PLATFORM
The platform under your platform.
We build the shared substrate underneath your SaaS product: tenancy, permissions, billing, entitlements, and audit. Engineered once, it keeps every part of the system in sync, instead of five teams maintaining five conflicting versions of the same idea.
SIGNAL IN THE NOISE
You've rebuilt this three times. It still doesn't hold.
- Every enterprise deal stalls on the same three questions: how tenants are isolated, who can see what, and whether an admin can impersonate a customer account without leaving a trace.
- Engineering has rebuilt the permissions system twice. It is still, underneath, a large if-statement guarding routes.
- Finance cannot tell you what a specific customer costs to serve, because usage is not metered anywhere except application logs nobody queries.
- The admin console is a Postgres client and a prayer. Support asks for direct database access because there is no safe way to do the job otherwise.
WHAT WE BUILD
Everything working together, by design.
Multi-Tenancy & Isolation
We choose the isolation model that matches your risk profile, whether pooled with row-level security, schema-per-tenant, or fully siloed, and make it explicit in the data layer, not just application logic. Tenant context travels with every request, every query, and every background job, so isolation survives a new engineer's first pull request.
Permissions: RBAC/ABAC
Roles get you launch day. Attributes get you the enterprise contract. We build permission systems that start with roles and scale into attribute-based policies (resource-level, condition-aware, auditable) without turning every feature branch into a permissions migration.
Billing, Metering & Entitlements
Usage-based pricing only works if usage is measured at the source, not reconstructed from logs after a customer disputes an invoice. We build the metering pipeline, the entitlement checks that gate features in real time, and the billing integration that keeps finance and product looking at the same numbers.
Workflow & Rules Engine
Business rules that live in Slack threads and tribal memory do not survive a re-org. We externalize approval chains, plan logic, and conditional workflows into a rules layer that product and support can read and change without a deploy.
Audit Logging, Notifications & Integrations
Every state change worth asking about later gets written to an immutable, queryable log: the artifact your security team hands an auditor without a scramble. The same event stream powers webhooks, in-app notifications, and the connectors your customers' tools expect.
Admin Console, White-Label & SSO/SCIM
Support and ops need a real console (safe impersonation, tenant search, plan overrides), not shell access to production. We build it alongside white-label theming for resellers and SAML/OIDC plus SCIM provisioning for the enterprise buyers who will not sign without them.
THE TIMELINE
Four phases, one substrate.
- 2–3 weeks
Platform Audit
- Platform Audit Report
- Tenancy & Entitlement Model decision document
- 4–6 weeks
Reference Slice
- Working reference implementation
- Architecture Decision Records (ADRs)
- 8–16 weeks, phased by capability
Build-Out
- Production capability modules
- API/SDK documentation
- 3–4 weeks
Hardening & Handover
Handover Pack: test reports, runbooks, recorded training
TECHNOLOGY
Named, and boring on purpose.
- Core services
- TypeScript/NestJS, or Go where metering needs raw throughput.
- Tenant data layer
- PostgreSQL with row-level security; Citus for sharded multi-tenant scale; Redis for tenant-aware caching and rate limiting.
- Permissions
- Open Policy Agent (OPA) or Oso for attribute-based policy evaluation.
- Billing & entitlements
- Stripe Billing or Orb for usage-based invoicing; Lago where a self-hosted engine is preferred.
- Identity
- WorkOS or Ory (Kratos/Hydra) for SSO/SCIM; Clerk or Auth0 for lighter tiers.
- Workflow/rules
- Temporal for durable execution; GoRules ZEN or JSON Logic for decision-table rules that change without a deploy.
- Events & integration
- Kafka or NATS as the internal bus; Svix for outbound webhooks.
- Feature flags/entitlement gating
- Unleash (self-hosted) or LaunchDarkly.
- Observability
- OpenTelemetry traces tagged by tenant ID; Grafana or Datadog for per-tenant cost and performance dashboards.
GOVERNANCE
Isolation, proven not promised.
- Security: Tenant isolation is verified with automated cross-tenant access tests in CI, not code review alone.
- Compliance: Audit log design anticipates SOC 2 Type II evidence requests: append-only storage, defined retention, exportable in an auditor's format.
- Cost control: Per-tenant cost attribution (compute, storage, third-party calls) feeds the entitlement and billing model directly, not a separate FinOps spreadsheet.
- Auditability: Every permission change and admin impersonation event is logged with actor, reason code, and timestamp.
- Operational ownership: Each capability module gets a runbook and a named owner on the on-call rotation. Support runs for 90 days past handover before the work is fully yours.
QUESTIONS
Questions worth asking before you sign.
RELATED SERVICES
Where this connects.
GET IN TOUCH
Your next hire shouldn't have to rebuild this.
Start the conversationhello@controlloop.tech