Prototypes that don't isolate tenants
01Tenant checks live in scattered queries, so one missed filter can expose another customer's data, and enterprise security reviews stall.
SAAS DEVELOPMENT COMPANYMake the product architecture work beyond the first customer.
We build and rebuild B2B SaaS products so the tenant model, permissions, billing and release process hold up as you add customers, plans and AI features, without a rewrite at customer fifty.
B2B SaaS founders, product leaders and platform engineering teams
THE OPERATIONAL GAP
What breaks between prototype and commercial product.
MVP shortcuts are fine until paying customers depend on them. These are the issues that tend to surface first.
Pricing disconnected from usage and entitlements
02Plans are hard-coded, limits aren't enforced and usage isn't metered, so sales can't sell new packages without engineering work.
Releases that break customer-specific configurations
03Feature flags, custom settings and integrations aren't covered by tests, so every release risks a regression for a subset of accounts.
AI inference costs invisible to margins
04Model calls aren't attributed to tenants or features, so a few heavy users can quietly erase the margin on a plan.
Prototypes that don't isolate tenants
01Tenant checks live in scattered queries, so one missed filter can expose another customer's data, and enterprise security reviews stall.
Pricing disconnected from usage and entitlements
02Plans are hard-coded, limits aren't enforced and usage isn't metered, so sales can't sell new packages without engineering work.
Releases that break customer-specific configurations
03Feature flags, custom settings and integrations aren't covered by tests, so every release risks a regression for a subset of accounts.
AI inference costs invisible to margins
04Model calls aren't attributed to tenants or features, so a few heavy users can quietly erase the margin on a plan.
WHAT WE BUILD
SaaS products and platforms we build.
We work on new products and on existing codebases that need to scale commercially.
01
Multi-tenant B2B SaaS platforms
Tenant-aware data models, org and role management, SSO and audit logs that pass enterprise security questionnaires.
02
AI-enabled product modules
Search, summarization, drafting and agent features with evaluation sets, per-tenant usage tracking and fallbacks when models fail.
03
Developer portals and API products
Public APIs with keys, scopes, rate limits, versioning, documentation and usage analytics.
04
Subscription, billing and admin systems
Plans, entitlements, metering and billing-provider integration so packaging changes don't require code changes.
01
Multi-tenant B2B SaaS platforms
Tenant-aware data models, org and role management, SSO and audit logs that pass enterprise security questionnaires.
02
AI-enabled product modules
Search, summarization, drafting and agent features with evaluation sets, per-tenant usage tracking and fallbacks when models fail.
03
Developer portals and API products
Public APIs with keys, scopes, rate limits, versioning, documentation and usage analytics.
04
Subscription, billing and admin systems
Plans, entitlements, metering and billing-provider integration so packaging changes don't require code changes.
WORKFLOW EXAMPLE
From sign-up to metered, billable usage.
An example product lifecycle. Plan rules and review thresholds are set with your product and finance teams.
Customer signs up
InputSelf-serve sign-up or sales-created account
OutputNew organization record with owner user and selected plan
01Tenant and roles provisioned
InputNew organization record
OutputIsolated tenant, default roles, SSO settings and audit log
02Plan entitlements applied
InputSelected plan and contract terms
OutputEnforced feature flags, seat limits and usage quotas
03Usage processed and anomalies reviewed
InputProduct requests, including AI calls
OutputMetered usage per tenant and feature; quota or cost anomalies flagged for review
Review required
04Usage billed and monitored
InputMetered usage and plan pricing
OutputInvoice line items in your billing provider and usage dashboards
05
SYSTEM DESIGN
The architecture behind the workflow.
A reference SaaS architecture. The tenancy model and hosting choices are set by your risk profile and customer requirements.
