For agencies & freelancers
The multi-tenant base you ship to every client
without rebuilding it
Workspace isolation, role-based permissions, billing per organization, API keys — the parts that are a week of work each, already built and tested. Deliver faster, charge the same.
You bill the client's unique 30%, not the reusable 70%
A B2B SaaS MVP is typically $5k–$15k of dev time (40–120 hours at $50–$150/hr). Most of that rebuilds the same 70%: auth, teams, roles, billing, admin. Ship that from a tested base and your billable hours go where they should — the client's unique 30%. The base pays for itself on the first project.
Why agencies build a reusable base — in their words
A week of work each
"workspace isolation, role-based permissions, billing per organization, custom domains, audit logs — each piece is a week of work." — RovaAI, Indie Hackers
So they reuse their own
"For the common functionalities (login, signup, admin panel, user panel) I used boilerplate from my other projects." — ideastosaas, Indie Hackers
Auth alone is a month
"building and testing a full featured authentication system takes at least a month to do properly." — kylegawley, Indie Hackers
Real multi-tenancy, not a users table with a role column
Organizations, members, invitations, RBAC, per-org billing, and API keys. Underneath, a tenant-isolation guard — org-scoped repositories plus a Prisma query guard — makes a cross-organization read return 404, not someone else's data. It's the piece that's genuinely hard to get right, already right.
1 GET /api/orgs/acme/projects/42
2 session.org = "globex" // different org
3
4 → 404 Not Found
5 // org-scoped repo never returns
6 // another tenant's row.
Never ship insecurity with your client's name on it
The liability is real
A public scan found 303 exposed endpoints across 170 vibe-coded sites leaking personal, payment, and API-key data. For work delivered under a client's brand, that's reputational and legal risk.
The dangerous parts are hardened
Auth, RBAC, and tenant isolation are DDD-layered and CI-tested here — not plausible-looking security code with subtle flaws an agent left behind.
It survives a second look
Typed OpenAPI contracts, an audit-friendly outbox event bus, and OTel/Sentry observability mean the work holds up in a technical review, not just a demo.
The answer to “most starter kits end up rebuilt”
"Most of the business who use starter kit eventually end up rebuilding software from scratch." (sachingk, Indie Hackers) That's the category's loudest complaint — and it's a complaint about spaghetti starters, not about architecture. DDD boundaries, tests, and typed contracts are the direct answer: a base that grows client after client instead of getting thrown away on the third one.
Win more projects, keep more margin
Close the LATAM projects Stripe-only kits lose
Native MercadoPago plus real EN/ES/PT docs let you take on Argentine, Brazilian, and Mexican clients that Stripe-first kits can't serve.
It ships under your client's brand
You own the code outright, so the product you deliver carries your client's name — nothing forces a UseDeploy badge into what you ship.
A living base, not a frozen snapshot
An upstream sync tool pulls boilerplate improvements into your projects without a full merge — so the foundation keeps improving instead of aging.
Agency & freelancer FAQ
Can I use it on multiple client projects?+
Is this really different from a throwaway starter kit?+
Can I take on LATAM clients with it?+
I inherited a broken vibe-coded app. Can I land it here?+
Deliver more, rebuild less.
Ship the reusable 70% from a tested base and bill your hours where they matter — the client's unique 30%.