Matt Turley, Continuum. Updated November 5, 2026.
For founders building a multi-user, multi-company SaaS product with AI tools who are about to onboard their first paying business customers.
Tenant isolation. A B2B app holds many companies' data in one system, and AI-generated code often checks only that a user is logged in, not that the record belongs to their company. Test it as a user from company A against company B's ids, then check roles, invitations and billing.
Consumer apps mostly need to separate one person from another. A B2B app must separate whole organisations, each with several users in different roles, and the boundary is crossed by every query. Forget it once, on one endpoint, and one customer can read another's data.
AI tools handle the first version well: a user, some records, a dashboard. The multi-tenant parts (organisations, memberships, invitations, role checks, per-seat billing) get bolted on later, usually in the interface, and the server and database quietly keep trusting any logged-in user.
Business buyers also test what they are buying. Their first questions are about exactly this: how is our data separated from other customers', who in our company can see what, and can we get our data out.
How to tell Sign in as a user of company A, then request a record id that belongs to company B directly through the API or URL. If it returns, isolation is missing. The same applies to files, exports and search.
The fix Put the organisation id on every tenant table and enforce it in the database (row level security) or in a single server-side data layer that every query goes through. Never trust an id supplied by the browser.
How to tell A member cannot see the Delete button, but can still call the delete endpoint. Admin-only pages are hidden by navigation, not protected.
The fix Check the caller's role for the specific action on the server for every write and every sensitive read, and keep the role list small and written down.
How to tell An invite link works for any email, never expires or can be reused. Anyone with a matching email domain joins the organisation automatically without approval.
The fix Tie each invitation to an email, expire it, make it single use and require approval for domain-based joining. Re-check membership on every request.
How to tell Seat counts, plan limits and cancelled subscriptions are tracked in one place while access is granted in another. A customer cancels and keeps access, or pays and does not receive it.
The fix Drive plan and seat state from the payment provider's webhook events, store the state in your database and check it on the server. Our page on webhooks that do not fire lists the usual faults.
How to tell You cannot answer "who changed this and when?", and a customer asks to export or delete their organisation's data. There is no way to do it other than manual database work.
The fix Record who did what to sensitive records, and build export and deletion for an organisation before a customer asks. Both come up in business sales.
How to tell The first larger customer asks for single sign-on, a security questionnaire and a data processing agreement. Each is a project.
The fix Decide which you will support, price it and sequence it. Prepare honest security answers early; our first security questionnaire page shows how.
If your product is single-tenant per customer (each customer has their own deployment or database), much of this does not apply. If you have no customers yet and a simple role model, work through the cross-tenant test yourself first. It takes an afternoon and finds the worst problem.
A Ship Check includes a security and data read of exactly this: who can reach what. If your backend is Supabase, the Supabase security review focuses on row level security policies, keys and storage with corrected SQL.
Ship Check, $299: A senior engineer reads your codebase and sends a written verdict (fine, fixable or rewrite), what will break first, a security and data read, and a costed plan, within 48 hours of repo access or it is free. It has a 7-day money-back and is credited against a Ship Fix. Or: Get the Supabase security review.