How do I isolate client data in Fast.io?

Create a separate organization or workspace per client. Permissions and storage are scoped to these containers, preventing cross-access. Intelligence Mode ensures RAG queries stay within the client's workspace.

Can Fast.io support multi-tenant SaaS applications?

Yes. The API allows dynamic creation of organizations and workspaces per tenant during signup. Granular permissions and per-workspace AI provide isolation without custom infrastructure.

What is the best way to structure Fast.io for multi-tenancy?

Assign one organization per tenant, with one or more workspaces inside. This mirrors standard SaaS patterns while leveraging Fast.io's native isolation.

Does Fast.io provide vector isolation for AI agents?

Yes. Intelligence Mode indexes files per workspace. RAG queries scope to folders or workspaces, guaranteeing no cross-tenant data leakage.

How do I onboard tenants programmatically?

Authenticate as your SaaS agent, POST /org/ for the tenant org, then POST /workspace/ inside it. Add tenant users as members.

Implementing Multi-Tenant Workspaces with Fast.io API

Multi-Tenant Basics and Fast.io Fit

Multi-tenant architecture lets one SaaS application serve multiple customers from a shared codebase and infrastructure while keeping their data separate. Fast.io supports this through its organization and workspace model. An organization acts as a tenant container, holding one or more workspaces for project-specific storage.

Workspaces provide the isolation layer. Files in one workspace stay separate from others, even within the same organization. Permissions apply at organization, workspace, folder, and file levels. For B2B SaaS, assign one organization per tenant, then create workspaces for their projects or teams.

This setup avoids shared storage pools where data leaks occur. Instead, each tenant's data lives in dedicated structures. Fast.io's API handles creation dynamically during tenant onboarding.

Workspaces as isolated containers within tenant organizations

Creating Tenant Organizations Programmatically

Start by authenticating with the Fast.io API using a service account or agent token. Agent accounts get 50 GB storage and 5,000 monthly credits free, with no credit card needed.

Use POST /current/org/ to create an organization for a new tenant:

curl -X POST https://api.fast.io/current/org/ \\
  -H "Authorization: Bearer YOUR_JWT" \\
  -d "name=Tenant Name" \\
  -d "domain=tenant1" \\
  -d "billing_plan=agent"

The response includes the org_id (19-digit number) or domain for future references. Organizations own billing and members. Add tenant admins with POST /current/org/{org_id}/member/.

For SaaS, trigger this on signup. Store the org_id in your database linked to the tenant record.

Handling Agent Accounts

Agents building for tenants use the free agent tier. When credits exhaust, transfer ownership to a human tenant admin via a claim link.

Provisioning Workspaces per Tenant

Once the organization exists, create workspaces inside it. Workspaces hold files, shares, and AI indexes.

curl -X POST https://api.fast.io/current/org/{org_id}/workspace/ \\
  -H "Authorization: Bearer YOUR_JWT" \\
  -d "folder_name=tenant-project-1" \\
  -d "name=Tenant Project Workspace"

Each workspace gets independent storage root. List them with GET /current/org/{org_id}/workspace/.

In multi-tenant SaaS, create one workspace per tenant project. This keeps data segmented even if tenants have multiple teams.

Multiple workspaces per tenant organization

Enforcing Data Isolation with Permissions

Fast.io permissions prevent cross-tenant access. Roles include owner, admin, member, guest, view-only.

Set at creation or update via member endpoints. For example, add a tenant user:

curl -X POST https://api.fast.io/current/org/{org_id}/member/ \\
  -H "Authorization: Bearer YOUR_JWT" \\
  -d "user_id=tenant-user-id" \\
  -d "role=admin"

Workspaces inherit org members but allow overrides. Files and folders have granular controls.

Audit logs track all actions across tenants. Query with GET /current/events/search/?org_id={org_id}.

Per-Tenant AI with Intelligence Mode

Enable Intelligence Mode on tenant workspaces for isolated RAG. Files auto-index for semantic search scoped to that workspace.

Toggle via API:

curl -X POST https://api.fast.io/current/workspace/{workspace_id}/intelligence/ \\
  -H "Authorization: Bearer YOUR_JWT" \\
  -d "enabled=true"

Queries stay within the workspace boundary, providing 100% vector isolation per tenant. Ask questions like "Summarize contracts in this workspace" – results cite only tenant files.

Attachments work without intelligence, but scoped RAG requires it. Costs: 10 credits/page ingestion.

Intelligence Mode indexing files per workspace for tenant isolation

Scaling and Best Practices

Follow these practices for robust multi-tenant setups:

Use one org per tenant for billing and top-level isolation.
Create workspaces per project or team within tenants.
Enable intelligence only on needed workspaces to save credits.
Use webhooks for tenant events like file uploads.
Monitor usage with GET /current/org/{org_id}/billing/usage/.
Transfer ownership for tenant handoff: POST /current/org/{org_id}/transfer/token/create/.

Handle rate limits (headers provided). Paginate lists with offset/limit.

Monitoring Tenant Activity and Compliance

Track tenant actions with activity polling: GET /current/activity/poll/{entity_id}.

Logs include uploads, views, permission changes. AI summarizes activity feeds.

For SaaS dashboards, aggregate per org_id. Set alerts on webhooks for high usage.

How to Implement Multi-Tenant Workspaces with Fast.io API