Get the kit
v1.0 · self-hostable · full source code

Stop rewriting
your SaaS foundation: multi-tenant, 2FA auth, white-label, CI/CD, branded emails.

A complete B2B foundation — organizations isolated by PostgreSQL RLS, white-label, 2FA auth, branded emails, i18n — shipped with its CI/CD chain, blocking security checks and automated Docker Compose delivery. On your infrastructure, with no metered cloud bill.

Get the kit See the CI/CD chain
  • Full source code, lifetime license
  • Self-hosted — no PaaS dependency
  • Security pipeline included

The stack your devs already know

TypeScript, PostgreSQL, Docker, Coolify, GitHub Actions, Tolgee, Dependency-Track, Gitleaks, Semgrep, OpenSSF Scorecard, Playwright, Vitest, Traefik.

The product

Everything a B2B SaaS rewrites every time, already written.

Every piece is tested and documented. You start from the product, not the skeleton.

Security

Auth + roles + 2FA in minutes

Sign-in, owner/admin/member roles and TOTP 2FA already wired, isolated per tenant with no manual config. You enable it, you sign in, it works.

White-label

The client's brand, served at runtime

Color, logo and radii via design tokens, applied to the UI and emails without redeploying. AA contrast checked server-side, dark mode included.

  • Multi-tenant by design

    Organizations and spaces isolated per tenant, roles and invitations included.

  • CI/CD pipeline

    Tests, security checks, signed images, Docker Compose delivery.

  • Creation wizard

    Tenant provisioned in five steps: database, subdomain, API keys.

  • Branded emails

    Invitation, verification, reset — re-themed per tenant.

  • i18n with Tolgee

    Self-hosted Tolgee, ICU catalogs versioned in the repository. One command adds a language.

  • Platform console

    Superadmin: tenants, plans and quotas, audit log, impersonation.

CI/CD

One push, and the chain does the rest.

The pipeline runs on standard GitHub Actions: hosted runners or your own, your choice. Each step gates the next: an image is delivered only when CI and e2e tests are green on the commit.

  1. Push
    • triggered on main and PRs
    • hosted or self-hosted runners
    • typecheck, lint, module boundaries

  2. Quality
    • lint + typecheck
    • vitest unit tests
    • playwright e2e

  3. Security
    • gitleaks
    • semgrep
    • pnpm audit + osv-scanner
    • grype image scan

  4. Build
    • arm64 docker images
    • CycloneDX SBOM
    • cosign signature + SLSA provenance

  5. Production
    • waits for green ci + e2e
    • docker compose + traefik
    • manual redeploy = rollback

Delivery to your server

Delivery waits for CI and e2e tests to be green on the commit, then deploys the signed images with Docker Compose behind Traefik. A manual redeploy workflow is the rollback path.

docker compose · traefik · postgresql 17 · redis

GitHub runners of your choice

Workflows are standard GitHub Actions: hosted runners by default, or your own self-hosted (ARM64) runners through a single variable. Image publishing and delivery run on your runners.

actions-runner · docker buildx · local cache

Automated tests

Unit and API tests on a real PostgreSQL, Playwright end-to-end with axe accessibility checks on critical journeys. A red test blocks delivery, not just a badge.

vitest · playwright · coverage per PR
blocking security checks on every PR
5
security control sheets, with evidence
49
documented architecture decisions (ADR)
73
Docusaurus documentation sites
4
Security

Blocking checks on every PR. Already wired.

Secrets, code, dependencies and images are checked in CI; published images are signed and carry their provenance. An enterprise client asks about your security posture? You show 49 control sheets and their evidence.

blocking in CI · report per PR

  • Gitleaks

    blocking · full history     Scans the whole git history on every PR: a committed API key, token or password fails CI.

  • Semgrep

    static analysis · blocking     TypeScript, Node.js and secrets rules on every PR; any finding fails the pipeline.

  • pnpm audit + OSV-Scanner

    dependencies · blocking     High vulnerabilities refused, OSV database queried with justified, versioned exceptions.

