SaaS development company: multi-tenancy, billing and compliance in 2026

Summary. Three decisions set the cost and the ceiling of a SaaS product, and all three are made in the first month. Tenant isolation model: AWS names three, silo, pool and bridge, and warns that a cross-tenant leak "would represent a significant and potentially unrecoverable event for a SaaS business" (AWS SaaS Lens). Billing rail: Stripe Billing lists at 0.7% of billing volume, Chargebee's Flow plan at 0.80%, and Paddle at 5% plus 50 cents per transaction as merchant of record, all retrieved 16 August 2026. Compliance clock: India's DPDP Rules were notified on 13 November 2025, with the substantive obligations effective 13 May 2027 and consent manager registration from 13 November 2026 (MeitY gazette). This page covers how we make those calls, what we build, and how the engagement runs.

The isolation decision, and what it costs to get wrong

Every multi-tenant product sits somewhere on a spectrum between one shared database and one deployment per customer. Microsoft's Azure Patterns and Practices team puts it exactly that way in its tenancy models guidance: "Instead of viewing isolation as a discrete property, consider it a spectrum."

AWS names the three positions in its SaaS Lens and is candid that most real systems are mixed: "The regulatory profile of a service's data and its noisy neighbor attributes might steer a microservice to a silo model. Meanwhile the agility, access patterns, and cost profile of another microservice could tip it toward a pool model."

Two lines from Microsoft's Azure SQL SaaS design patterns settle the argument that founders most often get stuck in. On the standalone per-tenant model: "elastic pools can't be used for databases deployed in different resource groups or to different subscriptions. This limitation makes this standalone single-tenant app model the most expensive solution from an overall database cost perspective." And on the alternative: "having many single-tenant databases in a pool is as cost efficient as having many tenants in a few multitenant databases."

That second sentence is the useful one. Database per tenant inside a pool gives you per-tenant backup, restore and residency without the cost profile of true silo. It is the default we reach for when a product sells to mid-market and enterprise at the same time. The Azure guidance also states the arithmetic that kills naive single-tenant plans: "If a single tenant requires a specific infrastructure cost, 100 tenants probably require 100 times that cost."

Pooling has its own bill. Azure's Hyperscale elastic pools carry a $0.05 per vCore-hour shared resource management charge that reserved-capacity discounts do not apply to. Small, easy to miss in a model, and it compounds.

Row-level security is not a security boundary on its own

Teams reach for PostgreSQL row-level security as the pool-model isolation mechanism. It works, but the official documentation lists the ways it does not, and a buyer should hold a vendor to all of them.

Superusers and roles with BYPASSRLS always bypass row security. Table owners bypass it too unless the table is set to ALTER TABLE ... FORCE ROW LEVEL SECURITY. Whole-table operations including TRUNCATE and REFERENCES are not subject to row security at all. And referential integrity checks always bypass it, which the documentation flags directly: care is needed "to avoid 'covert channel' leaks of information through such referential integrity checks". A unique constraint on an email column across a shared table will tell tenant A that tenant B has a given user, without ever returning a row.

The practical rule we apply: row-level security is the last line, not the only line. Tenant scoping belongs in the connection context, in the query layer and in the policy, and the application should fail closed when the tenant context is absent.

Noisy neighbours are managed, not eliminated

Azure's noisy neighbor antipattern is refreshingly blunt: "Sharing a single resource inherently carries the risk of noisy neighbor problems that you can't completely avoid." The mitigations it names are the ones we build in from the start: per-tenant rate limiting and throttling, sharding, the Deployment Stamps pattern, quality-of-service tiers and reserved capacity for the tenants who pay for it.

What billing actually costs in 2026

Billing is where SaaS founders discover that a 2% assumption was a 5% reality. List prices below come from the vendors' own pricing pages, retrieved 16 August 2026.

