A multi-tenant reference architecture covering the decisions that are expensive to reverse after launch.
The parts of a SaaS product that determine whether it survives growth are the parts customers never see. Tenancy model, billing correctness, permission granularity and migration strategy are cheap to design in and costly to retrofit once real customers hold real data.
Shared schema, schema-per-tenant and database-per-tenant each carry different cost, isolation and compliance trade-offs. The decision is made explicitly against the product's actual requirements, and enforced consistently at the data access layer.
Plans, entitlements, proration, trials, upgrades and failed payments are modelled properly rather than inferred from a provider's webhooks. Entitlement checks read from one authoritative place.
Schema changes follow expand-and-contract so deploys never require a maintenance window and rollback stays possible while a change is in flight.
Your team needs to impersonate safely, inspect tenant state and resolve issues without a developer and without unaudited access to customer data.
Tell us what the system needs to do and what it has to survive. We will tell you how we would approach it and what that would involve.
