Marcus founded a UK scheduling SaaS and spent £40K getting an MVP live fast. It worked: 9,000 sign-ups in the first quarter. Then the single-tenant database started leaking one customer's data into another's view, billing drifted out of sync with Stripe, and there was no audit log to tell anyone what had happened.
Service SaaS development · MVP to Series B · UK senior-only studio
SaaS development that ships your MVP and your Series B on one codebase.
SaaS development for UK founders and scale-ups — multi-tenant from day one, an audit log on every mutation, Stripe billing wired, observability from the first deploy, and a SOC 2 evidence pipeline running before your first paying customer.
84SaaS builds shipped since 2019
12founders raised Series B on our code
0RLS leaks in production
SaaS development across every stage
You want one codebase that survives the round.
We do SaaS development with the same engineers from MVP to Series B, so the architecture that ships on day 1 still earns on day 1,200. Most SaaS dies not because the idea was wrong, but because the spine couldn't hold the growth.
“We build the multi-tenant foundation, the billing, and the audit trail in week one, so you're not rebuilding the day a real customer or a real acquirer turns up.”
001
84+
SaaS builds shipped to production since 2019.
002
12
Series A founders who raised Series B on our code.
003
28mo
Median client retainer tenure after the build ships.
The founder this page is for£40K seed · 9,000 sign-ups · rebuilt in 14 weeks
Marcus shipped his MVP in 6 weeks. The launch went better than planned. Then the spine started to crack.
The product wasn't the problem. The SaaS spine was. He'd treated multi-tenancy, observability, and an audit trail as things the next round would fund. By the time a real customer asked the hard question, every gap was a fortnight of senior engineering he didn't have spare.
We rebuilt the spine over fourteen weeks behind a feature flag, cutting over one tenant per weekend: row-level security in Postgres, an idempotent Stripe reconciler, an append-only audit log on every mutation. Zero downtime, zero data loss. This page is for the SaaS founder who'd rather build the spine once than rebuild it the week it breaks.
The pain. The day-1 answer.
Every SaaS founder who emails us is fighting one of these eight things. Each one is impossible to fix cheaply once the codebase is live. Each one is a single architectural decision made on day one of our build.
- 01
“We can't add multi-tenancy now without rebuilding everything from scratch.”
Row-level security from commit one. Postgres RLS enforces tenant isolation at the database. Customer 1 and customer 1,000 use the same hot path. No retrofit. No nine-month rebuild.
- 02
“Our biggest prospect wants SSO and our auth library can't do it.”
Clerk / Auth.js with SAML + OIDC stubbed. A one-day switch from email and password to SSO when your first enterprise customer demands it. You flip a flag. You don't lose the deal.
- 03
“Stripe is a mess. Subscriptions don't sync, taxes are wrong, refunds break invoices.”
Idempotent billing module + reconciler. A webhook reconciler verifies every Stripe event against our database. Stripe Tax handles VAT. Idempotency keys prevent double-charges.
- 04
“We have no audit log. SOC 2 is six months of panic engineering, not paperwork.”
Append-only audit log on every mutation. Every write is logged: actor, tenant, IP, timestamp, before-value, after-value. SOC 2 readiness becomes 8-12 weeks of paperwork, not six months of rebuild.
- 05
“Our acquirer's CTO flagged the single-tenant DB and the offer is on hold.”
Multi-tenant first, single-tenant never. The architecture brief and ADRs we ship are the documents the diligence team asks for. Three 2025 clients passed acquirer reviews on the first walkthrough.
- 06
“Every new customer takes us two hours of manual setup. We can't scale onboarding.”
Self-serve workspace provisioning. Workspace, invite, and billing is one flow from day one. A customer signs up at 11pm Sunday and is paying you by Monday morning. No founder in the loop.
- 07
“We broke at 4,000 concurrent users on launch day. We can't survive a real spike.”
Edge + serverless Postgres + idempotent writes. Vercel edge for reads, Neon serverless for the connection pool, queues for writes. Load-tested to 5× expected peak before handover.
- 08
“We don't know which customer is costing us money or which feature is burning the bill.”