The rate is only half the decision. The other half is who is legally the seller. Stripe describes its merchant-of-record product as handling "global sales tax, VAT, GST, and post-sale compliance in more than 80 countries and for 35 product categories", and explicitly contrasts it with Stripe Tax, where "you remain the merchant of record" (Stripe Managed Payments). Paddle sells the same transfer of liability at 5% plus 50 cents. Timothée Lacroix, Chief Technology Officer of Mistral AI, makes the build-versus-buy case for the billing layer specifically on Lago's pricing page: "Lago has been able to follow the pace of our releases and has allowed us to focus on what we do best."

The arithmetic is straightforward. Below roughly $2 million in annual billing volume, a merchant of record usually costs less than the tax registrations, filings and finance headcount it replaces. Above it, the percentage starts to dominate and direct plus a tax engine wins. Model both against your own volume rather than taking either vendor's framing.

One Indian rule that breaks annual plans

The Reserve Bank of India raised the additional-factor-of-authentication exemption for recurring card transactions from ₹5,000 to ₹15,000 per transaction in circular RBI/2022-23/73, dated 16 June 2022. Any Indian card subscription charging more than ₹15,000 in a single debit needs authentication on every renewal, which means silent auto-renewal stops working. If your annual plan is priced above that line, either the plan becomes monthly for Indian customers or the renewal becomes an interactive flow. This is a pricing decision disguised as an engineering one, and it should be made before the pricing page is designed. Our RBI e-mandate engineering checklist covers the current framework.

Compliance: what buyers will actually ask for

SOC 2. The current standard is the 2017 Trust Services Criteria with revised points of focus issued in 2022, set by the AICPA's Assurance Services Executive Committee, covering "the security, availability, processing integrity, confidentiality, or privacy of information and systems" (AICPA). Architecture decisions that make an audit cheap are the boring ones: centralised authentication, immutable audit logs, infrastructure as code, and a tenant-scoped access model you can evidence.

ISO/IEC 27001:2022 was published on 25 October 2022 and the 2013 edition is withdrawn (ISO). The transition deadline of 31 October 2025 comes from IAF MD 26 Issue 2, not from ISO, and certificates against the 2013 edition expired at that point. eCorpIT holds ISO 27001:2022 certification, along with CMMI Level 5 and MSME.

India's DPDP Rules are the date that matters for a product being built in 2026. Gazette notification G.S.R. 846(E) of 13 November 2025 phases the Rules in three steps: Rules 1, 2 and 17 to 21 on publication, Rule 4 covering consent manager registration one year later on 13 November 2026, and Rules 3 and 5 to 16 plus 22 and 23 eighteen months later on 13 May 2027. That last tranche is the substantive one: notice, consent, security safeguards, breach reporting, significant data fiduciary duties and data principal rights.

Three requirements from those Rules are architecture, not policy. Breach reporting requires a detailed report to the Data Protection Board within seventy-two hours, which means incident detection has to be instrumented rather than discovered. Security safeguards include one year of log retention, which is a storage line item. And notice must be presented and understandable independently of any other information, in clear and plain language, with withdrawal comparable in ease to giving consent, which is a product surface someone has to design. Cross-border transfer remains permitted subject to Central Government conditions, so this is not a localisation ban; the hard localisation hook applies to Significant Data Fiduciaries only. We build applications aligned with DPDP Act requirements and treat the 13 May 2027 date as the design deadline. Our DPDP compliance cost guide for Indian startups has the cost side.

Selling into the EU from India. India is not on the European Commission's adequacy list, which as of 23 July 2026 runs to seventeen entries including Brazil, added in January 2026. Transfers therefore run on Standard Contractual Clauses under Commission Implementing Decision (EU) 2021/914 of 4 June 2021. Worth knowing before you sign: the Commission's own page states it is still developing additional clauses for transfers to processors outside the EU whose processing is already directly subject to the GDPR, which is precisely the position of an Indian vendor serving EU users.

EU AI Act, if you embed a model. The AI Omnibus entered into force on 27 July 2026, moving Annex III high-risk obligations to 2 December 2027 and Annex I obligations to 2 August 2028 (European Commission). Most B2B SaaS features are not high-risk, but the classification is worth doing on paper before a customer asks.

If your product embeds AI, price the tokens before you price the plan

Published list prices per million tokens, retrieved 16 August 2026 from each vendor's own pricing page.

