How to Build a SaaS Product in 2026, from Architecture and Tenancy to Billing, SOC 2 and Launch
Vasim Gujrati
Solutions Architect, AI & Platforms, Unico Connect
In this article
- Quick Answer
- Key Takeaways
- What Business Buyers Expect When You Build a SaaS Product
- Choose a Tenancy Model Before the First Table
- SaaS Tech Stack and Architecture for a First Release
- SaaS Billing, Plans and Usage Metering
- SOC 2 Readiness Starts During the Build
- Adding AI Features Without Mixing Tenant Data
- Team, Timeline and Budget to Build a SaaS Product
- A Launch Checklist for a B2B SaaS
- How Unico Connect Builds SaaS Products
- Frequently Asked Questions
How to build a SaaS product depends on who will buy it. A solo founder selling a $10 tool can lean on an AI app builder and ship a first version fast. A team selling to businesses faces a different test, because the buyer often sends a security questionnaire before signing. We sell SaaS product development. Weigh our view with that in mind.
Quick Answer
To build a SaaS product for business customers, validate one painful workflow, then settle five decisions before feature work. Choose a tenancy model, enforce tenant isolation in the database, wire billing to plan entitlements, design for single sign on (SSO) and audit logs, and run the controls a SOC 2 auditor will later test. Add AI features only on tenant scoped data.
An MVP takes 2 to 3 months, on web or mobile. A multi role SaaS with integrations, reporting and payments is a mid sized platform, which takes 3 to 6 months, depending on complexity and workflows.
Key Takeaways
- A tenant is usually a customer organization. Start pooled, with a tenant key on every row, and give a customer its own database only when a contract demands it.
- PostgreSQL row level security enforces isolation, but superusers, BYPASSRLS roles and views can skip it. Test with two tenants before launch.
- At list prices on a US domestic card, Stripe Payments plus Billing takes $3.90 on a $100 charge, while Paddle takes $5.50 and handles sales tax.
- SOC 2 is an audit report from a CPA firm. Its auditor samples evidence from the system you build now.
- AI features need the tenant filter too, and token cost at our example load runs from about 1 cent to $1.10 per user a month.
What Business Buyers Expect When You Build a SaaS Product
Business buyers check the work around the feature before they sign, such as tenant isolation, audit events, data export and single sign on. In a February 2026 build log on ITNEXT, developer Dobri Kostadinov wrote that the code was 30 percent of the work. For his self hosted tool, the other 70 percent went to distribution, licensing, telemetry, a website, a Slack integration, security and outreach. A B2B SaaS has hidden work too, and buyers inspect it. Sort it into three piles.
Build in release one
- Tenant model and access rules enforced on the server
- The core workflow your buyer pays for
- Audit events for sign in, admin actions and data access
- Data export, so a customer can leave with its records
Buy, do not build
- Login, password reset and multi factor authentication (MFA)
- Payments, invoices and tax calculation
- Transactional email and error monitoring
Defer until a deal asks
- SSO and SCIM provisioning
- A dedicated database per customer
- Data residency in a second region
- The SOC 2 audit itself, not the controls it tests
Enterprise buyers commonly ask for single sign on through SAML 2.0 and for user provisioning through the SCIM protocol, defined in IETF RFC 7644. Pick an identity layer that supports both. In October 2026, WorkOS listed SSO at $125 per connection a month for the first 15 and counted each enterprise customer as one connection, with Directory Sync for SCIM priced the same way. The SOC 2 audit can wait for a deal, but start its observation window before one arrives.
Choose a Tenancy Model Before the First Table
Start with the pool model, which AWS calls significantly more cost effective with less operational overhead, and move a customer to its own database only when a contract pays for it. In a multi tenant SaaS architecture for business customers, Microsoft expects each tenant to be one customer organization, with all its employees as users inside it. The AWS Well-Architected SaaS Lens names three ways tenants share a system, silo, bridge and pool, and AWS maps them to PostgreSQL.
| Trait | Pool | Bridge | Silo |
|---|---|---|---|
| What each tenant gets | Rows in shared tables, one schema, a tenant key on every row | Its own schema or logical database in a shared instance | Its own PostgreSQL instance |
| Isolation | Row level security policies | Schema or database boundaries | Separate instances |
| Cost and operations | Lowest, nothing new to provision per tenant | Moderate, a schema or database to provision per tenant | Highest, an instance to provision and run per tenant |
| Noisy neighbors | Reduced with capacity and read replicas, never fully removed | Same exposure as pool | Eliminated |
| Fits (our reading) | Most first releases | Teams that prefer schemas to row policies | Strict security or regulatory demands, sometimes sold for an extra fee |
Put the tenant key on every table, file path, search index and audit log from day one, and route queries through one data access layer. A customer that later demands its own database then costs a data migration and a routing change.
