Nürnberg, Germany
I build the parts of SaaS that users never see.
Who is allowed to read which record. What happens to a session after a reload, or a breach. What breaks when ten people log in at the same moment. My main project is PropertyOS, a multi-tenant rental platform I built on my own, from the access model to the deploy pipeline.
Before this I spent seven years in German finance and property back offices: invoicing, payment monitoring and dunning for a network of 60 estate agencies, then daily till reconciliation, currency dealing and money transfer at one of the country’s largest pawn-credit firms. I build these systems having been the person who had to balance them.
What I build
Everything below is work I’ve shipped, not a list of things I’m willing to try. Where there’s a write-up of the decisions behind it, it’s linked.
Multi-Tenant SaaS Architecture
Designing who exists in a system and what they can reach: separate actor domains, isolation enforced at the query layer, and boundaries that hold when a request comes from the wrong tenant.
See how →Authentication & Session Security
TOTP multi-factor auth, hashed rotating refresh tokens, httpOnly cookies, CSRF protection, and Redis-backed sessions that can be revoked server-side instead of waiting to expire.
See how →Access Control & Audit Design
Permission models, role boundaries, and support tooling like impersonation — built so that acting on someone else's behalf is fully attributable rather than a line in a log file.
See how →Production Hardening
The pass that happens after the tests pass: real response headers, connection pools that actually release, rate limiting, and load testing that finds what unit tests structurally can't.
See how →