SaaS products
Three decisions make or break a SaaS product, and all of them are made in the first fortnight: how tenants are separated, how permissions are modelled, and how billing knows what happened.
Tenancy is the first and least reversible. Whether every customer shares a database with a tenant column, or gets their own schema, or their own instance, determines your cost per customer, your blast radius when something goes wrong, and whether you can ever sell to a client who demands their data be physically separate. It is cheap to decide on day one and close to a rewrite on day four hundred. The right answer depends on who you are selling to, which is why it is a commercial question before it is a technical one.
Permissions are the second, and they are almost always modelled too simply at the start. A product that assumes one kind of user will meet its first customer with departments, then one with contractors who see only their own projects, then one who wants an auditor with read-only access to everything. Retrofitting roles onto a system built around a single user type touches every screen and every query. Building a real permission model early costs a week; adding one later costs a quarter.
Billing is the third, and the one that quietly costs money. Subscriptions are easy until someone upgrades mid-cycle, adds seats on a Tuesday, or churns and comes back. Metered billing is harder still, because you now need a usage record you trust well enough to put on an invoice. The rule that keeps this sane is that usage is recorded as immutable events and the invoice is derived from them, so a disputed charge is a query rather than an argument.
How we work
- Tenancy is chosen against who you intend to sell to, and written down. It is the one decision that is nearly a rewrite to change.
- A real permission model from the start, enforced at the data boundary. A hidden menu item is not a permission.
- Usage is stored as immutable events; invoices are derived. That is what lets you answer a billing dispute with a record instead of an apology.
- The admin tooling ships with the product, not after it. Without it every edge case becomes an engineer running a query against production.
A film tool whose hero is not a screenshot of a grade — it is one, computed on your GPU. Pick a stock.
What this includes
Pick what you need and send it over.
Questions
- Can we start single-tenant and change later?
- You can, and it is the more common direction — going from shared to isolated is usually harder than the reverse. What matters is that the code never assumes there is only one tenant, even while there is. A tenant identifier threaded through from the first query costs almost nothing and saves the migration entirely.
- Should we build billing ourselves?
- No — use a billing provider for cards, invoices, tax and dunning, all of which are much harder than they look. What you do own is the usage record that tells the provider what to charge, because that is specific to your product and nobody else can be responsible for it being right.