Enforce Tenant Isolation in the Database
AWS has long warned that a user could be authenticated and authorized, and still access the resources of another tenant. Its PostgreSQL guidance says row level security is required for isolation in a pooled model, belongs on every table with tenant data, and relies on the application setting the tenant context at runtime.
ALTER TABLE invoices ENABLE ROW LEVEL SECURITY;
ALTER TABLE invoices FORCE ROW LEVEL SECURITY;
CREATE POLICY tenant_isolation_policy ON invoices
USING (tenant_id = current_setting('app.current_tenant')::UUID);
The policy follows the AWS example. The FORCE line, from the PostgreSQL documentation, stops table owners from skipping their own policies. Take the tenant from the signed session on the server, never from a value the browser sends. On Supabase, our row level security checklist covers keys and policies.
Where row level security quietly stops
- Superusers and roles with the BYPASSRLS attribute always skip policies. Never let the app connect as one.
- Postgres views run with the permissions of their creator by default, which means a view can return rows the underlying table policy would have blocked.
- Session variables may be incompatible with connection poolers such as PgBouncer. Setting the tenant with SET LOCAL inside each transaction keeps it from outliving that transaction.
SaaS Tech Stack and Architecture for a First Release
We default to a modular monolith for new products and move to microservices only when team size and scaling justify it, splitting incrementally along boundaries designed in from the start. PostgreSQL ranks first among databases in the Stack Overflow 2026 Developer Survey, used by 57.9 percent of respondents, and its row level security suits a pooled SaaS. If you are weighing a managed backend, compare Xano, Supabase or custom on tenant isolation and SSO plan limits.
SaaS Billing, Plans and Usage Metering
Billing in a SaaS is product code. Your plans decide which features each tenant can use, so the app must know every subscription state.
Model plans as entitlements
Store plans, limits and feature flags in your own database. The provider bills, and your server checks the tenant entitlement on every request.
Let the provider run checkout and webhooks
Hosted checkout keeps card data off your servers, and webhooks update your record on every signup, plan change, failed payment and cancellation.
Meter usage if you sell it
Record seats, API calls or AI credits as usage events per tenant and send them to billing.
Handle the edges
Decide proration for mid cycle upgrades, retries for failed cards and a clear path to cancel and export data.
On a tiered real estate SaaS for a US operator, every tier runs on one data foundation, because the platform had to deliver value at price points under $50 a month without thinning the higher tiers. For Meeveem, a healthtech jobs marketplace, we wired Free, Growth and Scale plans into the architecture so upgrades follow a path the code already handles.
Payment Processor or Merchant of Record
With Stripe Billing you are the seller, and you file sales tax and VAT where you owe it. Paddle describes a merchant of record as the legal entity that sells to the end customer and takes on sales tax, PCI compliance, refunds and chargebacks, with its name on the card statement.
| Setup, US domestic card at list price | Fees on a $100 charge | Fees on a $20 charge | Seller of record | Sales tax and VAT |
|---|---|---|---|---|
| Stripe Payments plus Billing, pay as you go | $3.90 | $1.02 | You | You register and file |
| Same, plus Stripe Tax Basic at 0.5% | $4.40 | $1.12 | You | Stripe works out the tax, you register and file |
| Stripe Managed Payments | $6.70, or $7.40 if the Billing fee also applies | $1.58, or $1.72 | Stripe | Stripe, in more than 75 countries |
| Paddle | $5.50 | $1.50 | Paddle | Paddle |
Our arithmetic from Stripe US pricing captured October 16, 2026 and Paddle pricing read October 17, 2026, before international cards, currency conversion, disputes and fraud tools.
The gap buys tax filing in many countries plus fraud and dispute handling. In our reading, a merchant of record suits a small team selling self serve plans worldwide, and Stripe Billing suits B2B sales on invoices. For usage based billing, such as AI credits, Stripe recommends Metronome for new integrations. Metronome is now part of Stripe, and its Startup plan lists $0.04 per 1,000 ingested events plus 0.8 percent of billing volume.
