Services / Build
We build multi-tenant web platforms with the controls enterprise buyers actually verify: SAML 2.0 and OIDC single sign-on, SCIM provisioning, RBAC and ABAC authorisation, immutable audit logging, WCAG 2.2 AA accessibility and measured Core Web Vitals budgets. These are engineered from the first increment, because retrofitting tenancy or an audit trail costs several times what building it in does.
At a glance
Architecture
This is the decision that is hardest to reverse. Everything else on this page can be added later at reasonable cost. Tenancy cannot.
Silo vs pool vs bridge
Default to pool tenancy: one database, every table scoped by tenant identifier, isolation enforced in the data layer. Choose silo — a database or cloud account per tenant — when a contract requires physical separation or one tenant would distort capacity for the rest. Bridge, shared infrastructure with a schema per tenant, sits between them and carries the migration overhead of silo with less of the isolation benefit.
| Dimension | Silo (database or account per tenant) | Pool (shared, tenant-scoped rows) | Bridge (shared database, schema per tenant) |
|---|---|---|---|
| Isolation strength | Strongest. Separate credentials and blast radius per tenant | Logical only. Depends entirely on correct query scoping | Strong logical separation, shared engine and shared failure domain |
| Infrastructure cost per tenant | Highest. Each tenant carries its own baseline | Lowest. Idle tenants cost close to nothing | Moderate. One engine, many schemas |
| Schema migration effort | Runs N times. Needs orchestration and partial-failure handling | Single pass across the whole platform | Runs N times but within one engine and one connection pool |
| Noisy neighbour risk | None between tenants | Real. Needs per-tenant rate limits and query governance | Reduced but not eliminated. Shared CPU, memory and I/O |
| Per-tenant restore | Trivial. Restore one database | Hard. Requires logical extract and selective replay | Moderate. Schema-level restore is workable |
| Per-tenant data residency | Natural fit. Place the tenant in its own region | Not possible without a second deployment | Only at the deployment level, not per schema |
| Scale ceiling | Operationally painful beyond roughly 200 tenants | Thousands of tenants; sharded further when needed | Connection and catalogue limits bite around 500 schemas |
| Best fit | Regulated sectors, large enterprise accounts, government contracts | Self-serve and mid-market B2B SaaS, internal platforms | Mid-market where tenants demand separation without silo economics |
Most platforms end up hybrid: pool for the long tail, silo for the two or three accounts whose contracts demand it. Design the abstraction on day one so a tenant can be promoted from pool to silo without an application rewrite. Retrofitting that promotion path is a multi-month project.
Identity
Three separate problems that get conflated. Authentication proves who the user is. Provisioning keeps the account list correct. Authorisation decides what they may do.
How enterprise identity fits together
We implement SAML 2.0 and OIDC for authentication, SCIM 2.0 for automated provisioning and deprovisioning, and a layered authorisation model: RBAC for coarse capability and ABAC for contextual limits such as region, business unit, record ownership or data classification. Roles alone cannot express "only claims under 50,000 in their own branch", which is why almost every enterprise platform needs both.
Authentication
Still the most requested standard in enterprise procurement, particularly with Entra ID, Okta and Ping deployments that predate OIDC rollout.
Authentication
Preferred for new integrations, mobile clients and machine-to-machine access. Cleaner token handling and far easier to debug than SAML.
Provisioning
The difference between a leaver losing access in seconds and a dormant active account discovered at the next audit.
Authorisation
Policy evaluated centrally and consistently, never scattered through controllers as ad-hoc conditionals.
Auditability
What makes an audit log defensible
An audit log is not application logging. It is an append-only record of who did what to which entity, when, from where, and what the values were before and after. We write it in the same database transaction as the change so it cannot silently diverge, hash-chain each entry to the previous one so tampering is detectable, and ship it to write-once storage with an object-lock retention period.
Performance
A budget only works if it fails a build. Ours are enforced in the pipeline against synthetic runs and monitored continuously against real user data.