- Web and mobile clients
- Tenant-aware API and authorization
- Data layer with isolation boundary
- Entitlements, metering and billing events
- Telemetry and release pipeline
- Usage processed and anomalies reviewed
- Web and mobile clients to Tenant-aware API and authorization
- Tenant-aware API and authorization to Data layer with isolation boundary
- Data layer with isolation boundary to Entitlements, metering and billing events
- Entitlements, metering and billing events to Telemetry and release pipeline
- Entitlements, metering and billing events to Usage processed and anomalies reviewed
- Usage processed and anomalies reviewed to Telemetry and release pipeline
Web and mobile clients -> Tenant-aware API and authorization -> Data layer with isolation boundary -> Entitlements, metering and billing events -> Telemetry and release pipeline
01
Web and mobile clients
Authenticate users, carry tenant context and call versioned APIs.
02
Tenant-aware API and authorization
Resolves tenant and role on every request and enforces permissions centrally rather than in each feature.
03
Data layer with isolation boundary
Enforces tenant isolation through row-level security, separate schemas or separate databases, depending on the model chosen.
04
Entitlements, metering and billing events
Checks plan limits, records usage per tenant and feature, and sends billable events to your billing provider.
05
Telemetry and release pipeline
Provides tracing, per-tenant error rates, feature flags and staged rollouts with rollback.
Technology
Chosen for the systems above.
These tools are already in published projects with a similar shape of work. The set for your release is confirmed once the interfaces and review points are known.
- PostgreSQL row-level security
- OAuth 2.0 / SAML SSO
- Stripe Billing or similar
- OpenTelemetry
- Feature flags
Frontend
ReactNext.jsTypeScriptTailwind CSSReactNext.jsTypeScriptTailwind CSSProgramming Language
TypeScriptTypeScriptUI Styling
Tailwind CSSTailwind CSSState Management
ReduxReduxBackend
Node.jsNode.jsBackend Framework
Express.jsExpress.jsDatabase
MySQLMongoDBMySQLMongoDBBackend and APIs
Node.jsExpress.jsNode.jsExpress.jsDeployment
DockerNginxDockerNginx
DESIGN TRADE-OFFS
Decisions that change cost, reliability and scope.
Getting these right early is far cheaper than migrating later.
Shared schema versus isolated databases
Shared schemas with row-level security are cheapest to operate; per-tenant databases simplify data residency and enterprise deals but raise operational cost. Many products need a hybrid.
Model against expected customer count, largest-tenant size and enterprise requirements.
Synchronous model calls versus queued jobs
Short AI responses can run inline; long or batch tasks belong in queues with progress updates so the product stays responsive and costs stay predictable.
Measure real latency and cost per call on representative inputs.
Build versus integrate billing
Established billing platforms handle tax, invoicing and dunning. Custom code should be limited to entitlements and usage logic specific to your product.
Check whether your pricing model is supported natively by candidate providers.
Shared schema versus isolated databases
Shared schemas with row-level security are cheapest to operate; per-tenant databases simplify data residency and enterprise deals but raise operational cost. Many products need a hybrid.
Model against expected customer count, largest-tenant size and enterprise requirements.
Synchronous model calls versus queued jobs
Short AI responses can run inline; long or batch tasks belong in queues with progress updates so the product stays responsive and costs stay predictable.
Measure real latency and cost per call on representative inputs.
Build versus integrate billing
Established billing platforms handle tax, invoicing and dunning. Custom code should be limited to entitlements and usage logic specific to your product.
Check whether your pricing model is supported natively by candidate providers.
SECURITY & COMPLIANCE
Controls B2B buyers will ask about.
We build the controls that enterprise security reviews and SOC 2 audits examine, so your team can evidence them.
Security design should match your tenancy model. SOC 2 is an audit of your organization's controls, not a property of code; we help you build and evidence controls, but the report comes from your auditor.
Automated tenant isolation tests
Tests attempt cross-tenant reads and writes on every build, so isolation regressions are caught before release.
Entitlement and plan enforcement
Limits and paid features are enforced server-side, with changes to plans and overrides recorded.
Secrets and API key management
Credentials live in a managed secrets store, customer API keys are hashed and scoped, and rotation is supported.
Usage and AI cost anomaly alerts
Per-tenant spend and usage are monitored, with alerts and automatic throttling when they exceed expected bounds.
