SaaS infrastructure · 2 min read
Multi-tenant SaaS on Google Cloud: lessons from building Shipyard
Tenancy, billing and provisioning are the parts of SaaS everyone rebuilds and few enjoy. What we learned turning them into a platform.
By [Founder name] · NeoMonarch
Every SaaS product eventually needs the same unglamorous machinery: create a tenant, give it isolated data and configuration, bill it correctly, route its traffic, and remove it cleanly when it leaves. Shipyard is our platform for that machinery on Google Cloud. These are the lessons that shaped it.
1. Decide your isolation model early
Shared tables with a tenant column, a schema per tenant, or a database per tenant — each trades cost against isolation and operational effort. Changing later is painful. Shipyard supports more than one model so a product can start lean and move high-value tenants to stronger isolation without a rewrite.
2. Never trust the tenant from the request
The tenant must come from verified identity, not a header a client can set. It sounds obvious; it is one of the most common multi-tenant vulnerabilities we find in reviews. Resolve tenancy once, at the edge, and carry it through every call as trusted context.
3. Provisioning is a saga, not a script
Creating a tenant touches identity, databases, storage, DNS, billing and email. Any step can fail. We model provisioning as a saga — each step with a compensating action — so a half-created tenant is rolled back or completed, never left stranded.
4. Billing deserves its own test bench
Usage-based and marketplace billing have more edge cases than almost anything else in SaaS: proration, refunds, failed payments, currency, payouts to partners. Shipyard uses Stripe Connect and ships with a billing simulator so these scenarios run in tests rather than surfacing on an invoice.
5. Land the cloud foundation first
Networking, IAM, logging and secrets management are much easier to get right on day one than to retrofit. A standard landing zone — the same one we reuse across projects — gives every new environment the same secure baseline.
6. Build the operator console you'll need at 2 a.m.
Suspending a tenant, replaying a failed step or checking a customer's plan should be one screen, not a database session. Operator tooling is part of the product.
Shipyard is in early access. If you are about to build this layer for your own product, we'd rather you didn't have to.