Multi-Tenant SaaS Platform for Har***** Property, AustraliaCase Study

The original application worked well for one agency and quietly assumed everywhere that only one agency existed. Converting it into SaaS was an architectural rebuild rather than a configuration exercise, something the client had initially underestimated. Tenant isolation was the overriding requirement: any leakage of renter details, lease documents or trust-account-adjacent records between agencies could end a young product.

Residential tenancy law in Australia varies by state, with different notice periods, bond handling and entry rules, so hardcoding one jurisdiction would block national growth. Trust accounting obligations demanded caution, and the platform needed a clear position that it records and reconciles without becoming the trust account system of record.

Operationally, document volume was large, with condition reports carrying extensive photo sets. Commercially, the letters of intent from launch agencies were tied to a delivery window, so the rebuild had to be both rigorous and on time. The client needed a partner able to balance architectural rigour with a fixed commercial deadline, without cutting corners on the isolation that agencies would later scrutinise.

PapaSiddhi rebuilt the product as multi-tenant SaaS on Next.js, Node.js and PostgreSQL, enforcing tenant isolation with row-level security at the database layer rather than application-level filters that fail open when a clause is forgotten. Every query path was reviewed, and an automated test suite attempts cross-tenant access against each endpoint on every deploy. State-specific tenancy rules live in configuration, turning a new state into a data task rather than a code change.

Lease documents and condition report photos are stored in AWS S3 under per-tenant prefixes and served only through signed, time-limited URLs. Stripe Billing manages subscriptions with per-agency plans and seat counts, and an email service handles transactional messages. Financial records reconcile against each agency's trust account behind a deliberate system boundary, a position we advised on directly given the regulatory exposure, and personal data handling was built with the Australian Privacy Act in mind.

Our dedicated team also built self-service agency onboarding so growth would not depend on engineers, plus tenant-level backup and export so an agency can leave with its own data — a question both launch customers raised during due diligence. Both capabilities were treated as core product features rather than afterthoughts, because a SaaS vendor seeking agencies' portfolios needs credible answers on scalability and exit before contracts are signed.