Multi-tenancy is a common requirement, but retrofitting it into an existing Django application with dozens of models can feel overwhelming.

How do you migrate from a user-centric architecture, where users own resources, to an organization-based one where users belong to multiple organizations? And all without downtime, dangerous migrations, breaking changes, or awful bugs?

At SendCloud, we tackled this exact challenge across our Django monolith: 600k+ lines of Python code with continuous production traffic. This talk shares our battle-tested strategy that allowed continuous deployments throughout the migration, and enabled us to move slowly, one Django app at a time.

The approach: 1) Proxy models as a bridge: Creating an Organization proxy of User, which allowed us to change ForeignKeys in code while maintaining database compatibility 2) Progressive refactoring: Using helpers like a base class with fallback code, and custom codemods to systematically update models, tests, and business logic across all apps 3) Dual foreign keys: Adding new FK constraints pointing to the organization table alongside existing user FKs, using PostgreSQL’s NOT VALID to avoid table locks 4) Seamless cutover: Swapping from proxy to real Organization model without SQL execution, then dropping old constraints

In this talk, I’ll share all the details involved in those steps, with real examples, alongside some pitfalls we discovered, what worked well, and practical tips for anyone attempting a similar large-scale refactoring without taking their Django app offline.