidance, and a 60-minute walkthrough call. Letter of attestation issued after free retest.
Do you sign NDAs?
Yes. We sign client-supplied NDAs as standard. Engagement data is protected under our ISO 27001 (BSI-audited) information security management system.
How quickly can you start?
From signed scope to active testing in 24 hours where required. Standard pipeline is 3-5 business days from initial scoping call to test start.
Are your testers UK-based and what certifications do they hold?
Every engagement is performed by vetted UK-based CREST-certified testers matched to your engagement based on security clearance, compliance scope, and sector specialism. Testers hold CREST certifications relevant to their discipline (CRT, CCT APP, CCT INF, CCSAM).
20+ CREST-accredited testing services in one place
Web, mobile, API, cloud, AI, infrastructure, red team. Pick the test that fits your environment.
Get my multi-tenant SaaS pen test scope
Tell us how many tenants, roles and integrations you run. A CREST-certified pen tester will contact you within one business day with a fixed price.
