SaaS Platform - Different database user for each user or one master account <p>I have a SaaS platform that I am working on; written in PHP and using a MySQL database (using the PHP PDO class).</p> <p>The application is already functional and I have decided to use a separate database for each instance.</p> <p>One of the reasons for using multiple databases is to ensure that client data is separated (and hopefully secure). This also allows us to easily transfer their instance into the on-premise version.</p> <p>Security is always something that I worry about. I want to ensure this system is as secure as possible before it goes live.</p> <p>Currently we are using a single MySQL username &amp; password that has access to every database (on that specific MySQL Farm).</p> <p>Theoretically if there was a security breach then the attacker might be able to access a different database (username &amp; password is unset after the PDO/Database connection is made, but they might be able to run a query such as "use databaseB").</p> <p>Is this something that I should be concerned about? For example a SaaS platform that simply uses database partitioning is already less secure as a simple SQL error could expose client data.</p> <p>I've already started looking into using different database usernames &amp; passwords, but it does add to the complexity of the SaaS platform, and keeping things simple is always a good idea.</p> <p>Thanks!</p> <hr> <p>I have decided to go with different usernames and password for each instance.</p> <p>This is another layer of security and that cannot hurt.</p>