1. A method, comprising: creating, in a database, a target database schema for a target version of a software system; and upgrading a plurality of tenants in a current database schema of a current version of the software system to the target database schema, the upgrading comprising, for each tenant: capturing a current state of data corresponding to the tenant in the current database schema; transitioning, using at least one processor of a machine, the data corresponding to the tenant from the current database schema to the target database schema; testing to verify the tenant in the target database schema; opening the tenant in the target database schema for users in response to the tenant in the target database schema being verified; and restoring the tenant in the current database schema using the captured state in response to the tenant in the target database schema not being verified.