Building a sovereign B2B SaaS with Lampion

Your business contact is sold, then the file reaches the security lead and the legal counsel. The same questions arrive: where is our data, who can read it, how do you guarantee another customer cannot reach it, and how do we get it back if we leave. None of them can be answered after the fact.

The first two are settled in steps 01 and 03. The other two then follow almost on their own.

This is the most common mistake: a database hosted in France, and the rest of the service at a non-European provider. But personal data does not stay in the database. It goes through the API, gets written to logs, lands in a cache, ends up in a transactional email and in the backups of all of the above. Every piece hosted elsewhere is a copy elsewhere.

Why the operator matters as much as the region

On Lampion, every project is a tenant of the storage engine: its pages, its WAL and its files in object storage are kept under its own identifier. Since October 10, 2026, the page server checks a project-specific token on every read: a compute only reads pages from its own tenant. Every project also has its own history — restoring one project to a point in time touches no other project — and deleting a project deletes its tenant, on the page server, the safekeeper and object storage.

What one project per customer gives you

The price: one migration and one connection string per customer. Startup allows up to 1,000 projects, Souverain far more; beyond a few dozen customers, the shared schema remains the simplest to run.

That gives you two ways to separate your customers. One project per customer: isolation goes all the way down to storage, and every customer has its own history, restore and erasure. A shared schema with row-level security: all customers in one project, filtered by the PostgreSQL engine. The two mix well — your large accounts in their own project, everyone else in a shared one — and the rest of this step sets up the second, which takes the most discipline.

-- Every table holding customer data carries a tenant_id.
CREATE TABLE tenants (
  id         uuid PRIMARY KEY DEFAULT gen_random_uuid(),
  slug       text UNIQUE NOT NULL,
  created_at timestamptz NOT NULL DEFAULT now()
);

CREATE TABLE orders (
  id         uuid PRIMARY KEY DEFAULT gen_random_uuid(),
  tenant_id  uuid NOT NULL REFERENCES tenants(id) ON DELETE CASCADE,
  amount_cts integer NOT NULL CHECK (amount_cts >= 0),
  created_at timestamptz NOT NULL DEFAULT now()
);

CREATE INDEX orders_tenant_created_idx
  ON orders (tenant_id, created_at DESC);

-- The engine filters, not just the application code.
ALTER TABLE orders ENABLE ROW LEVEL SECURITY;
-- FORCE: the policy also applies to the table owner.
ALTER TABLE orders FORCE ROW LEVEL SECURITY;

CREATE POLICY tenant_isolation ON orders
  USING      (tenant_id = NULLIF(current_setting('app.tenant_id', true), '')::uuid)
  WITH CHECK (tenant_id = NULLIF(current_setting('app.tenant_id', true), '')::uuid);

-- The application role is never the owner.
GRANT SELECT, INSERT, UPDATE, DELETE ON orders TO app_user;
GRANT SELECT ON tenants TO app_user;

# The application role, then its connection string
$ export APP_PASSWORD="$(openssl rand -hex 24)"
$ lampion roles create 4f9c21ab8d3e47b0a6c95e1d2b3f7a08 ep-4f9c21ab8d3e app_user --password "$APP_PASSWORD"
Role 'app_user' created.
$ export DATABASE_URL="postgresql://app_user:[email protected]:5432/ep-4f9c21ab8d3e.postgres?sslmode=require"

# Apply the schema and the policies
$ psql "$ADMIN_DATABASE_URL" -v ON_ERROR_STOP=1 -f schema.sql -f policies.sql

# One test row, written by the owner
$ psql "$ADMIN_DATABASE_URL" -c "INSERT INTO tenants (slug) VALUES ('acme')"
$ psql "$ADMIN_DATABASE_URL" -c "INSERT INTO orders (tenant_id, amount_cts) SELECT id, 1000 FROM tenants"

# Read back by the application, with no tenant set: the policy returns nothing
$ psql "$DATABASE_URL" -c "SELECT count(*) FROM orders"
 count 
-------
     0

# A branch forked from main, deleted automatically after 72 h
$ lampion branches create 4f9c21ab8d3e47b0a6c95e1d2b3f7a08 pr-482 --parent 4f9c21ab8d3e47b0a6c95e1d2b3f7a08 --ttl 72
Branch created: 9b2e7c41d0a54f3e8c6a1b7d2e9f0c35 (pr-482)

# An ephemeral database per pull request: deleted on close, TTL as a safety net
name: preview
on:
  pull_request:
    types: [opened, synchronize, reopened, closed]

# One run at a time per pull request: two pushes in quick succession do not create two branches.
concurrency: preview-${{ github.event.number }}

env:
  LAMPION_TOKEN: ${{ secrets.LAMPION_TOKEN }}
  PROJECT_ID: 4f9c21ab8d3e47b0a6c95e1d2b3f7a08
  BRANCH: pr-${{ github.event.number }}

jobs:
  test:
    if: github.event.action != 'closed'
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-python@v5
        with:
          python-version: '3.12'
      - run: pip install lampion-cli

      - name: Create the branch on the first run, reset it afterwards
        run: |
          BRANCH_ID=$(lampion branches list "$PROJECT_ID" --json \
            | jq -r --arg b "$BRANCH" '.[] | select(.name == $b) | .id')
          if [ -z "$BRANCH_ID" ]; then
            # 72 h TTL: the safety net if the cleanup job does not run
            lampion branches create "$PROJECT_ID" "$BRANCH" \
              --parent "$PROJECT_ID" --ttl 72 --json
          else
            # Later push: start again from main's current state
            lampion branches reset "$PROJECT_ID" "$BRANCH_ID" --yes
          fi

      - name: Fetch its URL
        run: |
          URL=$(lampion endpoints list "$PROJECT_ID" --json \
            | jq -r --arg b "$BRANCH" '.[] | select(.name == $b) | .connection_string')
          echo "::add-mask::$URL"
          echo "ADMIN_DATABASE_URL=$URL" >> "$GITHUB_ENV"

      - name: Migrations and tests
        run: |
          npm ci
          npm run migrate   # the PR's migrations, against the copy of production
          npm test

  cleanup:
    if: github.event.action == 'closed'
    runs-on: ubuntu-latest
    steps:
      - uses: actions/setup-python@v5
        with:
          python-version: '3.12'
      - run: pip install lampion-cli

      - name: Delete the branch
        run: |
          BRANCH_ID=$(lampion branches list "$PROJECT_ID" --json \
            | jq -r --arg b "$BRANCH" '.[] | select(.name == $b) | .id')
          # Empty if the TTL already deleted it: nothing to do
          if [ -n "$BRANCH_ID" ]; then
            lampion branches delete "$PROJECT_ID" "$BRANCH_ID"
          fi

There is no per-branch fee, on any plan — only the compute you burn and the storage you keep are billed. An idle branch suspends after five minutes. To go further and run the tests against masked data, there is a dedicated article.

Testing on masked production data, on every pull request →

# The pre-filled questionnaire, to hand to your AI assistant
$ lampion compliance questionnaire --format md -o questionnaire.md

# Accept the DPA on behalf of the company, then download the certificate
$ lampion compliance dpa-accept --company "Acme SAS" --signer "Camille Martin" --title "CEO"
$ lampion compliance dpa-certificate --pdf dpa-attestation.pdf

# The residency report and the list of subprocessors
$ lampion compliance residency --pdf residence.pdf
$ lampion compliance subprocessors

The same documents, from the command line. Every questionnaire answer carries a status — yes, partial, no, planned — that the assistant must not round up. Only the organization owner can accept the DPA. Documents are in French by default; --locale en gives the English version.