Per-tenant cost attribution from week one. Every paid event is logged with a tenant ID. A live dashboard shows cost per customer, per feature, per day. Pricing decisions become data, not guesses.
The six things every SaaS founder retrofits too late
Multi-tenant SaaS foundations. Day one, not week ten.
Every SaaS we've shipped since 2019 makes the same six load-bearing decisions on day one. Each one is hard to retrofit, and each one answers a question you'll get asked the first time a real customer or an investor looks closely.
Row-level security in Postgres
Every query carries the tenant ID. The database enforces isolation, not your application code. A misrouted query returns zero rows, not someone else's data.
Workspace + organisation model
Users belong to workspaces. Workspaces own data. Roles are workspace-scoped. The data model your enterprise customer asks about in week one is the one you wrote on day one.
Stripe billing with usage + seats
Subscriptions, seats, usage, trials, dunning, proration, GBP and USD invoices, VAT. Webhooks idempotent. Tax handled. Your finance team thanks you in month three.
Append-only audit log
Every action that touches data is logged with actor, tenant, IP, and timestamp. Exportable. Searchable. SOC 2 stops being a panic project and becomes paperwork.
SSO ready, not SSO live
Auth.js, Clerk, or WorkOS with the SAML and OIDC paths stubbed. When your first enterprise customer demands SSO, it's a one-day switch, not a one-month rebuild.
The kill-switch + data export
One-click tenant suspend. One-click full data export per workspace in CSV and JSON. The two things every DPA and every cancellation flow needs. We wire them in week two.
Cracking spine to Series A close, in one quarter
Single-tenant rebuilt multi-tenant behind a flag, cut over one tenant per weekend. Zero data loss, zero downtime, a term sheet eleven weeks after handover.
14wk
Multi-tenant rebuild behind a
They rebuilt the spine in fourteen weeks without a minute of downtime. The architecture brief was the document that closed our Series A.
Three tiers, twenty-two technologies, one defensible spine.
Eighty-four SaaS platforms have stress-tested these picks. Tier 1 runs every build. Tier 2 is what we reach for when the brief needs it. Tier 3 scales it to Series B without a rebuild.
T1
What we build every SaaS on
MERN + FlutterMongoDBExpress.jsReact + Next.jsNode.jsTypeScriptFlutterPostgreSQLMixpanelStripeClerk / Auth.jsTailwindPlaywright
T2
When your brief actually calls for it
reach when neededPythonJavaReact NativeSwift / SwiftUIKotlinGo
T3
The infrastructure that scales it
AWS + cloud-nativeAWSKubernetes (EKS)DockerAWS LambdaAWS RDS / AuroraS3 + CloudFrontRedisApache KafkaGraphQLTerraformDatadog + SentryMicroservices
Diligence-ready
Cracking spine to
Cracking spine to
Series A close, in one quarter
Marcus's scheduling SaaS, in real numbers. Single-tenant rebuilt multi-tenant in 14 weeks behind a flag, cut over one tenant per weekend. Zero data loss, zero downtime, a term sheet 11 weeks after handover.
The rebuild
14wk
Multi-tenant rebuild behind a flag
0
Downtime at cutover
The outcome
11wk
Handover to a new term sheet
9,000
Users migrated, zero loss
Track record
84+
SaaS platforms since 2019
12
Founders raised Series B on our code
What keeps a SaaS alive past the first 1,000 customers
Four things that carry a SaaS from launch to a real round
The engineering that separates a working demo from a platform your next engineer inherits without apology and your acquirer's diligence team walks through without flinching.
Tenant isolation(01)
Tenant isolation that's provable
Postgres row-level security on every query. A leak isn't prevented by policy, it's impossible by design. The first thing a careful customer or auditor checks, already done.
Postgres RLSTenant IDZero leaksProvable
Tenant isolation that's provable
Billing(02)
Billing that matches reality
An idempotent Stripe reconciler checks every event against your database. No double-charges, no drift, VAT handled. Your finance team trusts the numbers from month one.
StripeIdempotentVAT handledNo drift
Billing that matches reality
Audit log(03)
An audit log that satisfies diligence
Append-only, actor and tenant and IP stamped, exportable. Not server logs renamed. The artefact that turns a Series A diligence call from two days into 28 minutes.