SOC 2 Readiness Starts During the Build
Start now, because a Type 2 auditor tests the system you ship. A SOC 2 examination is a report on controls relevant to security, availability, processing integrity, confidentiality or privacy, performed by a CPA firm under AICPA standards. ISO/IEC 27001 is a certification and SOC 2 is an audit report, while HIPAA and GDPR are laws you comply with rather than certificates a vendor can hold, as our guide to choosing a development partner explains. A Type 1 report covers the design of your controls, and a Type 2 report covers design and operating effectiveness over a period. Vanta, which sells compliance automation, says a growing number of buyers ask for Type 2 specifically.
$10K to $50K
Typical SOC 2 audit fee, before preparation costs
Vanta, read October 2026
1 to 5 months
Usual preparation time before the audit
Vanta, read October 2026
Scope the system and criteria
Name the product, infrastructure, people and vendors in scope. Vanta notes that Security is the one required criterion of the five.
Run a gap assessment
Compare current practice with the criteria and write policies you will follow.
Run controls inside the product
Tenant isolation tests, audit logs for admin and data access, MFA and least privilege for production access, reviewed pull requests through CI, encrypted backups with restore tests, and a subprocessor list.
Get a Type 1 report if a deal needs one sooner
A CPA firm reports on control design at one point in time. Vanta warns that buyers who ask for a Type 2 will not accept a Type 1 alone.
Get a Type 2 report, then renew
The firm tests how controls operated across the window. Vanta notes that audits happen every year, so the cost recurs.
On those vendor figures, a first Type 2 report lands at least 4 months after you start and can take more than a year. In February 2026 the AICPA Journal of Accountancy warned that tool vendors may promise compliance in mere weeks, though compliance is a term never used in SOC 2 examinations. Because most of these providers are not CPA firms, they cannot attest that controls are effective.
SOC 2 and Unico Connect
Unico Connect is a services company, so the SOC 2 report belongs to your company. We have built SOC 2 ready products for many clients, with the access controls, logging and encryption that auditors test. We operate an ISO/IEC 27001:2022 certified information security management system. A licensed CPA firm audits your controls and issues your report.
Privacy Law Reaches a US SaaS Too
Under Article 3(2), the GDPR applies to a company outside the EU that offers services to people in the EU. As a B2B processor you sign a data processing agreement with each customer under Article 28 and need authorization before adding subprocessors. The CCPA applies to for profit businesses that do business in California, decide why and how personal information is processed and meet any of its thresholds, according to the California Privacy Protection Agency. One threshold is gross annual revenue of $26.625 million or more in the preceding calendar year.
Adding AI Features Without Mixing Tenant Data
An AI feature is another way to read tenant data, so it needs the same filter as every query. Retrieval searches only the documents of the current tenant, vector indexes carry the tenant key, and prompts, outputs and logs are stored under that tenant. Keep customer data off free tiers, because Google marks free tier Gemini API data as used to improve its products and paid tier data as not. On the tiered real estate SaaS, we designed the AI analyst into the architecture from the start, and it answers from live platform data instead of a stale snapshot.
In beta, build an evaluation set of 50 to 200 real cases from your own traffic, with correct answers written down. The OWASP GenAI LLM Top 10 for 2026, published on 3 August 2026, states that prompt injection is intrinsic to current generative AI, and no reliable prevention mechanism exists today. So give each AI feature the fewest actions it needs, and put anything that sends, deletes or charges behind a server side check.
To size token cost per user, take 1,000 active users making 20 requests a month at 3,000 input and 500 output tokens each.
| Model tier | Price per million tokens, input and output | Monthly cost | Per active user |
|---|---|---|---|
| Claude Haiku 5.5 or GPT-6 Luna | $0.10 and $0.50 | $11 | About 1 cent |
| Gemini 3.8 Flash | $0.75 and $3.75, doubling January 1, 2027 | $82.50, then $165 | About 8 cents, then 17 cents |
| Claude Sonnet 5.5 or GPT-6.1 Sol | $2 and $10 | $220 | 22 cents |
| Claude Fable 5.1 or GPT-6 Astra | $10 and $50 | $1,100 | $1.10 |
List prices from Anthropic, OpenAI and Google read October 17, 2026, at short context rates, for equal token counts, before caching and batch discounts.