Two footnotes decide whether that table is true next year. Gemini 3.7 Flash is on introductory pricing: Google's page states "$0.75 through December 31, 2026. $1.50 starting January 1, 2027", with output moving to $7.50 on the same date. A 2026 gross-margin model built on Flash is off by a factor of two from January.

The second is the long-context cliff. OpenAI reprices prompts above 272,000 input tokens at 2x input and 1.5x output for the full request, not just the excess. Google reprices its Pro tiers above 200,000. Anthropic's page states there is no such cliff: a 900k-token request bills at the same per-token rate as a 9k-token request. For a retrieval-heavy B2B product with large documents, that is an architectural input, not a marketing point.

What we build

Product architecture and the tenancy decision, documented as an architecture decision record with the isolation model, the data residency plan and the migration path if a tenant later needs to move up the spectrum.

Application and API layer, typically TypeScript or Python services with a tenant context enforced at the boundary, and a frontend in React or Next.js. Our custom software development company page covers the wider engineering practice.

Data layer on PostgreSQL, with row-level security plus query-layer scoping, per-tenant migration tooling, and a backup and restore path tested per tenant rather than per cluster. Managed Postgres choices are compared on our Neon versus Supabase for serverless Postgres backends page. One number worth flagging when picking a platform: Supabase gates SOC 2 and ISO 27001 coverage, SSO and audit logs behind its $599 a month Team plan, so the compliance features arrive with a price attached rather than a checkbox.

Billing and entitlements, wired so that the plan definition in the billing provider and the feature gate in the application come from one source of truth. Entitlement drift between those two is the most common revenue bug we are called in to fix.

Identity, with SSO through SAML or OIDC, SCIM provisioning, and role-based access mapped to tenant scope. Enterprise deals stall on SCIM more often than on features.

Observability and audit, with per-tenant metrics so a noisy neighbour is visible before a customer reports it, and immutable audit logs sized for the one-year retention the DPDP Rules require.

How we run the build

1. Architecture and commercial discovery, two to three weeks. Tenancy model, billing rail and merchant-of-record decision, compliance map against DPDP, SOC 2 and any EU exposure, and a costed infrastructure model. Output is written and reviewable.

2. Platform core, six to ten weeks. Tenant context, identity, data layer with isolation enforced and tested, and the deployment pipeline. We write the cross-tenant access tests here, not later.

3. Product surface, eight to sixteen weeks. The features that make the product sellable, built on a core that already handles tenancy correctly.

4. Billing, entitlements and admin, four to six weeks. Plans, metering if usage-based, dunning, and the internal console your support team will actually live in.

5. Hardening and evidence, three to four weeks. Load testing under multi-tenant contention, penetration testing, audit log completeness, and the control evidence a SOC 2 auditor will ask for.

Why eCorpIT

eCorp Information Technologies Private Limited has built software from Gurugram since 2021. We hold CMMI Level 5, ISO 27001:2022 and MSME certification, and we are partners of AWS, Microsoft, Google and Shopify. Teams are senior-led and multi-disciplinary, so the engineer who designs the tenant isolation model is the one who writes the tests that prove it holds.

We do not publish a rate card, because SaaS build cost turns on tenancy model, compliance scope and whether identity and billing are greenfield or an integration. Engagements usually run as a fixed-scope discovery followed by a dedicated squad on a monthly retainer against the plan agreed in step one. We will give you a band in writing against your scope.

Related pages: software development company in India and custom software development company.

FAQ

What is the difference between silo, pool and bridge multi-tenancy?

Silo gives each tenant its own stack, pool shares infrastructure across tenants with logical separation, and bridge mixes the two across different services. AWS describes bridge as acknowledging that SaaS businesses are not always exclusively one or the other, with regulatory profile and noisy neighbour behaviour pushing individual services either way.

Is PostgreSQL row-level security enough to isolate tenants?

Not on its own. The PostgreSQL documentation states that superusers and roles with BYPASSRLS always bypass it, table owners bypass it unless FORCE ROW LEVEL SECURITY is set, and whole-table operations such as TRUNCATE and REFERENCES are not subject to it. Referential integrity checks also bypass policies, creating covert channel leaks.

