The architecture decision made at 10 users that blocks the deal at 10,000.
Picture the version you actually want. The enterprise prospect sends their security questionnaire, and the answers are already true: tenant isolation, SSO, audit logs, real, not promised on the call. The deal closes on schedule instead of stalling in procurement.
Now the version most growth-stage SaaS teams get instead. A shared-schema multi-tenant design that worked fine at 50 customers starts breaking at 5,000. Subscription billing bolted on after launch is harder to change than if it had been designed in. Role-based access retrofitted after the first enterprise deal requires it is a rebuild, not a feature.
None of these were bad calls at the time. They were MVP calls, made when the next customer mattered more than the ten-thousandth. Then the enterprise buyer shows up with a procurement checklist, and a decision made at 10 users is suddenly what stands between you and the contract.
SaaS development is building software delivered over the internet on a subscription basis, where one codebase serves many customers, not a single-customer application. Five things make it different. Multi-tenancy isolates each customer's data on shared infrastructure. Subscription billing (recurring billing, trials, plan changes, usage-based pricing) is a core product feature, not an afterthought. Role-based access covers user, team, admin, and billing roles with real permissions. Observability keeps uptime and performance honest for every customer at once. And the architecture has to absorb growth without a rebuild at each new order of magnitude.
RaftLabs has shipped production software since 2015 across healthcare, fintech, hospitality, and logistics, for teams that include Aldi, Vodafone, and Nike. We launch a validated multi-tenant v1 in 10-16 weeks at a fixed cost, then grow it, with full source code ownership and no vendor lock-in. If you're still validating whether anyone wants the product at all, see MVP development, that's step one. This page is step two: the architecture that survives contact with a real enterprise buyer.
Key Insight
Ashit Vora, RaftLabs co-founder: the tenancy model is the one architecture decision you can't cheaply reverse. Change it at 5,000 customers and it's a live data migration, not a code change. We pick it in week two, against your actual buyer, so it stays a decision instead of becoming a rescue.
The odds today
- 33-42%
- of engineering time lost to technical debt and maintenance industry-wide, an estimated $85B annual cost
- Stripe, The Developer Coefficient, 2018
- 16.7%
- worldwide SaaS revenue growth in 2024, reaching $218.5 billion, the fastest-growing enterprise software segment
- Gartner, 2024
Most of that debt isn't a mystery when it finally surfaces. On April 5, 2022, an Atlassian engineer ran a maintenance script meant to operate on a single app's data. The script instead received an entire customer site's ID, and it ran in permanent-delete mode rather than recoverable mode. The result: 883 Jira and Confluence Cloud sites, 775 customers, permanently deleted. Full restoration took two weeks. Atlassian has deep engineering resources. The tooling simply had no validation step to catch the difference between "one customer's app" and "an entire customer's data" before running an irreversible operation at the wrong scope. That is what tenant isolation as operational discipline, not a one-time design decision, is actually for.
- Shipped the MVP single-tenant, planned to "multi-tenant it later"
- The right call to get to first revenue fast. "Later" always arrives mid-growth, when the migration is a bulk data move under live traffic instead of a clean design decision made in week 2.
- Hired a generalist software shop that had never shipped a real multi-tenant product
- They build competent CRUD software, because that's genuinely most of their client work, and treat tenancy as "add a tenant_id column" and billing as "wire up Stripe Checkout." Neither is wrong as a starting sentence. Both are incomplete as an architecture.
- Bolted billing onto a working product with the fastest available integration
- Ships fast, breaks quietly. Proration, plan changes, and failed-then-retried payments have real edge cases, and the bugs are usually found by finance, not engineering, months after they started leaking revenue.
- Waited for the enterprise deal to demand compliance, then scrambled
- SOC 2, SSO, and audit logging get promised on a sales call before they're built, creating a deadline-driven retrofit under the worst possible conditions: a live prospect, a verbal commitment, and an architecture that was never designed with those constraints in mind.
We choose the tenancy model based on your buyer and their procurement requirements, not a default preference, row-level for SMB SaaS, schema-per-tenant for most B2B products, database-per-tenant when regulated buyers demand it. Cross-tenant isolation is enforced by an automated security test suite, not a one-time review. One team owns your product from architecture through launch, no handoffs, no relay race between four vendors.
