Karta · Multi-tenant base

The foundation for multi-tenant apps.

Next.js + Hono + Neon + Drizzle + Better Auth. Each tenant gets its own subdomain or custom domain, with separate staff and customer logins, isolated by Postgres row-level security.

Create a workspace Sign in

No credit card required · Free to start

Next.jsHonoNeonDrizzleBetter Auth

Why Karta

Everything a multi-tenant SaaS needs, out of the box.

A production-shaped starting point, not a toy scaffold.

Multi-tenant by default

Every signup provisions its own workspace, subdomain, and membership roles.

Isolated at the database

Forced Postgres row-level security keeps every tenant's data apart — not just app-level filters.

Custom domains

Tenants can verify their own domain and serve the same app under their own brand.

Built to extend

Typed contracts, RBAC, and a shared UI kit make new tenant-scoped modules fast to add.

Why not roll your own

A production-shaped starting point, not a toy scaffold.

Without a foundation

Rolling your own tenant isolation and hoping app-level filters never leak a row

Wiring auth, roles, and custom domains from scratch on every new project

Client and server drifting out of sync with no shared contract

With Karta

Forced Postgres row-level security enforces isolation at the database, not just app code

Auth, roles, and custom domains ship pre-wired via Better Auth + Hono

Shared Zod contracts keep the API and UI in lockstep

Roles

Designed around real tenant roles.

Three system roles, enforced server-side — plus custom roles a tenant can compose from the same permissions.

Owner

Every permission, including billing and transferring or deleting the tenant.

Admin

Everything except billing and tenant-level actions like delete or transfer.

Staff

Scoped to the essentials — create projects, no admin surface.

Onboarding

Get started in three steps.

Create a workspace

Invite your team

Assign owner, admin, or staff roles — or compose a custom role from the same permissions.

Build your first module

Copy the project pattern to ship a new tenant-scoped table, route, and page.

FAQ

Common questions.

How is tenant data isolated?

Every tenant table has forced row-level security in Postgres, scoped by tenant_id. Isolation is enforced at the database — not just by an app-level WHERE clause.

Can each tenant use a custom domain?

Yes. A verified custom domain resolves to the same tenant as its subdomain, with no separate deployment.

What handles authentication?

Better Auth, with separate staff and customer logins per tenant, and session-based role resolution on every request.

Is this a hosted product?

No — it's a starting codebase, not a hosted product. You own it, deploy it, and operate it yourself wherever you run Postgres and Node.

How do roles and permissions work?

Three system roles (staff, admin, owner) plus tenant-defined custom roles, all built from the same permission vocabulary and enforced server-side.

Ready to spin up your workspace?

Create a tenant in seconds — you'll get your own subdomain, owner account, and dashboard immediately.

Create a workspace