Scalable multi-tenant B2B SaaS platform
Multi-tenant B2B SaaS platform — Next.js + Postgres RLS, from 50 to 2,000 organisations, 99.95% SLA, SOC 2 Type II compliance.
The challenge
The challenge
The MVP had been delivered by a previous team in 4 months: PHP monolith, MySQL database, no tenant separation. Past 50 client organisations the platform stood upright but performance collapsed.
Enterprise clients demanded SOC 2 Type II, SAML SSO, audit logs, fine-grained RBAC, a contractual 99.95% SLA.
The engineering team needed to scale: from 2 to 8 developers without losing coherence. The legacy stack would not allow it.
Loaded product roadmap: 8 modules to ship in the year, 3 of them critical for the Series C round.
Our approach
Our approach
Full rebuild to a TypeScript monorepo (Next.js 15 + Prisma + PostgreSQL 16) with a multi-tenant architecture by Postgres schema (strict per-client isolation).
Row-Level Security on every sensitive table, policy per tenant and per role. Append-only audit log on critical operations.
Auth: Supabase Auth + enterprise SAML SSO (Okta, Azure AD) + mandatory admin MFA. Granular RBAC (60 permissions).
Progressive legacy migration: strangler pattern over 5 months, per-tenant dual-run, cutover with zero client downtime.
Observability: Sentry, OpenTelemetry, per-tenant Grafana dashboards, SLO error budgets, actionable alerts.
SOC 2 Type II compliance set up with an auditor partner, ready in 8 months.
Outcomes
Outcomes
From 50 to 2,000 client organisations in 14 months, without dramatic infrastructure growth (cost per client ÷3).
Contractual 99.95% SLA held: actual availability 99.97% over 12 months.
SOC 2 Type II obtained at the first audit. Enterprise deals (ARR > €100k) multiplied by 4.
Engineering team grew from 2 to 9 developers, velocity ×3 (story points / sprint) thanks to the design system and IaC.
Commitments met