B2B SaaS engineering that survives the first 100 paying users
Pre-seed, seed and Series A teams come to us when shipping fast is no longer the only metric. We build the production-ready foundation that lets you ship features for the next two years without an architectural rewrite.
Most of our SaaS engagements fall into one of four shapes:
01Production-ready MVPThe core product, built from a defined architecture: auth, multi-tenant data, primary flows, CI/CD pipeline, base monitoring, GDPR-aligned by default. Typical scope: 6–8 weeks, €35–50k.
02Re-architecture after seedYou launched with freelancers or no-code, you have traction, and the codebase now blocks the team. We plan a phased rebuild that keeps the product shippable while we replace the load-bearing parts.
03Multi-domain productBeyond the first product surface — admin tooling, operator dashboards, billing, integrations. Built with clean domain boundaries so the next two product squads can ship in parallel without stepping on each other.
04Embedded engineering capacityAfter launch, your team grows but hiring senior backend engineers in Berlin or Munich is slow. We embed in your repository, follow your code review, and hand the work back when you're staffed.
Audience
Who this is for
We're a fit when:
01Your round is closed (or closing) and you have 12–24 months of runway
02You see the product growing past 3–5 entities (users, organisations, workflows)
03You expect 100+ paying users in year one — and your seed pitch promised more
04Your CTO or first engineer needs senior architecture support without giving up control
05You'd rather spend €35k now than €120k on a forced rewrite next year
✕ Not a fit
Not a fit if you're pre-funding, validating an idea, or building a feature on top of an existing platform.
Outcomes
What you walk away with
01A documented architecture your next senior hire can read in an hour
02A deploy pipeline you can show an investor without flinching
03Domain logic that already accommodates the year-2 features in your roadmap
04Test coverage on the paths that matter — payments, auth, data integrity
We've shipped enough post-seed rebuilds to know which decisions cost teams six months and a Series A delay. These are the five we see most often.
01MVP built without a multi-tenant modelOnboarding the second customer organisation means forking the codebase. Every later workspace, every per-tenant setting, every isolated dataset becomes a migration.
02Auth designed for users, not organisationsThere are users but no orgs, no roles, no workspace switching. SCIM, SSO and admin delegation can't be bolted on later without rewriting the session and permission layer.
03Billing bolted on after launchRevenue logic and product logic share state. Plan changes mid-cycle, usage metering, refunds and trial extensions each become a special case in the application code.
04No domain separation in the monolithEvery team blocks every other team in the same repo. A two-person product squad can't ship a feature without a four-engineer review chain — and the senior hire you wanted leaves.
05Observability deferred until productionThe first paying-customer outage is debugged in raw logs. There is no per-tenant tracing, no error budget, no alert that distinguishes a noisy customer from a broken release.
How we deliver
From an architecture sprint to a stable production system
Four phases, predictable cadence, weekly demos. Nothing is hidden behind a 'big reveal' — you see deploys every week from week three.
01 · 1–2 weeks
Architecture sprint
We map the existing system, decide the tenancy model, lock the data model and write a one-page RFC your team and ours both sign off.
02 · 2–3 weeks
System design
API contracts, auth and billing boundaries, deployment topology. The output is a buildable spec — reviewed by your CTO before any production code is written.
03 · 6–12 weeks
Implementation
Vertical slices, weekly deploys behind feature flags. No big-bang launch — your team can ship product features alongside us throughout.
04 · 2–4 weeks
Stabilisation & handover
Load test, SLO baseline, runbooks, on-call documentation. We hand the system to your engineers, not to a maintenance contract.
What we actually did
Four funded teams, four real problems
These aren't logos on a wall. Each row is one engagement: what was broken when we walked in, what we changed, and what shipped.
A multi-role marketplace where creators, brands and agency operators all needed isolated workspaces, dashboards and approval flows in a single product surface.
What we did
Role-based product logic, per-workspace data isolation, structured campaign and content workflows engineered into the system from day one rather than retrofitted.
