Features
Everything below is implemented, tested and switchable. Turn a module off and its routes, its tables and its interface go with it.
Authentication that has met production
Password and OAuth sign-in, email verification, session revocation, recovery codes and step-up authentication for the actions that deserve it.
Organizations and roles
Multi-organization membership, invitations, per-organization permissions, and tenant isolation enforced in the query layer rather than remembered by each endpoint.
Billing that survives a webhook storm
Stripe checkout, the customer portal, plan limits, trials and a dunning sequence — all idempotent, because the same event will arrive twice.
File storage
S3-compatible uploads with presigned URLs, scanned and size-limited, wired to the same permission model as everything else.
Six locales, one source of truth
The product, the emails and this marketing site read the same translation files, so a term cannot mean one thing in the app and another on the pricing page.
Operations you do not have to invent
Structured logging, Prometheus metrics, audit trails, backup and key-rotation runbooks, load tests and an accessibility gate in the pipeline.