| Metric | Target | Pipeline fails above | Measured how |
|---|---|---|---|
| Largest Contentful Paint (LCP) | Under 2.5 s at p75 | 2.9 s | Real user monitoring plus Lighthouse CI on key routes |
| Interaction to Next Paint (INP) | Under 200 ms at p75 | 260 ms | Real user monitoring, field data only |
| Cumulative Layout Shift (CLS) | Under 0.1 at p75 | 0.15 | Real user monitoring plus synthetic checks |
| Time to First Byte | Under 600 ms at p75 | 800 ms | CDN and origin logs |
| JavaScript transferred, initial route | Under 200 kB compressed | 260 kB | Bundle analysis as a pipeline step |
| Server response, p95 read API | Under 300 ms | 450 ms | Application performance monitoring traces |
| Server response, p95 write API | Under 700 ms | 1,000 ms | Application performance monitoring traces |
| Search or list query, p95 | Under 1.2 s at 1 million rows | 2 s | Load test against production-shaped dataset |
| Report generation, synchronous | Under 8 s or made asynchronous | Anything over 10 s | Load test plus production timing histogram |
p75 and p95 rather than averages, because averages hide the experience of the users who complain. Budgets are set per route: a dense operational grid is not held to the same payload budget as a marketing page.
Scale
How we keep reporting off the critical path
Operational and analytical reads are separated. Interactive reports hit a read replica or pre-aggregated summary tables. Exports above roughly ten thousand rows become asynchronous jobs that stream to object storage and hand the user a signed, expiring download link. Nothing that can grow unboundedly runs inside a request-response cycle.
Reach
Conformance is engineered, not audited in at the end. Retrofitting accessibility into a component library after launch typically costs three to five times more than building it accessibly.
Automated tooling detects roughly a third of WCAG failures. Full validation requires manual testing with assistive technologies and expert accessibility review, which we scope separately.
Cheap if designed in, expensive if bolted on. We externalise strings from the first increment even when only English is required at launch.
Currency is a business rule, not a formatting concern. Multi-currency needs a decision on rate source, rounding and the rate date before any code is written.
Stated in the contract so it is never an argument later.
Where an internal user base is pinned to an older browser by policy we will support it, but we price it. Older engines mean transpilation, polyfills and a separate test matrix, typically adding eight to fifteen percent to front-end effort.
Answers
Not user count. It is the set of things enterprise procurement verifies before signing: single sign-on against their identity provider, automated user provisioning and deprovisioning, role and attribute-based authorisation, an audit trail an auditor accepts, accessibility conformance, documented data residency, and a support agreement with response targets. An application can serve fifty users and be genuinely enterprise-grade, or fifty thousand and fail every one of those checks.
Pool tenancy — shared database with tenant-scoped rows — is the default because it keeps per-tenant cost lowest and schema migrations single-pass. Move to silo, one database or account per tenant, where a contract or regulator demands physical separation, or where one tenant is large enough to distort capacity for everyone else. Bridge, shared infrastructure with separate schemas, is the middle ground and the hardest to reverse later.
Both, and enterprise buyers still ask for SAML 2.0 more often than OIDC. We implement service-provider-initiated and identity-provider-initiated SAML flows with signed assertions, per-tenant certificate rotation, and metadata exchange. OIDC is used for newer identity providers and for our own first-party clients. Applications are built so a tenant can be moved between the two without a data migration.
SCIM 2.0 is the standard protocol identity providers use to create, update and deactivate accounts in your application automatically. You need it when tenants have more than roughly two hundred users or a compliance requirement that leavers lose access within a fixed window. Without SCIM, deprovisioning depends on somebody remembering, and dormant active accounts are one of the most common audit findings.
Accessible component primitives from the start, automated axe-core checks as a pipeline gate, and manual keyboard and screen reader testing with NVDA and VoiceOver each release. Automated tooling catches roughly a third of WCAG failures, so manual testing is not optional. Full conformance verification requires review by an accessibility specialist and testing with assistive technology users, which we scope as a separate audit.
Largest Contentful Paint under 2.5 seconds, Interaction to Next Paint under 200 milliseconds, and Cumulative Layout Shift under 0.1, measured at the 75th percentile of real user traffic rather than in a lab. We also budget JavaScript payload and server response time, because those are the levers engineers can actually pull during a sprint.
Yes. We deploy into the AWS, Azure or Google Cloud region you require and keep primary data, backups and logs inside it. Where a tenant needs a dedicated region we use the silo model for that tenant only rather than fragmenting the whole platform. Be aware that region pinning limits which managed services and AI models are available, and we document those gaps before you commit.
Operational reads and analytical reads are separated. Interactive reports run against a read replica or a pre-aggregated summary table refreshed on a schedule. Anything larger than a few thousand rows becomes an asynchronous job that streams to object storage and notifies the user with a signed download link. Synchronous export of large result sets is the single most common cause of production timeouts we are called in to fix.
Send the security questionnaire, the accessibility clause and the identity requirements from your largest prospect. We will tell you which items your current platform already satisfies and what the gaps cost to close.