Result
Three operator personas use the same platform without conflict; new role types can be added without rewriting the access model.
The decisions we expect to argue about with your team in the architecture sprint — and the questions investors and acquirers will ask later.
01
Multi-tenant data isolation
Silo, pool or bridge — each model trades isolation against operational cost. The right choice depends on regulated data, expected tenant size, and whether you'll ever need a single-tenant deployment.
Pool: shared schema with tenant_id, lowest ops cost, weakest isolation
Bridge: per-tenant schema in a shared cluster, the usual middle ground
02
RBAC & organisation-level auth
Users belong to organisations, not the other way around. Workspace switching, role hierarchies and (later) SCIM provisioning all depend on getting the org/user/role boundary right on day one.
Org-as-root model with users invited into roles
Workspace switching that survives SSO and impersonation
Audit log that captures who did what in which workspace
03
Billing & metering
Plan changes mid-cycle, usage-based pricing, free-trial conversions and prorated upgrades all live or die on the metering boundary. Treat billing as a separate domain, not a feature flag.
Usage events emitted from the product, never derived from the database after the fact
Plan transitions modelled as state machines, not booleans
Refund and credit paths designed before the first paying customer
04
Integrations & webhooks
Outbound webhooks fail. Inbound integrations rate-limit. Idempotency, retries and replay are infrastructure, not application concerns — the SaaS that gets this right won't lose customer data on a partner outage.
Idempotency keys on every external write
Exponential backoff with a dead-letter queue for human review
Replay endpoint so a customer can recover from their own integration failure
05
GDPR & EU data residency
EU hosting is the easy part. The harder part is data subject access requests, sub-processor disclosure, deletion paths and contractual DPAs your customer's procurement team will read line by line.
EU-only processing with documented sub-processor list
Per-tenant deletion that survives backups and analytics pipelines
DPA template ready before the first enterprise customer asks
06
Observability & SLOs
Per-tenant metrics matter more than aggregate ones. A 99.9% global SLO can hide a single customer who's seeing 10% errors — and that customer churns first.
Per-tenant request, error and latency metrics tagged at the edge
Error budgets tied to product surfaces, not the whole system
On-call rotation with paging that distinguishes 'one customer broke' from 'the platform is down'
FAQ
Questions funded SaaS founders ask before they hire us
If your question isn't here, it's almost certainly the first thing we'll discuss in a 30-minute call.
Different situation? We answer the actual question, not the brochure version.
From the architecture sprint to a stable, production-running system: typically 12–20 weeks for a seed-stage product, depending on what's already shipped and what has to keep running. The first deploy of new code usually happens in week three. We don't quote a re-architecture without the architecture sprint output — quoting blind is how teams get burned.
Yes — that's the explicit constraint we plan around. Every implementation phase produces vertical slices behind feature flags, deployed weekly. Your product team works in the same repo, reviews the same PRs, and ships features alongside the rebuild. There is no production freeze, ever.
We work alongside it. We embed in your repository, follow your code review, attend your standups when it helps. Our job is to make your engineers stronger, not to make them dependent on us. By the end of stabilisation, the system runs on your team's on-call rotation, not ours.
Modular monolith, almost always, until you have at least three product squads or a clear operational reason to split. Microservices at seed stage trade a real problem (codebase coupling) for a worse one (operational complexity). The exceptions: anything that has to scale independently, like AI inference or per-tenant rendering.
We default to a bridge model — per-tenant schema in a shared cluster — because it's the easiest to migrate from later. Silo and pool are both reachable from bridge with bounded effort; the reverse migrations are punishing. The decision is made in the architecture sprint based on your largest expected tenant and your regulatory exposure, not on a default.
GDPR is a baseline, not a feature. Every system we ship has EU-only processing, a documented sub-processor list, per-tenant deletion that survives backups, and a DPA template your enterprise customers can sign. We'd rather over-engineer this on day one than defend a half-measure to your customer's procurement team six months later.