Katkat
Back

Design a compliant multi-tenant analytics platform

PalantirSoftware Engineer · Onsite
MediumSoftware EngineerOnsiteSystem Design

Last updated

This question tests the ability to design a secure, scalable multi-tenant analytics platform that enforces strict data isolation and fine-grained access control while maintaining rigorous audit trails.

Problem Statement

Design a multi-tenant analytics platform that allows different enterprise clients (tenants) to upload datasets, run complex SQL-based analytical queries, and build visualizations. Each tenant must be strictly isolated from others, meaning no tenant should be able to access or infer the existence of another tenant's data.

Core Requirements

  1. Data Isolation: Ensure physical or logical separation such that cross-tenant data leakage is impossible.
  2. Access Control: Implement Attribute-Based Access Control (ABAC) to restrict access to specific rows and columns within a dataset based on user roles and sensitivity tags (e.g., PII, GDPR-restricted).
  3. Compliance & Auditing: Every query execution, data access, and configuration change must be logged in an immutable audit trail for forensic analysis.
  4. Scalability: The system should support thousands of concurrent users across hundreds of tenants, with varying query complexity.

System Constraints

  • The platform must handle petabyte-scale data.
  • Audit logs must be retained for 7 years and be queryable within seconds.
  • The system must support "Right to be Forgotten" requests, requiring the ability to purge specific user data across all storage layers.

Expectations

Your solution should cover:

  • High-level architecture and data storage strategy (e.g., shared vs. siloed DBs).
  • The AuthZ middleware design to enforce ABAC.
  • Data lineage tracking mechanisms.
  • Strategies for ensuring audit log integrity.
  • How the system detects and recovers from unauthorized access attempts.

Hints

Hint 1

Consider the trade-offs between shared-database multi-tenancy (using row-level security) and isolated-database multi-tenancy (using separate schemas or instances).

Hint 2

Think about how to offload authorization checks from the analytical engine by using a centralized sidecar or proxy layer to validate policies before execution.

Hint 3

For the audit trail, consider using a write-once-read-many (WORM) storage architecture to ensure logs cannot be tampered with by administrators.

Follow-up questions

  • How would you handle a cross-tenant data processing task if a global administrator needs to run a platform-wide security patch on data?
  • How do you ensure the latency added by the ABAC evaluation layer does not negatively impact the performance of complex analytical queries?
  • If a tenant reports a data leak, how would you use your lineage system to trace the origin of the exposure?