Choose by what you must control. Multi-tenant is usually patched faster and easier to operate. Single-tenant gives stronger separation and more control over timing and location. Customer hosted gives the most control and puts patching on you. None is automatically safer, so ask how each is run.
Definitions
Multi-tenant: many customers share the same running application and infrastructure, separated by software controls.
Single-tenant (dedicated hosted): the vendor runs a separate instance for you, often with its own database and sometimes its own network.
Customer hosted: you run the software in your own data center or cloud account.
Comparison
| Question | Multi-tenant | Single-tenant hosted | Customer hosted |
|---|---|---|---|
| Who patches | Vendor, for everyone at once | Vendor, often on a per customer schedule | You |
| Isolation | Software separation | Stronger, instance level | Fully yours |
| Data location | Vendor's regions | Often selectable | You choose |
| Upgrade timing | Vendor decides | Negotiable | You decide |
| Exit | Export only | Export or image | You keep the install |
| Operating effort for you | Low | Low to moderate | High |
What each choice changes for security
Patching. In multi-tenant, one fix reaches all customers, so a vendor can close a flaw quickly. In single-tenant, the speed depends on whether the vendor rolls fixes across instances or waits for your window. In customer hosted, you inherit the work. NIST SP 800-40 Rev. 4 describes patching as identifying, prioritizing, acquiring, installing and verifying updates. In customer hosted, you do all five steps.
Isolation. Multi-tenant means a flaw in tenant separation can expose other customers. That is a design risk the vendor must manage. Ask how they test it. Single-tenant lowers the shared surface but not to zero, since the vendor's management plane may still reach many instances.
Location. NCSC advises customers to know where data is stored, processed and managed. Dedicated instances can often be placed in a region you choose. Multi-tenant platforms may offer fewer options.
Exit. Customer hosted software keeps working if the vendor disappears, though without fixes. Hosted options depend on the vendor for continuity.
Questions to ask
- How is one customer's data separated from another's, and who tests it?
- Can I choose the region, and which copies stay there?
- Who controls upgrade timing, and can I defer a non security release?
- How do you patch single-tenant instances, one at a time or together?
- What do I receive at exit, and in what format?
- Can the vendor's staff reach my instance, and how is that logged?
How to decide
Start with your constraints. If a law or contract requires a stated location or dedicated infrastructure, that narrows the options. If you lack staff to patch, customer hosted costs more than it looks. If you need tight control over change timing, multi-tenant may not fit.
Write the decision down with the reasons, so that the next reviewer sees why.
Quick check
Is single-tenant always more secure?
No. Separation is stronger, but patching speed and the vendor's management access still matter.
Who patches customer hosted software?
You do. The vendor supplies the fixes, but installing and verifying them is your job.
Safeguard supports customer side verification with SBOM and dependency scanning and continuous monitoring.
Sources
- NIST SP 800-40 Rev. 4, Guide to Enterprise Patch Management Planning
- NCSC Cloud Security Principle 2: Asset protection and resilience
Last reviewed: 19 October 2026.
