Design a Multi-Tenant Compliance Engine
Last updated: December 9, 2025
Quick Overview
Design a system that continuously evaluates cloud environments against compliance frameworks (SOC 2, HIPAA, PCI-DSS, CIS Benchmarks) and generates audit-ready reports for thousands of tenants.
Wiz
December 9, 20255
3
1,883 solved
Design a system that continuously evaluates cloud environments against compliance frameworks (SOC 2, HIPAA, PCI-DSS, CIS Benchmarks) and generates audit-ready reports for thousands of tenants.
Compliance is a critical part of Wiz's value proposition. Enterprise customers need to continuously prove their cloud environments meet regulatory requirements. The system must evaluate hundreds of compliance rules against millions of resources, support custom rules, and generate reports that auditors can trust.
What the Interviewer Expects
- Design a rule engine that evaluates compliance policies against cloud resource states
- Support multiple compliance frameworks with overlapping controls
- Handle continuous evaluation versus point-in-time audit snapshots
- Address multi-tenant isolation for compliance data
- Generate audit-ready reports with evidence trails
Key Topics to Cover
How to Approach This
- Start by clarifying functional and non-functional requirements with the interviewer.
- Estimate the scale: QPS, storage, bandwidth. This drives your design decisions.
- Draw a high-level architecture first, then deep dive into 1-2 critical components.
- Discuss trade-offs explicitly (e.g., consistency vs availability, SQL vs NoSQL).
- Address failure scenarios, monitoring, and how the system handles 10x traffic spikes.
Possible Follow-up Questions
- How would you handle a compliance framework update that changes evaluation criteria?
- How do you support custom compliance rules created by individual tenants?
- What is your strategy for handling compliance evaluation at scale across millions of resources?
Sharpen Your Skills on Codemia
Practice similar problems with our interactive workspace, get AI feedback, and track your progress.
Practice System Design ProblemsSample Answer
Architecture Overview
Three main components: a Rule Engine that evaluates compliance policies, a Resource State Store that maintains current cloud resource configurations, ...
Evaluation Engine
Two modes: continuous (real-time evaluation as resources change) and snapshot (point-in-time assessment for audits). For continuous mode, subscribe t...
Submit Your Answer
