A SaaS platform has had three full outages this year, each affecting all customers. Propose an architectural response.

What the interviewer is testing

Whether you can propose converting availability from a probability into a bounded fraction, and whether you know what it costs.

The proposal: cell-based architecture

Run many complete, independent copies of the stack, each serving a subset of customers. A cell is a full vertical slice — compute, data, cache, queues — with no shared state between cells.

With twenty cells, the same fault affects 5% of customers rather than 100%. The incident becomes a degradation rather than an outage, which changes the commercial conversation entirely.

What else it buys

Deployments become naturally progressive, cell by cell, so a bad release is contained before it spreads.

Capacity scales by adding cells rather than by scaling individual components, which removes a class of scaling limits.

A natural boundary for residency and tenancy requirements.

What it costs

Duplicated fixed infrastructure per cell, so the total footprint rises.

Cross-cell operations become awkward or impossible — global search, cross-tenant reporting, anything requiring a single view. That constraint must be checked against the product.

Operational tooling must work across all cells at once, or the operational burden multiplies by cell count. This is the part that determines whether the model is sustainable, and it is the largest piece of work.

The routing layer is the one remaining global dependency, so it must be simple enough to be far more reliable than what it routes to.

The refinement worth proposing

Shuffle sharding: assign each customer to a random subset of cells rather than one. The probability that two customers share their entire set becomes very small, so a customer whose workload poisons a cell affects only the few who overlap with them rather than everyone in a fixed partition.

What a strong answer adds

Checking the causes of the three outages first. If all three originated in the shared database, cells address it. If they originated in a global control plane or a shared routing tier, cells do not, and the investment would be misplaced. The architecture should follow the evidence.

Common weak answers

More redundancy within the existing single stack, which does not address correlated failure. Cells proposed without the operational tooling implications.