Members, tenants, operators — on one platform
Auth, permissions, and audit as integral platform parts — not bolt-on add-ons. We build platforms where tenant isolation, compliance, and support workflows work from day one.
Leading companies worldwide trust WZ-IT
Permissions look simple — until you have to run them in production
The first 80 percent of any member or tenant platform are built in two weeks. The last 20 percent — impersonation for support, audit-grade logs, soft delete without data loss, safe permission inheritance, MFA onboarding without lockouts — eat three months if not planned from the start.
We bring architecture patterns from production platforms. You skip the tuition phase and start with a model that survives audit number five.
What auditors want to see
- Who changed what when (audit trail with actor and timestamp)
- Data residency and backup location
- Right-to-forget workflow without audit gaps
- Tenant isolation deep in the data model, not just in the application
- Encryption strategy for stored secrets
Six building blocks for robust member and tenant platforms
Robust auth stack
Login, single sign-on against your existing identity provider, OIDC or SAML integration — vendor-independent, self-hosted on request. Accounts can be deactivated without losing audit history.
Multi-level permissions
Global roles, tenant level, project or site level, optionally down to individual devices or records. Inheritance and exceptions cleanly modeled — and anchored deep in the data model, not just in the UI.
Audit trail with impersonation
Every write action is logged — who changed what when, from where. When an admin acts on behalf of an end customer (support case), the admin identity stays in the log — accountability is preserved.
Misuse protection
Multi-tier throttling against brute-force attacks, detection of unusual login patterns, generic error messages without data leakage. Optional multi-factor layer for sensitive areas.
Encrypted secrets
API keys, stored credentials, and sensitive configurations are encrypted at rest. Per-install key, key rotation without downtime — even when compliance requirements demand it.
Deep tenant isolation
Tenant isolation is enforced at the database level — not just in the application. So separation holds even when an endpoint forgets a check. Defense-in-depth instead of blind trust in the frontend.
Who benefits
B2B SaaS with sub-tenants
A SaaS product distributed by reseller partners to their end customers. Reseller admin sees all their own end customers, end customers see only themselves, platform operator sees everything and can intervene — all in one code base.
Member management & associations
Associations, federations, cooperatives — with roles (board, member, guest), membership fee workflows, elections, and resolutions. Including GDPR-compliant data handling and right to forget.
Internal operator consoles
Tools for your staff to manage customers, tickets, devices, or licenses. Single sign-on against your existing IdP, audit trail per action, export for compliance reports.
Feature flagging & tenancy configs
Per-tenant features, limits, UI branding. Self-service configuration by the tenant admin, centrally controlled by the platform operator. Feature toggles as first-class citizens.
Auth stacks alone are rarely enough
Member and tenant platforms usually live in the context of other platform jobs. We combine them seamlessly with remote site management, custom dashboards, or classical business apps.
Depends on the goal. For fast time-to-market and SaaS: Supabase. For enterprise compliance with SAML/OIDC and existing IdP landscape: Keycloak. For modern lightweight self-hosting: Authentik. We decide jointly in the workshop and advise vendor-neutrally.
Yes. We encapsulate auth behind a service layer in the API, so a switch from Supabase to Keycloak (or the other way around) is possible without losing permissions or audit data. It is an architectural effort, not a data-loss risk.
MVP with auth, tenant model, audit, and one permission level: €40,000–€80,000. Full platform with multi-level permissions, impersonation, MFA, self-service tenant config: €100,000–€250,000. Fixed price after architecture workshop.
MVP: 6–10 weeks. Full build: 4–8 months. We ship in iterative releases — usually something usable is in production by week 4.
Not necessarily. We host in European data centers (Hetzner, IONOS, OVHcloud, STACKIT) — GDPR compliant, with dedicated VPC on request. Alternatively the platform runs on your Proxmox infrastructure or in a hyperscaler of your choice.
Default: all data in the EU, backups in the EU, no transfer to third countries. On request we document this in a data protection concept document you can attach to processor agreements.
Industry-leading companies rely on us
What do our customers say?
Let's Talk About Your Idea
Whether a specific IT challenge or just an idea – we look forward to the exchange. In a brief conversation, we'll evaluate together if and how your project fits with WZ-IT.
Leading companies trust WZ-IT
Timo Wevelsiep & Robin Zins
Managing Directors of WZ-IT