One app, many customers, provably isolated.
Your software is only as safe as its weakest tenant, and the first customer who runs a security review will ask about it before anything else.
We inventory what exists, prove what holds, fix what does not, scope the platform tier your compliance requires, pass the security gate, and stay on monitoring. The UI is not lost.
- 1Inventory
- 2Prove
- 3Fix
- 4Scope
- 5Monitor
What the probe actually does
We create two tenants in your live app and try, from tenant A, to read, list, write and download what belongs to tenant B. Every route, every function, every file URL. The write-up says what was tested, what held, and what did not, in language you can hand to your own customers.
If it finds a leak, the report prices the fix. It is a test report, never a certification, and this page says so.
The ladder
Ten questions a security reviewer would ask, scored. Three things they would ask about first, on screen.
The A/B tenant probe above, written up as a result you can show your own customers.
Inventory of entities and rules, backend functions and their service-role use, scheduled jobs, file-bearing entities, per-customer integrations, and the platform tier your compliance requires. Output: a written scope with fixed prices.
Tenant-aware entities and functions, payments with one choke point, per-tenant integration config, file isolation with tenant-scoped signed URLs, and the probe re-run as acceptance.
Software for an advisory firm, CPA or professional practice: a client diagnostic, a portal, an integration into the CRM you run. Formats, never advises.
Health check on central monitoring, security patching, version history, one hour of small changes. Or scoped where you run your own workspace.
The Triage is credited against your build if you sign within thirty days. It is required before we quote anything with more than one customer.
What we refuse
Apps that store health information, anywhere. Apps we would have to host that hold licenses, background checks or financial account data; those live in your own workspace.
Rebuilds that discard a working UI. Quotes before a Triage on anything with more than one customer. We say founder-built, and we do not use the word vibe-coded.
Platform truths
Four things about the platform that decide how we build. Each one is a constraint we design around, not a surprise you find later.
Renaming a page orphans its meta row
Why we launch under new names
Cloning is export and import by hand
Why we build in the app you already run
One implementation, no shared modules
Why a second mode beats a second function
Service-role calls bypass your rules
The first thing the probe looks for
Find out what holds.
Ten questions a security reviewer would ask, free. The probe is the opening ask in every conversation after that.