NIST Cybersecurity Framework 2.0NIST AI Risk Management Framework
NIST Cybersecurity Framework 2.0NIST AI Risk Management Framework
DELIVERY APPROACH
From product constraints to a verifiable release.
We ship thin, complete slices so customers see value early and architecture decisions are tested with real usage.
01
Validate target customer journeys
Confirm the buyer, user roles and the two or three journeys that drive revenue.
Agreed journey map, user roles and success metrics for the first release.
02
Define tenancy and entitlement model
Choose isolation strategy and model plans, limits and usage events.
Written tenancy decision and an entitlement matrix approved by product and finance.
03
Build thin end-to-end product slices
Deliver sign-up to first value working in production-like infrastructure.
Working slice with tenant isolation tests and plan enforcement passing.
04
Test isolation, upgrades and plan changes
Exercise upgrades, downgrades, seat changes and failure cases.
Test results for cross-tenant access, plan changes, migrations and load.
05
Release with telemetry and support runbooks
Roll out behind flags with monitoring and support documentation.
Staged rollout plan, dashboards, alerting and support runbook handed over.
Published work
Projects you can read in full.
Each card is a published project. The industry on the card is the one that work was built for.
SaaS, Project Management and Business Productivity
Clove
We developed a complete project management and team collaboration SaaS with frontend, backend, REST APIs and a structured database.
Read the project
Cybersecurity, SaaS and Credential Management
LockYantra
We built a secure platform for managing and sharing credentials and confidential information.
Read the project
From the journal
Reading that sits beside this work.
Recent notes from the team. Pieces that match this industry are shown first.
PROJECT PLANNING
What we need to define before development begins.
Bring what you have. A product brief, an existing codebase or even sales call notes is enough to start.
- 01
Who buys the product and who uses it day to day?
- 02
Do enterprise customers need SSO, audit logs, data residency or dedicated hosting?
- 03
How do you price today, and how might that change in the next year?
- 04
Is there an existing codebase, and what must not break during changes?
- 05
Which metric defines a successful first paid release?
Existing repository and infrastructure access
Billing provider account
Model provider accounts and usage budgets
Product owner availability
Existing repository and infrastructure access
Billing provider account
Model provider accounts and usage budgets
Product owner availability
SaaS development FAQs.
Most B2B products start with a shared database and strict row-level isolation, enforced centrally and covered by automated tests. If enterprise customers need data residency or dedicated environments, we design a path to isolated databases for those tenants without forking the codebase.
We attribute every model call to a tenant, user and feature, record tokens and cost, and expose that to your billing logic. That lets you set quotas, charge by usage or bundle AI into tiers with visibility into the margin.
Yes. We start with a code and infrastructure review, fix the risks that block growth, such as tenant isolation, test coverage and deployment, and then continue delivering features rather than rewriting from scratch.
One complete journey from sign-up to clear customer value, working accounts and roles, enforced plan limits, billing and the support tooling to handle issues. Nice-to-have features can wait; billing and isolation can't.
We build the technical controls enterprise questionnaires ask about, such as SSO, audit logs, encryption and access reviews, and document how they work so your team can answer reviews accurately.
You own the codebase and the customer data. Third-party model and billing providers remain under the agreements you sign with them. We document tenant boundaries so one customer's data is not readable by another.
Yes, when the cloud, database, and model providers you choose offer that region. Region, backup, and subprocessors are decided before the first tenant is onboarded.
Entitlements are checked in the API, not only in the interface. A plan change updates what the tenant can do, and usage that affects a bill is recorded against that tenant.
The first release is built so a model, billing provider, or database can be replaced without rewriting the product. We name those boundaries in the architecture before development starts.
Building or scaling a B2B SaaS product?
Share your product, customers and current architecture. We'll identify what has to change before the next stage of growth.
Tell us how the work runs today, which systems already hold the data, and what a useful first release would change. We use that to judge scope before anyone writes a proposal.
The form goes to a solutions architect at THE TISA. You get a direct reply on fit, approach, and what we would need from your team.
Share your scope
Tell us about the workflow or product. A solutions architect replies within one business day.