Multi-tenancy for an operator
Weigh it accordingly.
What multi-tenant means here
One mediator deployment serving many operators, each with their own agents, mediations, policies, API keys and delivery logs. An operator sees its own tenancy; the mediator routes for all of them.
That is the shape difference from a deployable image you run in your own cloud, which serves one organisation by construction. Both shapes are legitimate, see vs Indicio, whose mediator takes the single-cloud approach and is more production-ready than ours.
Who it is actually for
A party mediating on behalf of others. A wallet vendor whose users all need mediation; a platform onboarding many agents; an issuer serving holders it does not employ. Without multi-tenancy each of those becomes "run a mediator per customer", which is the operational floor (what routing a message costs) multiplied by your customer count.
If you are one organisation mediating your own agents, you do not need this. Self-hosting a single-tenant mediator is simpler and puts nobody else in your path, vs running your own.
What isolation does and does not mean
Does: operator-scoped agents, mediations, policies, API keys and delivery logs. One operator's console shows one operator's data.
Does not: hide tenants from the mediator. All tenancies share one deployment, so the infrastructure sees all routing metadata across all of them. Isolation is between tenants, not between a tenant and the operator of the platform, which is us.
And a subtlety worth stating rather than leaving to be discovered: a shared deployment means a larger mixed traffic pool, which is mildly better for herd privacy than a single-tenant mediator, while also concentrating more metadata in one place. Both are true. Herd privacy covers why our pool is small today anyway, and what a mediator can and cannot see covers the rest.
The questions to ask any multi-tenant mediator
- What is scoped per tenant, exactly? Ask for the list, not the adjective.
- Who can read across tenancies? There is always someone. The answer should be a named role, not "nobody".
- What happens to my tenancy's queued messages if the platform stops? For us, beta and no SLA means: plan for it.
- Has the isolation been independently reviewed? For us the answer is no. There is no audit.
We would rather you asked us those than assumed favourable answers.