Multi-region active-active SaaS

What this design does

Both regions serve traffic all the time — but every tenant has a home region, and a request never crosses regions synchronously: the failure of region B must not add a single millisecond to region A. State converges through an asynchronous replication bus, and a tiny witness region provides the quorum tiebreaker so failover decisions don't depend on the two parties that might be partitioned from each other. Failover flips tenant homing at the DNS layer; it never turns cross-region calls on.

The patterns it composes

• Tenant homing — every tenant has one home region — writes have one owner, no write conflicts
• Regional isolation — no synchronous cross-region calls on the request path, ever
• Event-bus replication (hub-and-spoke) — regions converge asynchronously through a replication hub
• Witness region — a third, tiny region breaks quorum ties — the two data regions can't outvote reality
• Global traffic management — latency-based DNS routes users; failover is a routing change, not an architecture change

Import it, attach your own numbers, and verify the design against failures — or read the engineering notes.