SaaS Architect
Cloud-native B2B SaaS architect using BMAD v6.2. Evaluates feasibility, designs multi-tenant systems, and orchestrates structured development workflows.
Expert cloud-native B2B SaaS architect integrated with BMAD v6.2 methodology. Evaluates product feasibility, designs multi-tenant systems with row-level security, chooses the right tech stack, and orchestrates structured BMAD development workflows from brief to deployment. Produces architecture diagrams, ADRs, ERDs, and BMAD handoff briefs that developers can act on immediately.
$skillfish add ~skills/saas-architect What This Skill Can Do
Concrete capabilities you get when you install this skill.
Design multi-tenant architectures (shared schema + RLS, schema-per-tenant, database-per-tenant)
Run BMAD v6.2 structured workflows: Analyst → PM → Architect → Developer → QA
Evaluate SaaS feasibility: market, technical, and compliance dimensions
Generate Architecture Decision Records (ADRs) with context, decision, and consequences
Recommend SaaS-optimized tech stacks (Next.js, Supabase, Stripe, Resend, Inngest)
Design compliance-ready architectures: SOC 2, GDPR, HIPAA decision trees
Real Conversations
See how the SaaS Architect skill responds to actual requests. These are representative examples of what your AI agent will produce.
I want to build a SaaS that helps HR teams track employee training compliance for ISO 13485. Target: medical device companies. MVP in 3 months with a 2-person team. We need multi-tenancy, audit logs, and certificate uploads.
SaaS Architect — Compliance Tracker MVP
Feasibility Assessment
| Dimension | Score | Notes |
|---|---|---|
| Technical complexity | 3/5 | Multi-tenancy + file storage + audit logs — achievable in 3 months |
| Market clarity | 4/5 | Clear ICP (ISO 13485 medical device HR), measurable pain |
| Compliance scope | SOC 2 Year 1 | ISO 13485 customers will ask for it |
MVP scope is tight but achievable. Lock it to: tenant onboarding, user management, training assignment, completion tracking, certificate upload, compliance dashboard. No custom reporting until v2.
Architecture Overview
graph TD
A[Next.js 14 Frontend] --> B[Next.js API Routes]
B --> C[(Supabase Postgres + RLS)]
B --> D[Supabase Auth]
B --> E[Supabase Storage — Certificates]
B --> F[Stripe Billing]
B --> G[Resend — Notifications]
C --> H[audit_log — append-only]
Tenancy: Shared schema + Postgres RLS. Each company row is a tenant.
Core Data Model
tenants (id, slug, name, plan, stripe_customer_id)
tenant_users (tenant_id, user_id, role: owner|admin|member)
training_items (id, tenant_id, title, description, required_by)
assignments (id, tenant_id, user_id, training_id, due_date, status)
completions (id, tenant_id, assignment_id, completed_at, certificate_url)
audit_log (id, tenant_id, user_id, action, entity_type, entity_id, payload, created_at)
Architecture Decision Records
ADR-001 — Multi-tenancy: Shared schema + Postgres RLS
- Simpler ops for a 2-person team; Supabase makes RLS config straightforward
- Migration path to schema-per-tenant available if an enterprise customer requires strict isolation
ADR-002 — Audit log: Append-only table, no UPDATE/DELETE policies
- ISO 13485 auditors need tamper-proof activity history
- On GDPR erasure: anonymize PII fields in-place — never hard-delete log rows
ADR-003 — Certificate storage: Supabase Storage, private bucket + signed URLs
- Built-in tenant isolation, no separate S3 setup to manage
- ⚠️ If HIPAA scope added: migrate to AWS S3 with BAA — Supabase is not HIPAA-eligible
Tech Stack
| Layer | Choice | Why |
|---|---|---|
| Frontend + API | Next.js 14 (App Router) | Full-stack, great DX, deploys to Vercel |
| Database + Auth + Storage | Supabase | RLS built-in — saves ~3 weeks vs raw Postgres |
| Billing | Stripe | Per-seat subscriptions, usage metering ready |
| Resend | Deadline reminders, completion confirmations | |
| Deployment | Vercel + Supabase cloud | Zero ops for 2-person team |
Compliance Notes
- SOC 2: Audit log + RBAC + Vanta gives you a clean evidence trail for Year 1 audit
- GDPR: Host Supabase in EU region (
eu-west-1); implement soft-delete anonymization - HIPAA: Out of scope — Supabase is not HIPAA-eligible. Disclose to customers upfront.
BMAD Handoff Brief
Phase: Architect → Developer
Product: ISO 13485 Training Compliance Tracker
Stack: Next.js 14 + Supabase + Stripe + Vercel
Tenancy: Shared schema + Postgres RLS
Auth: Supabase Auth (magic link + email/password)
Key constraint: Append-only audit_log — ISO 13485 compliance
MVP epics: Tenant onboarding · User management · Training CRUD
Assignment tracking · Certificate upload · Compliance dashboard
Ready to generate the Supabase schema SQL and Next.js project scaffold?
Get Started
How to install and use this skill in your preferred environment.
Skills are designed for AI coding agents (Claude Code, Cursor, Windsurf) and IDE-based workflows where the agent can read files, run scripts, and act on your codebase.
Models & Context
Which AI models and context windows work best with this skill.
Recommended Models
Works best with Claude Opus/Sonnet 4 or GPT-4o — this skill requires sustained multi-step reasoning across architecture, compliance, and product strategy. Smaller models handle individual questions but struggle with the full BMAD orchestration flow.
Context Window
This skill's SKILL.md is typically 3–10 KB — fits in any modern context window.
All current frontier models support 100K+ context.
Pro tips for best results
Be specific
Include numbers — users, budget, RPS — so the skill can size the architecture.
Share constraints
Compliance needs, team size, and existing stack all improve the output.
Iterate
Start with a high-level design, then ask follow-ups for IaC, cost analysis, or security review.
Combine skills
Pair with companion skills below for end-to-end coverage.
Works Great With
These skills complement SaaS Architect for end-to-end coverage. Install them together for better results.
Ready to try SaaS Architect?
Install the skill and start getting expert-level guidance in your workflow — any agent, any IDE.
$skillfish add ~skills/saas-architect