I Built an Open-Source Rust Proxy to Strengthen PostgreSQL Tenant Isolation

Description and use

An open‑source Rust proxy, Agata Proxima, adds a security layer between SaaS applications and PostgreSQL to prevent cross‑tenant data leaks.

Problem

In multi‑tenant SaaS applications, a missing tenant filter, incorrect authorization, or misconfigured policy can allow one tenant to access another tenant’s data.

Outcome

The proxy adds an extra security layer, reducing the risk of cross‑tenant data leaks while maintaining performance and visibility.

Workflow

• 1. Deploy Agata Proxima Engine between the SaaS application and PostgreSQL.
• 2. Configure tenant policies and security rules in the Agata Proxima platform.
• 3. Applications connect to the proxy instead of directly to PostgreSQL.
• 4. The proxy validates tenant identity, applies filters, and forwards queries to PostgreSQL.
• 5. All database activity is logged and auditable via the platform APIs.

Evidence

Developers rely on application-level authorization, tenant filters, and sometimes PostgreSQL Row-Level Security (RLS) to keep customer data isolated.

Source

Agata Proxima is a PostgreSQL security platform built around an open-source Rust proxy engine.

Source

The architecture introduces a security layer between applications and PostgreSQL: SaaS Application | Agata Proxima Engine (Rust Proxy) | PostgreSQL

Source