  • SBOM, grype, Cosign

    images · blocking     CycloneDX SBOMs from syft and cdxgen, grype scan on every PR and weekly, Cosign-signed images with SLSA provenance and VEX. The SBOMs feed your Dependency-Track.
Industries

Built for sectors that get audited.

Audit log, CI security checks, shipped documentation: the kit provides the technical building blocks these sectors expect. Compliance itself remains yours.

  • Health & medtech

    Append-only audit log, data export and erasure, per-role 2FA: the technical building blocks of a health compliance file, completed by your own measures.

    audit log

  • Finance & insurance

    Every action traced, mandatory 2FA, the continuous dependency review your auditors ask for.

    per-role 2fa

  • Public sector

    Self-hosting: your data stays on your infrastructure, data export and erasure built in.

    export · erasure

  • Legaltech

    Strict per-firm isolation, controlled and justified impersonation, configurable audit log retention and purge.

    audit trail

  • Agencies & studios

    White-label by API: ship every client under their own brand, from a single foundation.

    multi-tenant

  • Industry & IoT

    Hardened pipeline with continuous SBOM: Cyber Resilience Act compliance starts in CI.

    continuous sbom
Roadmapcoming soon

Voice becomes an admin interface.

Next step: expose the foundation to agents through an MCP server. Dictation and transcripts will become verified actions, with the same permissions and audit log.

Dictation → actions

Dictate an instruction; the agent converts it to MCP calls and shows you the plan before executing.

Transcript → actions

Drop in a meeting transcript: the agent extracts platform actions and proposes them for approval.

Documentation

Four Docusaurus sites shipped with the kit

End users, developers and architects, security, decisions: each audience has its own docs, versioned in their repository and checked in CI. Your teams never start from a README.

  • User help

    PUBLIC     Guides for the end users of your SaaS: workspaces, members, roles, account security. The only published site. 51 pages

  • Developers & architecture

     Architecture, flows, operations, building, quality, the Contour design system and reference. 116 pages

  • Security

     Threat model, 49 control sheets with evidence, compliance and procedures. 70 pages

  • Decisions (ADR)

     73 reasoned architecture decisions, from multi-tenancy to delivery. 75 pages
Compliance: the building blocks are in the code Audit log, export and erasure, controls mapped to SOC 2 criteria. Audits, certifications, DPA, registers and volume encryption remain the buyer's responsibility.
  • Auditappend-only
  • Exportand erasure
  • SOC 2criteria mapped
Pricing

One payment. The code is yours.

Lifetime license, full source code, no subscription.

See the offer details

  • Kit

    The complete foundation, on your own.     €1,000lifetime license One-time payment
    • Full source code of the foundation
    • Multi-tenant, white-label, 2FA auth
    • CI/CD chain + 5 blocking security checks
    • Docker Compose delivery and runners included
    • Contour design system, light and dark
    Get the kit

  • Kit + guidance

    Installed and in production with us.     On quote Based on your project
    • Everything in Kit, plus:
    • Guided install: Traefik, runners, Tolgee, Dependency-Track
    • Review of your first production release
    Request a quote
Good to know

Frequently asked questions

What do I need to host it?

A Linux server with Docker and a GitHub repository. The API, worker and console run with Docker Compose behind Traefik, with PostgreSQL 17 and Redis. Tolgee and Dependency-Track have their own Compose files; Dependency-Track alone needs about 4.5 GB of RAM.

Can I use my own GitHub runners?

Workflows run on GitHub-hosted runners by default; one variable switches them to your self-hosted runners, which image publishing and delivery already use. Your deployment secrets stay on your network.

Which security checks block CI?

Gitleaks, Semgrep, pnpm audit, OSV-Scanner and the grype image scan run alongside the tests. Every exception is justified and versioned in the repository, never silently disabled.

What stack is the foundation built on?

Strict TypeScript end to end: NestJS on Fastify for the API, PostgreSQL 17 and Drizzle, Better Auth for authentication, BullMQ and Redis for jobs, React 19, Vite and Refine for the console, Tolgee for i18n. pnpm and Turborepo monorepo.

Can I use it for client projects?

Yes. The license covers one production product per license, with no limit on tenants or end users.

Ready?

Your next SaaS starts at the next git push

Get the kit