SYS/SAAS
A product, not a slide stack.
Custom SaaS development: CRM, client portal, business tool
A custom SaaS is a real product — not a stack of slides, not a spreadsheet that overflowed. We scope the need, model the data, build in Django, GraphQL and React, and ship a tool a small team can actually run.
SaaS development is part of our Digital Products expertise — prototyping, SaaS, and landing pages.
SYS/FOR
Who it's for
Internal tool stuck in spreadsheets
A process living in ten shared Sheets tabs: we turn it into a controlled application, with permissions and a history.
A client portal to open
Give your clients a space to track, upload, and approve — instead of endless email threads.
A product to launch without a tech team
A SaaS idea, no CTO: we scope, we build, and we ship an MVP you can show and sell.
SYS/SCOPE
What it covers
Six building blocks. Expand a card to see exactly what's inside.
Scoping and PRD
Journeys, screens, and business rules written in black and white before the first line of code.
What you get
A PRD per product step: goal, data, actions, rules, error states. This is the document that frames the agents' work throughout the build — and that lets you say no to a feature without reopening the debate. An existing clickable prototype is a strong substitute for this step.
Multi-tenant data model
A database designed to isolate each account properly, from day one.
What you get
PostgreSQL schema, entities, relations, and a tenant key carried by every query. Isolation is decided on day one: bolted on later, it forces a migration of every table and every query.
Django GraphQL API
A robust, typed backend that exposes exactly what the front end needs.
What you get
A typed schema, tested resolvers, and mutations that carry the business rules. Typing is also a guardrail for agents: an invented query doesn't compile, so it doesn't ship to production.
React front end
A reactive, maintainable interface, aligned with the validated mockups.
What you get
Components taken from the prototype's HTML screens, wired to the API: what was validated as clickable becomes the real interface, with no intermediate redesign phase.
Auth and roles
Authentication, permissions, and role gates, on both the front end and the back end.
What you get
One role per user type, a server-side check for every sensitive action, and the same gate replicated in the interface so we don't display what will be refused. The front-end check is convenience; the back-end check is security.
VPS deployment
Production on a VPS (nginx, database, cache), with a reproducible deployment path.
What you get
nginx in front, PostgreSQL and Redis behind, a replayable deployment and backups. The repo, the database, and the server are yours: no lock-in to a proprietary platform.
SYS/AI
What AI changes here
The studio builds software with agents in the loop, under a protocol named GSD: every phase — plan, execution, audit — goes through a dedicated agent, reviewed by a human. That's what lets one person ship a product, not a throwaway prototype.
Before
Custom SaaS used to assume a team: a back end, a front end, a lead holding coherence together. One person could mock it up, not ship it. The budget for a business tool therefore went either to a vendor that only half-fits, or to a stack of spreadsheets nobody masters anymore.
Team threshold
Three profiles minimum to hold a multi-tenant product, its permissions, and its deployment.
Cost of custom
A truly adapted tool stayed reserved for organizations that could fund an in-house team.
With agents
Work is split into phases, each assigned to a dedicated agent under the GSD protocol, with a written plan before execution and an audit after. RankyDocky — multi-tenant CRM, 33 modules — is built exactly this way: that's what lets one person ship a product, not a demo. The SEO & GEO audit, the original fork, automates client analyses.
Protocol
GSD frames the agents' work: written plans, task-based execution, systematic audits — speed without the chaos.
Project skills
Project-specific skills give agents the context. We explain this in detail on the AI engineering page.
What stays human
The data model, account isolation, and permissions can't be delegated: they're the decisions you can't fix after the fact without migrating everything. The MVP scope neither — knowing what you won't build is half the work. Every task an agent produces is reviewed before it's committed.
Architecture
Data model, multi-tenant isolation, and roles: decided and reviewed by hand, line by line.
Scope
Arbitrate the MVP, refuse the extra feature, decide when the product is ready to go to production.
SYS/LOOP
How we work
From idea to product in production, in short iterations.
- 01Scope — PRD, journeys, and key screens — agree on the product before coding.
- 02Model — multi-tenant data schema, entities and relations designed to last.
- 03Build — Django GraphQL API and React front end, developed with agents and reviewed.
- 04Secure — authentication, roles, and permissions checked on both front end and back end.
- 05Deploy — production on a VPS, with a reproducible deployment path.
SYS/PROOF
Proof
| Metric | Registrants |
|---|---|
| Target | 3,000 |
| Actual | 6,300 |
Platform of 60 webinars over 5 days · 15,000 hours watched · NPS 60.