What does SaaS billing cost in 2026?

Stripe Billing lists at 0.7% of billing volume and Chargebee's Flow plan at 0.80% with no platform fee, both on your own merchant account. Paddle charges 5% plus 50 cents per transaction as merchant of record, which includes global tax registration and filing. Razorpay lists 2% plus GST in India.

When do India's DPDP obligations actually take effect?

The DPDP Rules were notified on 13 November 2025 in three phases. Rules 1, 2 and 17 to 21 applied immediately, Rule 4 on consent manager registration applies from 13 November 2026, and the substantive tranche covering notice, consent, security safeguards and breach reporting applies from 13 May 2027.

Can an Indian SaaS company sell to EU customers?

Yes, using Standard Contractual Clauses under Commission Implementing Decision 2021/914 of 4 June 2021. India is not on the European Commission's adequacy list, which as of 23 July 2026 covers seventeen entries. The Commission is still developing additional clauses for processors outside the EU already directly subject to the GDPR.

Should I choose database per tenant or a shared schema?

Microsoft's Azure SQL guidance states that many single-tenant databases in an elastic pool are as cost efficient as many tenants in a few multitenant databases. Database per tenant inside a pool therefore buys per-tenant restore and residency at close to pooled cost, which suits products selling to mid-market and enterprise simultaneously.

Why does my Indian annual plan fail to auto-renew?

The Reserve Bank of India set the exemption from additional-factor authentication for recurring card transactions at ₹15,000 per transaction in its circular of 16 June 2022. Any single debit above that figure requires authentication on every renewal, so an annual plan priced above ₹15,000 cannot silently auto-renew for Indian cardholders.

How long does a SaaS platform take to build?

The five phases above typically run twenty-three to thirty-nine weeks in total, with the product surface overlapping the platform core. Architecture discovery takes two to three weeks, the platform core six to ten, the product surface eight to sixteen, billing four to six, and hardening three to four weeks.

How eCorpIT can help

We build B2B SaaS platforms from the tenancy decision through to the evidence pack an enterprise buyer's security team asks for. Discovery produces a written architecture decision record, a costed infrastructure model, and a compliance map against the DPDP Rules timeline, SOC 2 and any EU exposure, so you know what the product owes before the first sprint. Delivery runs to CMMI Level 5 process with senior-led teams from Gurugram, and we are ISO 27001:2022 certified. Send us your tenancy expectations, pricing model and target customer profile at /contact-us/ and we will come back with a scoped plan and a price band.

References

1. AWS Well-Architected SaaS Lens, tenant isolation.
2. AWS Well-Architected SaaS Lens, silo, pool and bridge models.
3. Microsoft Azure Architecture Center, tenancy models, updated 27 June 2025.
4. Microsoft Azure, noisy neighbor antipattern, updated 2 July 2025.
5. Microsoft, Azure SQL Database SaaS tenancy app design patterns.
6. PostgreSQL documentation, row security policies.
7. Stripe Billing pricing.
8. Stripe Billing pricing, India.
9. Stripe Managed Payments.
10. Chargebee pricing.
11. Paddle pricing.
12. Razorpay pricing.
13. Lago pricing.
14. Reserve Bank of India, circular RBI/2022-23/73 on processing e-mandates, 16 June 2022.
15. AICPA, 2017 Trust Services Criteria with revised points of focus 2022.
16. ISO/IEC 27001:2022, published 25 October 2022.
17. IAF MD 26 Issue 2, transition requirements for ISO/IEC 27001:2022, 15 February 2023.
18. MeitY, Digital Personal Data Protection Rules, gazette G.S.R. 846(E), 13 November 2025.
19. European Commission, adequacy decisions.
20. European Commission, standard contractual clauses.
21. European Commission, AI Omnibus enters into force, 27 July 2026.
22. Anthropic, Claude API pricing.
23. OpenAI, API pricing.
24. Google, Gemini API pricing.
25. Neon pricing.
26. Supabase pricing.

Last updated: 16 August 2026.