VulCode

Web Platforms

VulCode builds web platforms for startups and companies: marketplaces, edtech and fintech platforms, and subscription SaaS tools. One system serves many organisations with separated data, bills subscriptions and offers a REST API for partners. We can start with an MVP.

from PLN 7,999

The figure for your scope comes in a free quote.

Members and roles of one organisation on the platform
Invitation acceptedFirma 21: a new person with the Member role
An invitation to an organisation on a phone

What is a multi-tenant web platform?

A multi-tenant platform is not a tool for one company, but a product serving many independent accounts at once, each with its own separated data.

A marketplace, an EdTech or FinTech platform needs to isolate data across hundreds or thousands of accounts, bill subscriptions automatically, and expose an API to partners from day one. Multi-tenant architecture is the foundation you grow on without rewriting the system at account number 1,000.

Multi-tenant architecture

Many accounts and organizations on one system, with data isolated from each other.

Subscriptions and billing

Automatic recurring billing without manually issuing invoices.

A documented REST API

Ready to integrate with partners and external systems from day one.

Who is a web platform for?

It works where the product serves many independent accounts, not one company.

Marketplace

You connect two sides of a transaction - sellers and buyers - on one platform.

Education platform (EdTech)

Courses, schedules and student progress split across institution and student accounts.

A SaaS tool with subscriptions

Paid access billed automatically, with a separate account and data for every customer.

A startup scaling from an MVP

Architecture that survives the jump from your first 100 accounts to 100,000 without a rewrite.

A product with a partner API

External companies integrate with your platform through a documented API.

A service booking platform

Businesses list their slots, customers book and pay, and the platform takes its commission.

What's included?

Platform foundation

The platform serves many organizations at once, bills them by plan and scales without interrupting service for active accounts.

6 items
  • Accounts and SSO sign-inSign-up with email confirmation, password reset and company account sign-in via OAuth2 are ready from the first version.
  • Multi-tenant architectureEach organization's data is isolated from the others, even though they all run on a single codebase.
  • Plans and usage limitsYou define plans, limits and the features available at each tier, and the system itself blocks anything a plan doesn't include.
  • New account onboardingAfter signing up, the customer goes through a guided process that ends with their first real use of the platform.
  • API with OpenAPI docsCustomers integrate the platform with their own systems from day one, because every endpoint is documented in Swagger.
  • Browser-based appThe interface runs in the browser on desktop and tablet, and a mobile app can be added in a later phase.

Payments & billing

Billing is the riskiest part of a platform, so we set up the gateway, invoices and failed payment handling before launch.

6 items
  • Stripe, Przelewy24 or PayUCards, BLIK, bank transfers and digital wallets go through a single gateway chosen for the market you sell in.
  • Auto-renewing subscriptionsThe system charges on the renewal date, handles failed payments and reminds customers about expiring cards.
  • PDF invoices in the customer panelEvery transaction generates a legally compliant invoice that customers download themselves from their panel.
  • Discount codes and promotionsYou create campaigns, affiliate codes and discounts for chosen user groups in the panel, without code changes.
  • Credits and pay-as-you-goInstead of a fixed subscription, customers top up their account and pay in proportion to the resources or features they use.
  • Marketplace commissionsWhen users sell to each other, the platform charges your commission on every transaction at the agreed rates.

Scalability

We design the architecture so that ten times more users means changing infrastructure, not rewriting the application.

4 items
  • Modular monolith or microservicesA modular monolith is faster to build and easier to evolve early on, while microservices give you room under heavy traffic.
  • Background job queuesRabbitMQ, Bull or SQS process emails, reports and exports, so users don't sit waiting for them in front of the screen.
  • Horizontal scalingThe application keeps no session state on the server, so it runs on many instances at once and grows by adding machines.
  • Redis cache and CDNRedis handles frequent queries and sessions while a CDN serves images, JS and CSS, taking load off the database and server.

Operations panel

Your team gets its own panel for handling accounts, tickets and metrics, with no manual database queries.

4 items
  • Users and organizationsYou view accounts, change plans, grant access manually and block users who break the terms of service.
  • Helpdesk with customer historyNext to each ticket, support sees the customer's plan, recent activity and previous tickets in a single view.
  • MRR, churn, retention and ARPUSubscription metrics are calculated continuously from platform data, so you don't assemble them by hand in a spreadsheet.
  • Feature flagsYou switch a new feature on for selected accounts first, collect their feedback and only then roll it out to everyone.

Bonuses on larger projects

With a wider scope or several specialists at once, we can include these items in the project price.

4 items
  • UI/UX design includedTogether with the Aphrodi agency we prepare UX research, wireframes and finished Figma screens that go straight into implementation within the same project.
  • Cloud infrastructure includedWe configure VPC, CI/CD, databases, monitoring and auto-scaling on AWS or GCP before launch, with no separate DevOps hire.
  • Go-to-market strategyWe help prepare the platform's messaging before launch, together with the landing page that is meant to sell it.
  • Launch supportWe refine onboarding and prepare the first user acquisition campaigns for the day the platform goes live.

How we build the platform

Architecture comes before the first screen, because a mistake here costs the most later.

