Pricing
The foundation, delivered complete: code, docs, CI/CD and security.
One payment, the full source code and no subscription. Pick your level of support, then write to us: we get back to you to arrange delivery.
- Lifetime license, full source code
- Self-hosted on your infrastructure
-
Kit
The complete foundation, on your own. €1,000lifetime license One-time payment- Full source code of the foundation
- Multi-tenant, white-label, 2FA auth
- CI/CD chain + 5 blocking security checks
- Docker Compose delivery and runners included
- Contour design system, light and dark
-
Kit + guidance
Installed and in production with us. On quote Based on your project- Everything in Kit, plus:
- Guided install: Traefik, runners, Tolgee, Dependency-Track
- Review of your first production release
Quality and tooling
What you buy, verified in the code.
Every line below maps to a file, a workflow or a documentation page of the foundation. No promises: systems in place.
-
Multi-tenant architecture
- One database, Row Level Security isolation in FORCE mode, app role without BYPASSRLS
- A meta-test fails CI when a tenant table has no policy
- 56 versioned SQL migrations
- Append-only audit log: the database refuses DELETE to the app role
- SSRF-protected outgoing webhooks, XState workflows versioned per workspace
-
Identity and access
- TOTP 2FA with 8 backup codes, mandatory per workspace and per role
- Account lockout, password policy, step-up, session revocation
- Owner, admin, member roles plus custom roles per workspace
- Delegated session (impersonation): dedicated permission, 1 h max, mandatory reason, audited
- Identity port ready to plug another provider (SSO) when needed
-
Tech stack
- Strict TypeScript end to end, Node 22, digest-pinned image
- NestJS 12 API on Fastify 5, generated OpenAPI and client SDK
- React 19, Vite 8, Refine 5 console, Contour design system
- BullMQ and Redis 8 jobs: outbox, emails, purges, webhooks
- Billing through a Stripe or manual port, enforced quotas (402)
- OpenTelemetry and pino observability
-
Cybersecurity
- Gitleaks on the full history, Semgrep, pnpm audit and OSV-Scanner: blocking on every PR
- CycloneDX SBOMs (cdxgen, syft), grype scan on every PR and weekly
- Cosign-signed images, SLSA provenance, OpenVEX attestation
- Helmet and HSTS on the API, strict CSP with violation reports, Redis rate limiting
- File-based secrets, Dependabot, SECURITY.md policy
- Threat model and 49 control sheets with evidence
-
Compliance: what the code provides
- Append-only audit log, kept 24 months by default (never under six), purge built in
- Member and workspace export (access, portability), member pseudonymization, workspace erasure within 30 days
- TLS and HSTS in the browser, hashed passwords and backup codes
- Controls mapped to SOC 2 criteria, security questionnaire for your buyers, risk register
- Your responsibility: DPA, processing and breach registers, audits and certifications, volume and backup encryption
-
Dependency-Track
- Dependency-Track instance provided as Docker Compose, with its PostgreSQL
- pnpm sbom:sync pushes code, image and CI SBOMs
- pnpm dtrack:setup installs the "critical vulnerability = fail" policy and email alerts
- VEX import to document non-exploitable vulnerabilities
-
Internationalization
- Self-hosted Tolgee, optional DeepL machine translation
- ICU catalogs (intl-messageformat), source of truth in the repository
- pnpm i18n:sync: keys, tags, screenshots and context pushed to translators
- French and English complete (~1,300 keys), one command adds a language
-
CI/CD
- ci: typecheck, lint, module boundaries, tests, build, up-to-date OpenAPI and SDK, security checks, images
- e2e: Playwright against the real API, axe accessibility
- sast, sbom, image-scan, scorecard: dedicated and weekly scans
- release-images: signed arm64 images, then delivery only when ci and e2e are green
- deploy: manual redeploy, the rollback path
- load: k6 on every release, p95 < 300 ms target
-
Quality and tests
- Tests on a real PostgreSQL (Testcontainers), no mocked database
- Automatic check that every API route is covered
- Backup restore proven in CI
- Manual scenarios documented in TESTING.md
- doc-impact: every PR lists the documentation pages to review
-
Docusaurus documentation
- End-user help: 51 pages, published
- Developers and architects: 116 pages (architecture, operations, quality, Contour)
- Security: 70 pages (threat model, controls, compliance, procedures)
- Decisions: 73 reasoned ADRs
- Docs CI: sources and evidence checked, all 4 sites built
-
AI agent harness
- CLAUDE.md and AGENTS.md kept in sync: the repository rules your coding agents read
- 5 skills: atelier, avis-frais, e2e-pr, lot, release
- 3 reviewer agents: architect, lead-dev, doc auditor (Claude and Codex)
- Preset allow, ask and deny permissions (force push and deletions forbidden)
- "Product agent" kit to build your product on the foundation, kept in line with the code by a test
Running costs
- Open source, self-hosted toolchain: Tolgee, Dependency-Track, Gitleaks, Semgrep OSS, OSV-Scanner, syft, grype, Cosign. No third-party license to pay.
- Trial platform run on Oracle Cloud Always Free (Ampere A1, arm64). The free tier now covers 2 OCPUs and 12 GB of memory (1,500 OCPU hours and 9,000 GB hours per month).
- GitHub-hosted runners free at this scale, or your own runners.
- Plan about 4.5 GB of RAM for Dependency-Track.
What is delivered
Four parts, one delivery.
The product, its documentation, its CI/CD chain, its cybersecurity checks and, as an option, our guidance.
| Included | Kit€1,000 | Kit + guidanceOn quote |
|---|---|---|
| Product foundation | ||
| Full source code of the foundation | Included | Included |
| Multi-tenant, white-label, 2FA auth | Included | Included |
| Branded emails, platform console | Included | Included |
| Self-hosted Tolgee i18n, French and English ICU catalogs | Included | Included |
| AI agent harness: CLAUDE.md, AGENTS.md, 5 skills, 3 reviewer agents | Included | Included |
| Contour design system, light and dark | Included | Included |
| Documentation | ||
| 4 Docusaurus sites: user help (51 p.), developers and architects (116 p.), security (70 p.), ADR decisions (75 p.) | Included | Included |
| CI/CD | ||
| GitHub Actions CI/CD chain: tests, signed images, Docker Compose delivery | Included | Included |
| Self-hosted runners supported, Traefik proxy included | Included | Included |
| Guided installation: Traefik, runners, Tolgee, Dependency-Track | Not included | Included |
| Cybersecurity | ||
| 5 blocking checks: Gitleaks, Semgrep, pnpm audit, OSV-Scanner, grype image scan | Included | Included |
| CycloneDX SBOM, Cosign-signed images (SLSA, VEX), Dependency-Track included | Included | Included |
| Threat model and 49 control sheets with evidence | Included | Included |
| Review of your first production release | Not included | Included |
Contact
Interested in an offer? Write to us.
Three required fields. Your message lands directly in our inbox and we reply by email.
Reply by email.