Multi-Tenant SaaS on GCP
One codebase, unlimited tenants — Cloud Run, JWT, and wildcard domains
The problem
Teams rebuilding separate deployments per client burn ops budget. You need tenant isolation, fast provisioning, and one release pipeline — without sacrificing security or custom domains.
Our approach
- JWT + hostname-based tenant context across all product surfaces
- Platform-admin API to create tenants, default users, and product links in one call
- Cloud Build CI/CD with environment-specific build args per app
- Global HTTPS load balancer with host-based routing to Cloud Run services
- Secret Manager for JWT, payment keys, and third-party tokens
Deliverables
- Multi-app suite (marketing, dashboard, inbox, CRM, API)
- Tenant provisioning and admin console
- Production GCP infrastructure with managed SSL
- Documentation for onboarding new tenants
FAQ
Which GCP services do you typically use?
Cloud Run for web and API services, Cloud Build for CI/CD, Artifact Registry for images, Secret Manager for credentials, Cloud SQL or SQLite with backup buckets depending on scale, and a global HTTPS load balancer for custom domains.
How is tenant data isolated?
Every API request carries a tenant-scoped JWT. Database queries filter by tenant ID, and platform-admin routes are role-separated from tenant user routes.
Can you add new product modules later?
Yes. Our suite pattern uses a shared API with product flags per tenant — inbox, CRM, and clinic modules can be enabled independently at provision time.
Related case studies
Technical insights
Discuss multi-tenant saas on gcp
Tell us about your integrations, tenant model, or field constraints.
Get in touch