A hosted multi-tenant application is provided that permits a tenant to self-manage aspects of the operation of the application. A tenant may be permitted to upgrade the multi-tenant application on-demand or according to a schedule, to place the multi-tenant application into a read-only mode of operation, to create a shadow copy of their unshared organization database, to merge changes to a shadow copy into a master version of the unshared organization database, to create and revert to snapshots of an unshared organization database, and to perform other functions. A computing architecture that utilizes site-wide server computers and scale groups may be utilized to implement this functionality.