B2B Multi-tenant SaaS Starter Kit (containerised edition)

Engineering & Development

A containerised edition of an enterprise-grade B2B SaaS foundation: multi-tenant teams, member invitations and role permissions, connection points for SSO (SAML) and Directory Sync (SCIM), audit logs, webhooks and API keys; Next.js + Prisma + PostgreSQL, started with docker compose by following QUICKSTART.

Subscribe & download See how to start

SubscriptionUS$49 per month

Last run2026-11-02

In practice

Readiness4 / 5

What you need

Few changes needed4 / 5

Who it is for

Developers and small teams building SaaS that is sold to companies: our containerisation removes the first mile of installing Node and PostgreSQL and setting environment variables by hand.

How to start

$ ./scripts/quickstart/init-env.sh
$ docker compose up -d --build

Browse the files

Files in the product repository at the pinned commit. A few house files are left out of the zip.

File overview337 paths

▸__tests__1

lib/

▸components97

account/
apiKey/
auth/
billing/
defaultLanding/
emailTemplates/
invitation/
layouts/
shared/
styles.ts
…

▸docker1

entrypoint.sh

▸hooks12

useAPIKeys.ts
useCanAccess.ts
useCustomSignout.ts
useInvitation.ts
useInvitations.ts
usePermissions.ts
useTeam.ts
useTeamMembers.ts
useTeams.ts
useTheme.ts
…

▸lib46

accountLock.ts
app.ts
auth.ts
common.ts
email/
env.ts
errors.ts
fetcher.ts
guards/
inferSSRProps.ts
…

▸locales1

en/

▸models12

account.ts
apiKey.ts
invitation.ts
passwordReset.ts
price.ts
service.ts
session.ts
subscription.ts
team.ts
teamMember.ts
…

▸pages75

404.tsx
500.tsx
_app.tsx
_document.tsx
api/
auth/
dashboard.tsx
index.tsx
invitations/
settings/
…

▸prisma14

migrations/
schema.prisma
seed.ts

▸public6

home-hero.svg
logo.png
logowhite.png
saas-starter-kit-poster.png
user-default-profile.jpeg
vercel.svg

▸scripts1

quickstart/

▸styles2

globals.css
sdk-override.module.css

▸tests22

e2e/

▸types4

base.ts
index.ts
next-auth.d.ts
next.ts

▫ATTRIBUTION.md

▫CODE_OF_CONDUCT.md

▫CONTRIBUTING.md

▫Dockerfile

▫LICENSE

▫LICENSE-99LL.md

▫PRODUCT.md

▫Procfile

▫QUICKSTART.md

▫README.md

▫SECURITY.md

▫app.json

▫check-locale.js

▫delete-team.js

▫delivery-manifest.txt

▫docker-compose.upstream-dev.yml

▫docker-compose.yml

▫eslint.config.cjs

▫find-dupe-locale.js

▫i18next.d.ts

▫instrumentation.ts

▫jest.config.js

▫jest.setup.js

▫middleware.ts

▫next-env.d.ts

▫next-i18next.config.js

▫next.config.js

▫package-lock.json

▫package.json

▫playwright.config.ts

▫postcss.config.js

▫sentry.client.config.ts

▫sync-stripe.js

▫tailwind.config.js

▫tsconfig.json

▫Config and hidden files 8

Latest passing run

Clone → Checkout → Toolchain → Container up

Pre-purchase Disclosure

What you are buying

A frozen delivery of a B2B multi-tenant SaaS application: one container for the Next.js application and one for PostgreSQL, started with docker compose; once it is up you can register an account and create a team.

A derivative of boxyhq/saas-starter-kit, which is Apache-2.0 licensed; the containerisation, the self-generated keys and the Traditional Chinese documentation are ours.

Delivery is a frozen snapshot: one zip file, taken from the product repository at revision 3dc1995.

Known limitations

Only one HTTP port, 4002, is published; the domain, reverse proxy and TLS for going live are the buyer’s own
The database credentials are the public default values written into the compose file (saas / saas)
Mail, social login, SSO, SCIM, webhooks, auditing, telemetry and payments are optional integrations, each needing external service credentials you bring yourself, and each disabled until it is configured
The database contents live in a Docker volume, and docker compose down -v deletes them along with it
The first build fetches from the network, from sources including Docker Hub, the Debian package repositories and the npm registry
QUICKSTART states that this configuration is for development and evaluation, with the application running on a single node under next start
The pages load third-party resources in the browser: the site icon and logo from boxyhq.com, and the default avatars from api.dicebear.com
Pinned to the delivered snapshot; it does not follow upstream.

The liability cap, the scope of what is promised and the statutory floor are governed by the Terms of Service.

Vetting record

Everything below was checked against the pinned commit abc9b68. Every verdict carries its full reasoning, an evidence link and the checker; failures are published, not hidden — do not take our word for it, verify it yourself.

5 PASS0 WARN0 FAIL

Source ReviewPASS

A targeted scan of the execution surface of the delivered tree (vetted in 2026; lib/ and pages/api/ are all TS, with node_modules and the tests excluded): 0 occurrences of child_process, exec( or eval(. There are also third-party resources hot-linked on the browser side, which are listed in the known limitations of the disclosure. Not all of the source code was read line by line (this is a full Next.js application), and the scope and method of the scan are recorded here as they stand.

Script SafetyPASS

The scripts in package.json were read one by one: there is no postinstall side door. ⚠️ Among them build = "prisma generate && prisma db push && next build" connects to the database at build time and applies the schema — that is upstream's assumption about a developer working locally, not malice; our Dockerfile deliberately does not call that script (it uses npx prisma generate && npx next build instead) and moves applying the schema into docker/entrypoint.sh. The scripts we added (init-env.sh and entrypoint.sh, 21 lines) were reviewed line by line by ourselves: openssl generates the keys written into .env (chmod 600), and prisma db push runs in a retry loop, with no outbound connection.

RecencyPASS

Checked with gh api when this was vetted in 2026: upstream was not archived, and the pinned commit abc9b68 was the main HEAD on the day of that check. A note (it does not affect the determination, but is recorded as it stands): the pace of tagged releases had slowed, with the main changes rolling through main, which is reflected in the durability assessment.

LicensePASS

SPDX:LicenseRef-99LL-Product

Upstream's LICENSE was checked word for word (the evidence link points at the file itself at the pinned commit, not at GitHub's licence field): the standard full text of the Apache License 2.0 (opening with "Apache License / Version 2.0, January 2004" and ending with the standard appendix) — permitting commercial use, modification, derivative works, redistribution and sale, with the obligations being to keep the full licence text and the copyright notice, to mark modifications (clause 4), and to ship the NOTICE if there is one; upstream's repository has no NOTICE file (actually checked), so that additional obligation does not arise. For the product as a whole, the 99LL product licence template is attached: upstream's LICENSE is kept as it stands, and LICENSE-99LL.md is placed alongside it (at the root of the delivered tree, tag v0.1.0-99ll.1) as the sale and liability terms for the parts we added, with spdx recorded as LicenseRef-99LL-Product.

Dependency LicensesPASS

The delivered zip tree vendors no third-party package (node_modules is not in the tree). The buyer fetches the direct dependencies from the npm registry at build time, under their own respective licences, and they are not distributed with the zip. ⚠️ We did not verify the licence text of those packages package by package (recorded as it stands); the database image used at run time, postgres:16.4, is an official image (PostgreSQL License) and likewise is not distributed with the zip. The files we added have zero third-party dependencies.