Ship a tenant's API layer in two changes, not two quarters.

The Neat SaaS Kernel is the running platform: annex an existing RDBMS, pick modular options in the setup wizard, and 70–90% of the SP-driven and ORM-driven API layer is generated — with tenant-isolation proofs, auditable RBAC, and a typed SDK. This is the Developer Edition for internal evaluation and VAPT before the production cut.

Open the Setup Wizard → API Docs (OpenAPI) Download SDK / schema

Annex the RDBMS

T-SQL stored procedures via tsqlcraft, or a DB-agnostic ORM, or both. Register one connection — no view rewrites.

Wizard, not code

Choose auth lanes, plugins, cache/broker engines and features. The wizard shows per-choice usability guidance and emits a reviewable provisioning plan.

Generated API + SDK

generate_domain scaffolds views, serializers, repository and adversarial tests from SP contracts; OpenAPI → a typed TypeScript SDK.

Isolation you can prove

Cross-tenant IDOR proofs, explicit-deny RBAC, per-lane payload crypto, and an admin gate that stays HTTP-only on localhost.

Evaluate it like a tenant

Sign in with a Developer licenseThe wizard connects only with a valid dev license over the Cloudflare Tunnel (WireGuard-equivalent isolation) — no open ports.
Mimic your industryFintech, healthcare, hospitality, edtech, gov — pick the vertical's modules in the wizard and drive real SP/ORM endpoints.
Run VAPT & file feedbackThe edge is Cloudflare-fronted (WAF/DDoS); the origin has no public IP. Pentest the API and admin gate; feedback loops back before the production cut.

●

Security posture (for the pentest): TLS terminated at Cloudflare and again at the origin nginx edge; admin endpoints are IsAdminLocalOnly (localhost + HTTP only) and are 404 at the Tunnel; the origin has no inbound ports. Report scope and rules of engagement are in deploy/cloudflare/DEPLOY_VAPT_RUNBOOK.md.