The degree to which an organization retains control over where data travels, how it is processed, and who can inspect it. In access architectures, strong data tenancy means sensitive traffic is not routinely exposed to a third-party service for routing or inspection.
Expanded Definition
Data tenancy describes the practical boundary between data that remains under an organisation’s direct control and data that is copied, routed, inspected, or processed by another party. In NHI and access architectures, the term matters because service accounts, API keys, and agent workflows often move data through layers of infrastructure that are not equally trustworthy.
Definitions vary across vendors, especially when cloud providers describe tenant isolation, regional residency, or inspection controls as if they were the same thing. They are not. Strong data tenancy is about the full path of control: where data is stored, which system can decrypt it, whether metadata is visible to intermediaries, and whether a third party can inspect traffic for security or support reasons. The closest governance alignment is with data minimisation and trust boundaries, not with simple network placement. NIST’s NIST Cybersecurity Framework 2.0 is useful here because it frames protection as a lifecycle and governance problem, not just an infrastructure setting.
The most common misapplication is treating “data in our cloud region” as equivalent to data tenancy, which occurs when routing, support tooling, or shared inspection services still receive readable content.
Examples and Use Cases
Implementing data tenancy rigorously often introduces routing and inspection constraints, requiring organisations to weigh operational visibility against reduced third-party access.
- A customer support agent platform can process ticket metadata while keeping message bodies encrypted end to end, so the provider never inspects sensitive content.
- An internal AI agent may retrieve records from approved systems, but only through a tenant-bound gateway that logs access and blocks cross-customer exposure.
- A service account used by CI/CD tools can write deployment artifacts without sending secrets through a shared proxy that might cache or inspect them.
- Multi-region storage can preserve tenancy by constraining where data rests, but only if decryption keys also stay under the organisation’s control.
- As highlighted in the Ultimate Guide to NHIs — Key Research and Survey Results, third-party exposure is common, which makes tenancy decisions especially relevant for service accounts and API-driven workflows.
For guidance on how boundaries should be expressed in access and governance terms, the NIST Cybersecurity Framework 2.0 helps frame accountability across systems rather than assuming the network layer is sufficient.
Why It Matters in NHI Security
Data tenancy is a control issue, not a branding issue. When it is weak, non-human identities can move secrets, logs, payloads, and telemetry into environments where another party can observe more than intended. That becomes especially dangerous when agents operate with standing credentials, because the path they use to fetch data can become the path an attacker uses to exfiltrate it.
This is where the scale of the NHI problem matters. NHI Mgmt Group reports that only 5.7% of organisations have full visibility into their service accounts, and 92% expose NHIs to third parties, raising supply chain concerns. Those conditions make tenancy failures harder to detect and easier to rationalise away as normal cloud behaviour. The Ultimate Guide to NHIs — Key Research and Survey Results shows why this is not theoretical: weak visibility and broad exposure combine into persistent governance gaps.
Organisations typically encounter the consequences only after a data review, incident investigation, or customer escalation reveals that a third-party service had read access to information that was assumed to remain tenant-bound, at which point data tenancy becomes operationally unavoidable to address.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Non-Human Identity Top 10 address the attack and risk surface, while NIST CSF 2.0 and NIST Zero Trust (SP 800-207) set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST CSF 2.0 | PR.DS | Data tenancy directly concerns how data is stored, protected, and shared across trust boundaries. |
| NIST Zero Trust (SP 800-207) | SC | Zero Trust requires explicit control over data paths and trust boundaries for every access request. |
| OWASP Non-Human Identity Top 10 | NHI-01 | NHI governance addresses exposure of service accounts and secret-bearing workflows to external parties. |
Restrict NHI data paths so secrets and payloads never leave approved tenant boundaries unnecessarily.
