Multi-tenant RAG: one big index or per-tenant collections?

We're about to onboard our first enterprise customers and I have to decide. Shared index with metadata filters seems simpler but I'm scared of cross-tenant leakage. Per-tenant collections mean more ops. What do you run?