What makes SaaS different from a web app
A SaaS product is a web application that many independent customers use at once, each paying for it and each expecting their data to be private. That adds a layer of engineering an internal tool never needs: tenant isolation, subscription billing, plan limits, self-serve onboarding, and the operational tooling to support hundreds of customers without a person in the loop for each one.
Architecture
We build SaaS on a React and TypeScript front end, a Node.js API and PostgreSQL, with a WebSocket layer where the product needs live updates. Tenancy is modelled explicitly — in CR Cafe an account owns a subscription and one or more cafes, and entitlements resolve across every venue the account owns.
Authentication and access control
- Short-lived access tokens and refresh tokens delivered as HttpOnly cookies
- Passwords hashed with bcrypt; login and sensitive endpoints rate-limited
- Roles for platform staff, customer admins and employees, with granular permission keys
- Every API route and every real-time handler checks permissions on the server
- A permission can only be granted by someone who holds it — so role management can’t become a back door to admin
Subscriptions, plans and billing
Billing is where SaaS products most often go wrong, usually by treating a payment failure as a reason to lock the customer out. We design billing so a problem downgrades an account rather than locking it, keep a grace period for failed renewals, and snapshot what a customer paid for so later price changes can never retroactively take it away. Payment webhooks are signature-verified and idempotent, so a retried webhook never double-applies.
Dashboards, analytics and reporting
Customers judge a SaaS product by its dashboard. We build reporting that reconciles rather than estimates — revenue by payment method, by location and by day, with CSV export — plus a full audit log of who did what, filterable by user, action and resource.
Deployment, monitoring and scaling
Every push to the main branch builds, migrates and deploys automatically, and each release announces itself to the team. Schema changes go through versioned migrations that run on boot, so no environment drifts. We scale the boring way — sound indexes, stateless API processes and a database that is the single source of truth — before reaching for anything exotic.
Built on our own experience
CR Cafe is a SaaS product we designed, built and operate. Everything on this page is something we have had to get right for paying customers. Read the CR Cafe case study for the detail.