Multi-tenant from the first migration.

Four decisions that are
nearly irreversible

Row, schema or database-level isolation chosen deliberately, enforced in the data layer, and verified with tests that attempt cross-tenant access.

Subscription lifecycle, usage metering, proration, dunning and tax, integrated so finance can reconcile it rather than estimate it.

A scope model covering organisations, teams, delegated access and service accounts, applied consistently across every surface.

Impersonation with audit trails, plan and entitlement changes, refunds, exports and account merges — without engineering involvement.

Signup, workspace creation, invitations and first-value flow that works without a human, because sales-assisted onboarding does not scale.

Release control and plan gating on the same system, so a feature can ship dark, roll out by cohort, and be sold by tier.

Taking a prototype or internal tool to something you can sell, bill and support without a founder in the loop.

A product deployed per customer that has become unmaintainable. The migration is delicate and worth doing once, properly.

SSO, SCIM, audit logs, data residency and role granularity — the list that arrives with your first large prospect.

Moving from seats to usage, or adding tiers, when the current billing code cannot express the new model.

When engineering spends a day a week on support requests that admin tooling should handle.

Preparing for a SOC 2 or ISO 27001 audit without discovering that the architecture makes half the controls impossible.

The unglamorous 40 per cent,done in a fraction of the time.

Exhaustive, not sampled

Cross-tenant access tests generated across every table and endpoint. Hand-written, this is a fortnight nobody budgets for, so it gets partially done — which is the same as not done.

Support tooling that ships on time

The CRUD screens, filters and audit views your support team needs, scaffolded fast. This is the work most commonly deferred, and deferring it turns engineering into a support queue.

Scripts across fifty tables

Repetitive data migrations drafted consistently, then dry-run against a production copy and reviewed line by line. Consistency here is worth more than speed.

The time saved goes into the parts that cannot be generated.

Tenancy strategy, permission boundaries and billing reconciliation are decided and written by senior engineers. Efficiency on the surrounding volume is what makes room for that thinking inside a realistic budget.

When multi-tenant
is the wrong shape

With a handful of large contracts and heavy customisation, single-tenant deployments can genuinely be simpler and more saleable.

Building tenancy, billing and admin for something nobody has bought yet is expensive optionality. Prove demand first.

Where a vertical SaaS or low-code platform covers eighty per cent of the requirement, building from scratch is hard to justify.

Billing architecture follows commercial strategy. Without a decision on how you charge, the metering model is a guess.

Difference between product-reported revenue and the ledger. This should be near zero and it is the first number finance asks for.

Tickets that need a developer. Falling counts mean admin tooling is doing its job.

Share of tables and endpoints with automated isolation tests. Anything uncovered is named rather than assumed safe.

How long from signup to the thing the product is for, without a human involved.

Performance on your largest accounts specifically. Aggregates hide the noisy-neighbour problems that lose enterprise customers.

Deploys needing a fix or rollback. Flags should make this recoverable in minutes rather than hours.

What a SaaS platform
depends on