Pricing
One price. Everything included.
Sold as source code — $149 once during the founder launch (regularly $249). No subscription, no per-seat fees, no runtime license checks.
B2B SaaS OS
One-time payment$149$249once
Founder price — $149 for the first 50 buyers
Full source code, yours forever. One license, unlimited projects for you and your clients.
Instant download via Gumroad · one-time payment · no refunds once the download is accessed · installation support included
- Full source code
- Multi-tenancy
- PostgreSQL RLS
- Authentication
- Organizations
- RBAC
- Team invitations
- Stripe billing
- API keys
- Audit logs
- Usage limits
- Documentation
- Updates
What's in the ZIP
- SQL migrations with RLS policies inline
- 32
- SQL migrations with RLS policies inline
- executable hardening suites
- 9
- executable hardening suites
- app pages
- 27
- app pages
- API routes
- 4
- API routes
Plus the complete Next.js application, team invitations, audit logging, usage metering, Stripe checkout and portal, and the README / HARDENING / LICENSE documentation. Download is instant via Gumroad.
What's included, in detail
- Full source code
- Every file of the source — strict TypeScript, commented where it matters.
- Multi-tenancy
- Organizations as the root of the data model, from migration zero.
- PostgreSQL RLS
- Deny-by-default policies per table, shipped as SQL migrations.
- Authentication
- Email & password, Google and GitHub OAuth, password reset flows.
- Organizations
- Create, switch, rename and delete organizations with clean state.
- RBAC
- Owner / Admin / Member, enforced in PostgreSQL policies and mirrored in the app's permission map.
- Team invitations
- Tokened invite links with expiry, email match, role pre-selection and enforced plan member limits.
- Stripe billing
- Checkout, customer portal, webhooks, monthly and yearly plans with enforced limits.
- API keys
- Hashed at rest (SHA-256), shown exactly once, revocable, with optional expiry.
- Audit logs
- Append-only trail of every sensitive action per organization.
- Usage limits
- API requests metered per organization and enforced with HTTP 429 at the plan limit.
- Adversarial hardening suite
- Nine executable test files that attack tenant isolation, RBAC, SECURITY DEFINER boundaries, webhook reliability and billing enforcement — against a dedicated test database, never production.
- Documentation
- Setup, environment, customization, deployment, testing and troubleshooting — plus README.md and HARDENING.md in the ZIP.
- Updates
- Included while the product is actively maintained — pull improvements into your copy. No guaranteed release schedule.
The terms, in plain language
License
Perpetual, worldwide, non-exclusive, non-transferable commercial license. Unlimited projects for you and your clients. You own what you build; the underlying boilerplate stays Andrady's.
Full license terms →Support
Installation help is included: if you can't get the product running, email support gets you unblocked. Personalized support, custom development and consulting on your application are not part of the purchase.
License details →Updates
Included at no additional charge while the product is actively maintained — bug fixes, security patches and improvements. There is no guaranteed update schedule or roadmap.
License details →Refunds
Because this is source code, the purchase is final once the download has been accessed — no refunds. Stated here up front so it's a condition of buying, not a surprise after.
Refund policy →You can
- Modify the code and make it yours
- Build and run commercial SaaS products
- Use it for unlimited client projects
- Deploy applications built on it, anywhere
You can't
- Reselling or redistributing the boilerplate
- Publishing the source or the repository
- Sublicensing to non-licensees
- Custom development or consulting on your app
How it compares
Facts from each vendor's public pricing and documentation pages, checked November 2026 — sources linked below the table. The free official starter was verified from its public repository. We only state what each vendor publishes about its own product — verify current details before deciding.
| B2B SaaS OS | Free official starter | Supastack | Premium kits (MakerKit, supastarter) | |
|---|---|---|---|---|
| Price | $149 one-time (founder; regularly $249) | Free (MIT) | $149 Single Stack launch price (regularly $249); Dual Stack $298, Full Bundle $299 | MakerKit Supabase Pro $299 lifetime (regularly $349); supastarter Solo $349, Agency $1,499 |
| Tenant model | Organizations with PostgreSQL RLS from migration zero | Flat teams, app-level Owner/Member roles | Personal workspaces that grow into organizations (PostgreSQL via Drizzle ORM) | Organizations/teams; Supabase-native RLS in MakerKit's Supabase edition |
| Security testing | 9 executable hardening suites included, run against a dedicated test database | Not documented in its public README | Site advertises 5,200+ automated tests | MakerKit documents pgTAP RLS tests in its docs; supastarter ships Playwright E2E configured |
| Stripe webhook reliability | Idempotency ledger, ordering guard and retry reclaim — documented and tested | Basic webhook status sync | Signed webhooks advertised | Signature verification documented; duplicate/order handling varies |
| Feature breadth | Focused: tenancy, billing, API keys, usage, audit logs | Starter surface | Broad: mobile and desktop targets, AI integrations, notifications, file storage | Broad: i18n, admin panels, plugins and team features |
Sources, checked November 2026: supastack.dev, makerkit.dev/pricing, supastarter.dev, github.com/nextjs/saas-starter.
The honest summary: the bigger kits do more things. B2B SaaS OS does the multi-tenant foundation with its boundaries tested — at a lower price, in less surface area to understand.