The tenancy model decides your isolation guarantees, your compliance ceiling, and your infrastructure bill. There is no correct default. We choose it against who actually signs your contract.
| Tenancy model | Data isolation | Best-fit buyer | Infrastructure cost and ops |
|---|
| Shared schema (row-level security) | Logical, enforced by a tenant filter on every query | B2C and SMB SaaS at high tenant counts | Lowest; easiest to scale operationally |
| Schema-per-tenant | Separate schema per tenant in a shared database | Most B2B SaaS selling to growth-stage companies | Moderate; balances isolation and cost |
| Database-per-tenant | Separate database per customer | Regulated buyers (HIPAA, SOC 2) and data-residency mandates | Higher; scales with customer count |
| Single-tenant (dedicated stack) | Full physical separation, one deployment per customer | A flagship enterprise or a strict residency requirement | Highest; scales linearly with customers |
On top of the model, enterprise procurement checks the controls, not the diagram. A SOC 2 Type II review wants enforced access controls, audit logging, and change management you can evidence. GDPR wants data-subject export and erasure, and often EU data residency. We design those in against your target regime, rather than promising them on the sales call and retrofitting under a signed deadline.
This pays off when you're building a real multi-tenant product, not a single-customer tool.
Everything on the left should already be true for your product. Even one thing on the right, and a custom SaaS build is the wrong spend right now.
A fit01You're building a multi-tenant SaaS product where one codebase serves many customers.
02Subscription or usage-based billing is core to the model, not a bolt-on you'll add later.
03Budget for a build in the $25,000+ range, with enterprise buyers on the roadmap who will ask about data isolation and compliance.
Not a fitA single-customer internal tool with no multi-tenancy or subscription layer.
Pre-revenue with requirements still forming and no budget yet.
Shopping for the cheapest hourly team, not a fixed-scope partner.
What we build
Everything a SaaS product needs, built in from sprint one.
Multi-tenancy, billing, and the enterprise controls your buyers check before procurement, designed in from day one, not retrofitted before Series A.
01Multi-tenant SaaS platforms
SaaS products where one codebase serves many customers with complete data isolation. The tenancy model matches your buyer, and cross-tenant isolation is enforced by an automated security test suite, not a one-time design decision. Built on PostgreSQL, Temporal.io, and Step Functions.
02Subscription and billing infrastructure
Recurring subscriptions, trials, proration, usage-based metering, and invoicing, with webhook events processed idempotently. A dunning sequence runs from the first payment-failure email through account suspension at day 14, and any feature can be plan-gated without a code deployment. Built on Stripe Billing, LaunchDarkly, Unleash, and Lago.
Team and workspace management, audit logs, API key management, and webhook delivery for product events. The access controls enterprise buyers check before procurement approval, built in from the start, not added when the first enterprise deal requires them. SSO, SAML, OAuth, and RBAC.
04SaaS API and integration layer
Public API for third-party integrations, webhook delivery for product events, and native integrations with the tools your customers already use. The integration surface that makes your product a platform, not a silo. Connects Zapier, Make, Slack, Salesforce, and HubSpot.
05Admin and operations tooling
Internal admin dashboard for managing tenants, monitoring usage, and handling billing overrides without database access. Usage analytics and churn signals surface to your customer success team, so they can run the product without relying on engineers for every support task.
06SaaS infrastructure and DevOps
Production infrastructure with staging environments, database backups, monitoring and alerting, and auto-scaling. It supports zero-downtime deployments and handles traffic spikes, deployed to your cloud account and managed by you after handoff. Built on AWS, Vercel, GCP, and CI/CD.
Shipping production software since 2015. We know what breaks SaaS products at scale.
Fixed cost. A validated v1 in 10-16 weeks. Full source code ownership. No dependency on us to run your product.
How it works
From scope to shipped
Every project follows the same four phases. Scope is locked and price is fixed before development starts.
- Week 1
01Discovery and scope
We map the problem, the user, and the workflow. You leave week 1 with a written scope document, a defined feature list, and a fixed-price quote. No development starts without your sign-off.
- Weeks 2-3
02Architecture and design
We design the data model, tenancy model, and API structure before writing code. Wireframes validate the UX. Architecture decisions made here cost a fraction of changes made in week 8.
- Weeks 4-12
03Build, integrate, and QA
Working software deployed to staging at the end of sprint one. Bi-weekly demos with milestone sign-off before the next payment. QA runs in parallel with every sprint, not as a phase at the end.
- Weeks 12+
04Launch and handoff
Production deployment with monitoring activated on launch day. 8 weeks of post-launch support included. Full source code, infrastructure definitions, and documentation transferred to you at project end.
Gula was our own product, not client work: a multi-tenant food order management SaaS with Stripe billing that we co-built and held a stake in, alongside co-founder Grady Lakshmono. Runchise acquired Gula after launch, and the multi-tenant architecture we shipped held up under the acquirer's scale without a rebuild. Building on our own dime, with our own equity on the line, is a different kind of proof than billing by the hour.