First contact and a quote

You describe who meets whom on the platform and where your revenue comes from. We send back a price and a plan of stages.

  • The sides of the market and their needs
  • Revenue and settlement model
  • Scope of the first stage

Onboarding and rules

We write down the rules: who sees what, who pays whom, what happens in a dispute. That is the foundation of all the logic.

  • Access rules for each side
  • How money and commission flow
  • Disputes and edge cases

Data model and scaling

We design the structure for the traffic you are aiming at, not for month one. Changing the foundation later is the most expensive move.

  • Structure for the target volume
  • Queues and background jobs
  • A plan for database growth

Prototyping the key paths

Mockups of the most important flows for each side of the platform, approved before any code.

  • A path for each side
  • The operator admin panel
  • Empty states and first run

Building in stages

We ship the platform in stages so a first version can run before everything exists. Every stage is usable.

  • A usable first stage
  • Payments and settlements
  • Operator panel and moderation

Load tests and a buffer

We check how the platform holds above the expected traffic and where it breaks first. A buffer for your notes is in the deadline.

  • Behaviour above expected traffic
  • Data isolation between sides
  • In-scope fixes

Launch and handover

We go to production, connect monitoring and hand over the operator panel with training.

  • Production launch
  • Monitoring and alerts
  • Training for the operator team

Long-term support

We stay on for further stages, new market sides and changes to the settlement model.

  • The next stages from the plan
  • New integrations and payment methods
  • Monitoring and technical care

Behind the curtain

Before you see the finished platform, a lot of invisible work happens first.

Scale planned from day one

We design for 100,000 accounts even if you launch with a hundred, because the costliest architectural mistakes are the ones that only surface as you grow. We make database and infrastructure decisions for scale you do not have yet, so success never forces a rewrite from scratch.

Multi-tenant architecture

We design data isolation between accounts from the very first database table, because bolting it on later almost always leaves gaps. Each customer sees only their own data even when they share the same infrastructure - the foundation of trust no one buys a SaaS platform without.

API documented from the start

Swagger/OpenAPI is written alongside every endpoint, not as a tedious chore tacked on at the end of the project. That gives your clients and integrators documentation that actually matches the code, and lets a new developer understand the platform without a week of guessing.

Tested under load

We check how the system behaves under real traffic, not just when one person clicks through it on a developer laptop. We simulate thousands of concurrent users so bottlenecks surface in testing, not on the day the platform actually matters.

The result: you stand out

All of this work happens in the background so you can grow without rewriting the system at the worst possible moment. When a spike or a big client arrives, the platform simply copes, and you focus on growing the business instead of firefighting.

Selected work

Platforms from a panel for hosting companies to an encrypted messenger and email, and a medtech platform built for a startup.

Flaem

A platform for hosting companies: a service panel, a store and a billing system, installed on the operator's own servers.

Plazer

An encrypted messenger for communities. Private messages encrypted with MLS (RFC 9420), a Rust core running in the browser and a community server you host yourself.

VulMail

Email on your own domain or an @vulmail.pl address, with no ads in the inbox. MX, SPF, DKIM and DMARC records set themselves up, the spam filter learns from the user's decisions, and the antivirus and quarantine hold back suspicious attachments.

SafeBands

The operational core of a medtech platform for a startup building smart rescue wristbands.

Cairn

A self-hosted panel where knowledge about a project outlives the agents that work on it.

Pharos

Uptime monitoring, a public status page and incident handling in a single binary (Go + embedded SQLite), started with one command.

Three ways to get the same project

The same project can be bought three ways. Below, the same eight things checked against each of them.

A template from an AI builder
a builder subscription

Cheapest and fastest, until the page actually has to sell.

  • A fixed monthly fee.
  • The page is up the same day.
  • The same set of blocks as a thousand other companies.
  • Generic copy, written for nobody in particular.
  • Heavy builder code slows things down and pushes the Google ranking with it.
  • Only whatever the builder happens to offer.
  • A help chat and a knowledge base.
  • The first serious change means starting over.
VulCode
from PLN 7,999

We price the actual scope and hold that number to the end.

  • Quoted before we start and unchanged to the end.
  • A launch date comes with the quote.
  • Design and code written for this one page.
  • You write straight to the person who runs your project.
  • We write for your audience and the questions it asks.
  • Loads in about a second, on a phone too.
  • Included, with no separate line on the invoice.
  • We stay on for fixes and further sections.
A full-process agency
a big budget upfront

A big team and a big budget, much of which pays for the process itself.

  • A design made from scratch.
  • A copywriter on the agency side.
  • Optimization usually fits inside the scope.
  • In scope, often as a separate item.
  • Continued work on a retainer.
  • Every scope change means an annex and a new number.
  • A schedule counted in months.
  • Contact goes through an account manager, not the team.

Tell us what your page has to do. A quote with a number and a date comes back within an hour.

Why choose VulCode?

Five things you see from the first message to the work after launch.

A quote with the scope of work and payment stages

Frequently asked questions

Common questions about this service and working together.

Want to discuss your project?

Every project is quoted individually - regardless of scale, technology or stage. Contact us and we will reply within an hour. The quote is free.