Append-onlyExportableSOC 2Diligence
An audit log that satisfies diligence
Observability(04)
Observability from the first deploy
Sentry, PostHog, and per-tenant cost attribution wired before launch. You know which customer is costing you money and which feature is burning the bill, on day one.
SentryPostHogCost per tenantDay one
Observability from the first deploy
What SaaS founders actually ask before signing the contract
Pain-first, soft-second. The questions every founder asks after their third bad agency experience.
We don't price by salesperson mood. The audit week is fixed at £8K. After that, every SaaS development build is line-itemed into the scope document: workspace and auth, billing, core flows, admin tool, observability, handover pack. You see the cost of each piece, and you can cut any piece. Most multi-tenant SaaS builds we sign land between £65K and £120K on a 10-to-16 week fixed-price sprint. If we can't hit your budget, we tell you in week one and you walk away with the audit brief, no commitment.
Your code lives in your GitHub org from commit one. IP assigns on commit, not on final payment. Every dependency is open source or owned by you. Architecture decisions are documented in ADRs so any senior engineer can pick up the codebase in week one. If Empyreal vanished tomorrow, you'd have a working repo, a runbook, and six ADRs explaining every meaningful call. Nothing about your SaaS development work is locked inside our walls.
Three things make this hard to fake. First, the 30-day walk-away clause goes both ways and refunds the unused portion. Second, payments are milestoned: 25% on signed scope, 25% on staging up, 25% on production live, 25% on handover. You never pay more than 25% ahead of working software. Third, we've been shipping since 2019 with 200+ projects under our name, listed on Companies House, with UK VAT registered. You can check us before you sign.
This is the single biggest risk with a small studio, and the reason we run our process the way we do. Every project pairs two senior engineers, not one. Every decision is written into an ADR the same day. Every commit goes through Mohit's review. If one engineer leaves, the other has full context the next morning. In seven years, two engineers have left mid-project. Both handovers were inside 48 hours. Neither client noticed in their sprint.
We ship every SaaS on the MERN stack (MongoDB, Express, React with Next.js, Node.js) with AWS for infra. As of 2026, that's the biggest hiring pool in the UK and globally. London alone has 14,000+ Node engineers on LinkedIn. Any senior frontend or full-stack developer your future CTO interviews will be fluent in your stack on day one. Boring on purpose, hireable on purpose.
Yes, with 14 days' notice. The engineers move to other projects, your repo stays where it is, your spend pauses. Pick it back up with 14 days' notice and we resume on the same sprint board with the same engineers. No cancellation fee, no restart fee. We've done this six times in 2025. Two clients paused for four months. Both came back. Both shipped.
That's the point of how we build. Multi-tenant from day one, an append-only audit log, ADRs for every meaningful decision, and an architecture brief written for a CTO to read cold. Three of our 2025 clients passed acquirer reviews on the first walkthrough, and twelve founders we built with raised Series B on the code we wrote. SaaS development done this way turns a two-day diligence ordeal into a 28-minute call.
You walk away cleanly. The handover pack includes the architecture brief, ADRs, runbook, on-call playbook, DPA, and a 30-minute video tour of the codebase for your next engineer. We offer an optional £5K/month advisory retainer if you want a senior voice on your weekly engineering calls. It's cancellable with 30 days' notice, any month. Most clients run it for the first six to nine months while their in-house lead settles in, then end it without ceremony. No lock-in, no surprise renewals.
The SaaS build
SaaS that survives Series A.
The architecture your next CTO inherits without apology — observable, documented, and yours.
One paragraph. That's it.
Tell us where you are, how many customers you have, and what your next 12 months looks like. Mohit reads every first email and replies inside 24 hours: a clear yes, a clear no, or the one question that decides it.
What happens after the email lands
- < 24h
A personal reply.
Yes, no, or the deciding question. Straight to your inbox, not a team thread.
- Week 1
Audit week begins.
We draw the multi-tenant spine, write the trade-offs, and hand you a signed scope.
- Week 16
Diligence-ready SaaS.
Multi-tenant, billed, audited, with the brief your acquirer's CTO reads cold.