Multi-tenant SaaS Platform: Billing, RBAC & White-label

Client — B2B SaaS startup (project management for agencies), scaling from 50 to 800+ tenant organizations. Single-database MVP hit limits: data leaks risk, no per-tenant billing, custom domains requested by enterprise clients.

Scope: greenfield multi-tenant architecture — tenant isolation, role-based access (owner / admin / member / viewer), subscription billing, white-label (custom domain + logo). SOC2-ready audit trail.

• tenant model: shared DB with row-level tenant_id + policy middleware; optional schema-per-tenant for enterprise tier;
• RBAC: permission matrix, custom roles per tenant, invite flow, SSO (SAML) for Enterprise;
• billing: Stripe subscriptions, usage meters (seats, projects), proration, dunning, invoice PDF;
• white-label: CNAME + TLS (Let’s Encrypt automation), theme tokens (CSS vars), email from tenant domain;
• admin super-panel: impersonate tenant (logged), suspend, plan override;
• API rate limits per plan; webhook delivery with retry;
• observability: tenant-scoped logs, Datadog dashboards, error budget per tier.

Stack: Node.js/NestJS, PostgreSQL, Redis, Stripe, React, Kubernetes, Terraform. Acceptance: pen-test tenant isolation, 0 cross-tenant data in QA suite.

Result: Enterprise tier launched; ARR +140% in 2 quarters. NDA: product name not disclosed.