v3.6 — now on npm

Multi-tenancy that flows

Hierarchical tenant trees with config inheritance, permission delegation, and three isolation strategies. Built for MSSP/MSP/client architectures. Add to any Node.js stack in minutes.

Quick Start View on GitHub

npm install @stratum-hq/lib

Everything you need for multi-tenancy

One library. No vendor lock-in. Works with your existing stack.

🌳

Tenant Hierarchy

Tree-structured tenants with PostgreSQL ltree. Advisory locks prevent race conditions. Up to 20 levels deep.

⬇️

Config Inheritance

Values flow root to leaf. Children inherit, override, or are blocked by locked keys. Batch updates with partial success.

🔐

Permission Delegation

LOCKED, INHERITED, or DELEGATED modes. Cascade, soft, or permanent revocation. Full control over permission flow.

🛡️

Three Isolation Strategies

Shared RLS, schema-per-tenant, or database-per-tenant. Pick per tenant. Mix strategies in one deployment.

🔒

Field Encryption + GDPR

AES-256-GCM for sensitive values. Data export (Article 20) and hard purge (Article 17). Consent tracking built in.

📊

Audit + Observability

Every mutation logged with actor identity. Optional OpenTelemetry tracing. Redis-backed rate limiting. Webhook events with DLQ.

Simple to integrate

Five lines to hierarchical multi-tenancy.

import { Pool } from "pg";
import { Stratum } from "@stratum-hq/lib";

const stratum = new Stratum({ pool: new Pool() });

// Create a hierarchy
const root = await stratum.createTenant({ name: "AcmeSec", slug: "acmesec" });
const msp  = await stratum.createTenant({ name: "NorthStar", parent_id: root.id });

// Config inherits automatically
await stratum.setConfig(root.id, "max_users", { value: 1000, locked: false });
const config = await stratum.resolveConfig(msp.id);
// → max_users: 1000, inherited: true, source: root

8 packages. Pick what you need.

All published to npm under @stratum-hq/*

@stratum-hq/core

Types, Zod schemas, error classes

@stratum-hq/lib

Direct library — tenants, config, permissions, audit, GDPR

@stratum-hq/control-plane

Fastify v5 REST API with auth, scopes, OTel

@stratum-hq/sdk

HTTP client, LRU cache, Express/Fastify middleware

@stratum-hq/db-adapters

PostgreSQL — raw pg, Prisma, RLS, schema isolation

@stratum-hq/react

Tenant tree, config editor, permission editor, design system

@stratum-hq/cli

Project init, migrate, scaffold, doctor

@stratum-hq/demo

Full MSSP dashboard with RLS isolation demo