We've delivered for teams at Vodafone, T-Mobile, Aldi, Nike, Cisco, and Lockheed Martin. Those are relationships, not SaaS case studies. The SaaS proof below names the build and the real numbers.
Gula is one example, and it was our own product. We built the multi-platform food order management SaaS, including multi-tenant data isolation and Stripe billing, in 16 weeks. Runchise acquired it shortly after launch. Read the full case study.
"RaftLabs elevated my ideas and brought them to life when everything seemed impossible." - Grady Lakshmono, CoFounder, Gula (acquired by Runchise)
What clients say
What SaaS founders say
Three-year average engagement. Founders and operators describing the work in their own words. No marketing varnish.
Grady Lakshmono
IndonesiaCoFounder, Gula (acquired by Runchise)
“RaftLabs elevated my ideas and brought them to life when everything seemed impossible.
- "You'll pick a generic multi-tenancy pattern off a template, not the one that actually fits my buyer."
- We recommend row-level, schema-per-tenant, or database-per-tenant based on your target buyer and their procurement requirements, not a default preference.
- "The billing integration will be the thing that breaks when I change my pricing model in 12 months."
- Billing is designed to support plan structure changes without breaking existing subscriptions, not hard-coded to the pricing page you launched with.
- "I'll get locked into your infrastructure and can't hand this to my own team later."
- You own all source code, infrastructure definitions, and documentation at project end. No proprietary frameworks, no lock-in.
- "You'll disappear the moment we hit real scale, right when isolation and billing edge cases actually start to matter."
- Eight weeks of post-launch support is included, covering exactly that window, and you own the infrastructure either way, so you're never dependent on us to keep it running.
- "I'm not sure my team can evaluate whether the multi-tenancy design is actually sound."
- Cross-tenant isolation is enforced by an automated security test suite, not a one-time design review, something concrete you or a future hire can inspect, not just take our word for.
- "This will cost enterprise-agency money for what's really an MVP-plus scope."
- A focused SaaS build starts at $25,000. A complete platform with multiple modules runs up to $150,000. You get a fixed number after scoping, not a quote you have to chase.
Where you land in the range depends on scope, not negotiation:
- Focused SaaS, $25,000-$60,000
- One core workflow, multi-tenancy, subscription billing, and a web interface.
- Complete platform, $60,000-$150,000
- Multiple modules, a mobile app, an API for third-party integrations, and admin tooling.
What it costs
SaaS platforms, starting at $25,000. Yours to keep.
Multi-tenancy, subscription billing, and enterprise features, scoped and priced before development starts.
Starts at $25,000Scoped to your feature list. A validated v1 in 10-16 weeks, with full source code ownership. Start with one core workflow and expand into a full platform as you add modules.
Start with the workflow your users need most, then add multi-tenancy, billing, or a mobile app once the core product is live.
Ownership
You own all source code, infrastructure definitions, CI/CD configurations, and documentation at project end. No proprietary frameworks, no lock-in, ready to hand to any team.
No change-order surprises
Once we scope the build, that price is locked before development starts. A scope change is a priced change request, never a surprise on the invoice.
What you actually get
The unglamorous decisions that decide whether a SaaS product survives contact with an enterprise buyer, not just a demo.
- 01
A tenancy model chosen for your buyer, not a default
Row-level, schema-per-tenant, or database-per-tenant, picked to match who's actually procuring, not the fastest thing to ship.
- 02
Billing designed to survive a pricing-model change
Plan restructures and new usage-based tiers don't break existing subscriptions, because the billing layer was built to flex, not hard-coded to launch day.
- 03
Cross-tenant isolation enforced by an automated test suite
Not a one-time design review. A missing tenant filter in a query gets caught by a test, not discovered by a customer seeing another customer's data.
- 04
The enterprise checklist answered before the deal, not during it
SSO, audit logs, and tenant isolation guarantees are already true when the security questionnaire arrives, not a scramble under a signed verbal commitment.
- 05
A dunning sequence that recovers revenue instead of losing it quietly
Failed payments trigger a real retry and communication sequence, not a silent churn event nobody notices until finance asks why revenue dipped.
- 06
Code and infrastructure in your name from day one
Deployed to your cloud account, documented well enough that any competent team, including one that isn't us, can run and extend it.
A multi-tenant SaaS build rarely stays inside one scope. If your product needs run wider than SaaS, custom software development covers full-scope platforms beyond multi-tenancy. Startup software development carries the product forward once the MVP is behind you, product engineering runs the ongoing development after launch, and API development builds the integration layer that turns your product into a platform your customers connect to. Still validating whether anyone wants it? Start with MVP development.