Shipping a multi-tenant SaaS in 9 weeks with Claude Code: 3 decisions I'd make again, and 1 I wouldn't
John C. Thomas
Founder, BlueWave Projects
BlueWave Projects went from an empty repo to a multi-tenant SaaS running a real $139,165 Honolulu renovation in 9 weeks. Solo. One backend, one Next.js frontend, one iOS app, ~600K lines of code, 580 commits, around 15 billion Claude tokens through Claude Code.
I'm going to skip the cheerleading and just describe the four architecture decisions that mattered — three I'd make again, and one I'm already paying for.
1. Would do again: tenant_id on every row, scoped at every router
The cliché advice for multi-tenancy is "schema-per-tenant for isolation, shared schema for cost." I went the other way: single schema, tenant_id as the first column on every business table, scoping enforced in a FastAPI dependency that every router uses.
Fifteen-plus tables: leads, projects, scans, blueprints, invoices, subs, time_entries, daily_logs, selections, change_orders, documents, property_brief_subscribers, aloha_subscribers, tenant_users, tenant_invites. Each one starts with tenant_id uuid not null. The dependency injects a verified tenant_id into every endpoint and every query goes through a thin builder that requires it.
Why I'd do it again:
2. Would do again: marketing on Cloudflare Pages, product on a single $5 Vultr box
Two completely different deployment surfaces:
Marketing (bluewaveprojects.com) — Next.js 16 with output: "export", served from Cloudflare Pages. Static HTML at the edge, free traffic, zero ops.
Product (portal.ikenagroup.com + ai.portofcams.com) — FastAPI + Postgres + Docker on a single $5/mo Vultr instance, fronted by Nginx Proxy Manager. Eight containers including the API, db, e-sign, n8n, uptime monitor, and a metrics server. SSL is auto-renewed via Cloudflare proxy.
Total monthly infra bill for 12+ live products and a multi-tenant SaaS: less than $50 including domains.
Why I'd do it again: every additional dollar spent on infra before paying customers is dead weight. Edge-static for marketing buys you global perf for free. One box for the product means one place to look when something breaks.
3. Would do again: deterministic plumbing, AI in the loop only where humans wait
The AI scope generator gets all the press, but most of the code in BlueWave Projects is boring deterministic plumbing. Invoices are computed, not generated. Change orders are math, not prose. Time clock-out is a transaction, not an LLM call.
The AI only shows up where a human is waiting for *creative* work: a scope of work, a draft daily log narrative, a property brief summary. Everywhere else, traditional code wins on cost, latency, and correctness.
Specific places I use Claude in production:
Everything else is pydantic models and SQL.
4. Would reconsider: app-level tenant filtering instead of database row-level security
This is the one I'd change. I enforce tenant isolation in the application layer (a FastAPI dependency + a query builder). A more defensive design would push isolation down to the database via Postgres' Row-Level Security policies, where every SELECT is forced to include tenant_id = current_setting('app.tenant_id') whether the application asks for it or not.
What I have works because every router goes through the dependency. What I should have is a system where a future me writes a sloppy router and the database refuses to leak. RLS is the seatbelt; I'm currently driving without one because I'm the only driver.
It's on the migration list. Not urgent, but it's the architectural decision I'm least proud of.
What 9 weeks actually looked like
A boring chronology:
Tenant 1 (Ikena) is currently running a live design-build practice on top of it. The system has moved $1M+ of construction work since launch. Every feature I ship goes through a real job site before it ships to other tenants.
That's the whole story. Solo, agent-augmented, regulated industry, deterministic plumbing with AI in the loop where it earns its cost. The next 9 weeks are about cohort N and that RLS migration I owe future-me.
More from BlueWave
RoomPlan vs Matterport vs Polycam: which one belongs in your contractor's toolkit?
8 min
Hawaii complianceHawaii GET tax for contractors: how the §237-13(3)(B) sub-deduction actually works
6 min
WorkflowHow to scope a renovation in 60 seconds (and why your hand-written estimate keeps losing jobs)
5 min