# Tenant Segregation 
+ `TiDB Dedicated`
  + Tenant has dedicated TiDB servers, TiKV servers and PD servers
  + Tenants are isolated by VPCs
+ `TiDB Serverless`
  + Tenants have dynamic dedicated TiDB server instances, and share VPC, PD server instances pool, TiDB server instances pool and TiKV server instances pool
  + Tenants are isolated by TiKV key space

![`smart`](TiDBCloudKeySpace_aa_001_20230911.png)

------------------------------------------------------------------------------
TiDB Dedicated tenants:
- In the case of a TiDB cluster managed by TiDB Dedicated, all components/nodes that belong to a single TiDB cluster are launched and managed within a dedicated AWS or GCP VPC. This ensures that multiple tenants are isolated at the networking layer. 

TiDB Serverless tenants:
- The cluster will initially start a batch of TiDB server instances in the on-demand node pool. When needed, the tenant will be allocated a TiDB server instance. If the assigned TiDB server instance remains idle (without any connection) for more than 5 minutes, it will be released and returned to the pool. In other words, when a TiDB server instance is serving a connection for a specific tenant, it is exclusively dedicated to that tenant.

- TiKV data is isolated from different tenant data by different TiKV key space prefixes.