Separate Tenant Analytics Events
Trace event ownership through collection, joins, reports, and access controls.
An analytics dashboard can reveal tenant activity even when it never shows a customer record. Event names, counts, URLs, and user properties can expose account names or usage patterns. The event stream may also join data under a broad warehouse role. Treat analytics as another product data path, not as a harmless copy.
Build event lineage
Select one event that comes from a tenant-owned action. Record where the tenant ID is added, which fields are collected, how events are joined, and which dashboards can read the result.
| Stage | Question | Test evidence |
|---|---|---|
| Client or server emit | Is tenant identity verified or caller-supplied? | Event sample |
| Collector | Are sensitive properties excluded? | Schema and filters |
| Warehouse | Do joins preserve tenant ownership? | Query review |
| Dashboard | Who can see raw and aggregate views? | Role test |
| Retention | Can tenant data be removed or expired? | Policy and deletion test |
Use two synthetic tenants with distinct, non-sensitive event markers. Create events through normal product actions. Check that an A-scoped dashboard cannot display B rows, counts, or filters. Test a user who belongs to both tenants and a former member after access removal. If the dashboard is internal-only, document the staff grant and business need; “internal” is not an authorization policy.
A single tenant ID column does not secure a report. Aggregations, cached tiles, and exported CSVs can lose the filter. Tie each saved query and export to an owner and check the resulting bytes. Avoid logging full URLs when they contain IDs or tokens.
Check shared aggregates
Create a one-event synthetic tenant and inspect aggregate views. A low count can disclose activity even when no individual event row appears.
The OWASP Multi Tenant Security Cheat Sheet supports isolation across shared services. The OWASP authorization guidance supports a decision at each viewer. This lineage matrix lets a team find where a verified tenant context became an unchecked report parameter. If that point cannot be identified, hold any claim that the analytics view is tenant-isolated.
Find the gaps in your access controls
See how an illustrative cross-workspace finding connects evidence, impact and a fix. Discuss the tenant boundaries your team needs reviewed.