Team, Timeline and Budget to Build a SaaS Product
An MVP takes 2 to 3 months, on web or mobile. The SaaS development process below runs in four phases, and how long each takes depends on the product.
Discovery and architecture
A product lead, a solutions architect and a designer agree on the core workflow, tenancy model, plans and compliance targets.
Foundation
Engineers set up environments, CI, the identity layer, the tenant key and audit events before feature work.
Core build
The paid workflow, billing integration and an internal admin console ship in short sprints, with QA testing each one.
Hardening and beta
Isolation tests across two tenants, a restore from backup, load checks and onboarding of a few design partners.
| Tier | Timeline | Scope |
|---|---|---|
| Web app MVP | 2 to 3 months | Core workflows, auth, dashboard, one user role |
| Mid sized platform | 3 to 6 months | Multi role SaaS, integrations, reporting, payments |
| Enterprise system | 8 to 18 months | Legacy integration, compliance, high availability, large data |
The MVP tier above assumes one user role, so keep release one to a single customer role plus your own internal admin console. Several roles, integrations and reporting make it a mid sized platform. A SaaS MVP with core workflows, auth, and billing typically costs $15,000 to $50,000 at our published ranges, with multi role platforms at $50,000 to $150,000.
A Launch Checklist for a B2B SaaS
Run these checks before the first paying tenant goes live.
- Two test tenants prove that neither can read the other through the app, the API or AI features
- Row level security is on for every tenant table, and the app never connects as a superuser, a BYPASSRLS role or the table owner
- Webhooks for every subscription change update entitlements
- Audit events record sign in, admin actions, exports and permission changes
- Production access needs MFA, and every change ships through a reviewed pull request
- Backups are encrypted and one restore has been tested
- A data processing agreement and a subprocessor list are ready for the first customer
- Customers can export their data and close their account
Metrics to Track From Launch Day
Stripe defines monthly recurring revenue (MRR) as the monthly normalized value of active and past due subscriptions, excluding taxes, free plans and metered products, so track usage revenue separately. David Skok wrote in 2013 that the best SaaS businesses have a ratio of customer lifetime value to acquisition cost (LTV to CAC) above 3 and that many of them recover that cost in 5 to 7 months, which he called only guidelines.
How Unico Connect Builds SaaS Products
Unico Connect builds SaaS products for US founders and product teams, from tiered plans and Stripe payments to AI features that answer from live product data. Our web app development team built the tiered real estate platform above, now in production with paying subscribers.
Frequently Asked Questions
What is the difference between single tenant and multi tenant SaaS?
In a multi tenant SaaS, customer organizations share one running system and are kept apart by a tenant key and access rules. Single tenant means each customer gets dedicated resources, such as its own database.
Do you need SOC 2 before your first enterprise customer?
Not always. SOC 2 is not a law. It is a report buyers request in contracts and security reviews, so the need depends on who you sell to. Build the logging and access controls now, and start the observation window before a deal depends on the report.
How long does a first SOC 2 report take?
A first Type 2 report takes at least 4 months on vendor figures and can take more than a year. Vanta puts preparation at 1 to 5 months, and Vanta and Secureframe put the usual observation window at 3 to 12 months. A Type 1 report can follow preparation alone.
Should a SaaS use Stripe Billing or a merchant of record such as Paddle?
In our reading, use Stripe Billing when you sell mostly to businesses on invoices and can manage a few tax registrations. Stripe Payments plus Billing takes $3.90 on a $100 US domestic card charge at list prices. Use a merchant of record for self serve plans sold worldwide. Paddle takes $5.50 on the same charge and handles tax, fraud and disputes.
Does a US SaaS company have to follow GDPR?
Yes, if it offers services to people in the EU. Article 3(2) covers companies outside the EU that do so, and Article 27 requires them to name a representative in the EU unless their processing is occasional, excludes large scale processing of special category or criminal data, and is unlikely to result in a risk. Fines for breaching those duties can reach 10 million euros or 2 percent of worldwide annual turnover, whichever is higher.
How do you stop AI features from mixing data between customers?
Treat the AI feature as another query path. Filter retrieval and vector search by tenant, build prompts only from that tenant data, store outputs and logs under the tenant, and test with one tenant asking about records of another.