RankyDocky has no public usage metric — we write that rather than invent a number. What is verifiable is the surface: 33 modules, tenant isolation, Django, GraphQL, React, GSD. The SEO & GEO audit, in production for engagements, connects to the same backend.
Business tool · SEO / GEO
SEO & GEO Audit
In production
Internal tool for client analyses. Integrable with RankyDocky.
Product · prototype
BAO (docAgency)
34 screens
Guided journey in 13 steps, 10 PRDs, bank-ready PDF export.
Shamalo's own client portal is being built on this stack (coming soon).
SYS/TOOLS
Tools
- Django
- GraphQL
- React
- PostgreSQL
- Redis
- nginx
- GSD
SYS/FAQ
Frequently asked questions
Custom or no-code?
No-code is fast for validating an idea: an Airtable, a Webflow + logic, a bolted-on business tool. It hits a ceiling as soon as you need a clean data model, fine-grained permissions, volume, integrations, tenancy. Custom costs more up front and gives you the product and the code back.
MoreLess
Shamalo builds custom (Django, React, GraphQL — the same kind of stack as RankyDocky) when the tool is the business. We don't force a rebuild if an honest no-code still covers the next six months.
The call is for figuring out which side of the ceiling you're on. “We'll deal with roles later” is often the moment later is already too late.
How long for an MVP?
A few weeks for a first usable product, depending on scope. Agents in the loop speed up production; scoping and review remain the limiting factor — and that's a good thing. A fuzzy MVP shipped fast is more expensive than a narrow MVP shipped right.
MoreLess
An HTML proto upstream (the Prototyping lever) buys that time: we don't discover the flows during the build. BAO went through 34 screens before code; RankyDocky is a 33-module CRM, actually in production. The SEO & GEO audit is the studio's analysis backend.
Nobody should promise “the equivalent of an eight-person team in ten days.” We promise a written scope and a cadence.
Who owns the code?
You do. The repo, the database, and the infrastructure come back to you. No lock-in to a platform you can't leave, no “our in-house framework.”
MoreLess
That's the difference with a lot of no-code tools or site factories: the day the studio is gone, the product continues. Documentation, access, environment variables: that's part of the deliverable, not an extra.
Secrets (keys, tokens) stay yours. We don't recycle them, we don't put them on a slide.
Can we start from an existing prototype?
Yes — it's even the ideal. A clickable prototype (see Prototyping) serves as a living spec: screens, PRDs, UX decisions. The build doesn't invent the flows a second time.
MoreLess
A Figma file alone also works, with more risk of ambiguity. A Word spec, less so: we retranslate it into journeys before coding, otherwise we code misunderstandings.
If the proto comes from elsewhere, we run a takeover review: what's in scope, what isn't, what's decoration.
Designer or developer — who does what?
In this studio, the same counterpart connects journey, interface, and code. This isn't a design team on one side and a ticket factory on the other. Agents speed up both ends; product review stays human.
MoreLess
Polished art direction, an illustration, motion: we can lean on a partner designer. The heart of the SaaS (model, roles, business screens) isn't subcontracted to a decorative mockup.
If you already have a design system, we align with it. If you don't, we set a sober base, not a full identity “while we're at it.”
What about maintenance after launch?
A living product needs fixes, dependency updates, sometimes a small evolution. We can hold a retainer — it isn't mandatory on day 1, but dropping it on acceptance day is a bad plan.
MoreLess
Because you own the code, you can also hand it to an in-house team or another vendor. The studio documents so that's possible, not to make itself indispensable through opacity.
VPS-style hosting, backups, updates: we scope them. No “it's in the cloud” magic without naming who pays and who watches.
Multi-tenant, roles, security — do you handle that?
Yes, when the product requires it. RankyDocky / Shamalo carry isolation by organization, roles (owner, admin, editor, viewer), HttpOnly cookies, no tokens in localStorage. This isn't theater: it's the craft of a B2B tool.
MoreLess
We don't put a security factory “just in case” on a three-user MVP. We put in what prevents rebuilding everything in six months: the access model, as soon as there's more than one role or more than one client.
The details get scoped in writing. A SaaS without tenancy when you sell to multiple clients is debt, not simplicity.
What stack, concretely?
On the studio side, the default is what's already in production: Django, GraphQL, React, PostgreSQL, Celery when we need async. We adapt if you have an imposed stack — we don't force-convert a Symfony team.
MoreLess
The marketing front isn't the product: Next.js or static for a showcase, the SaaS separate. Mixing the two without saying so is how you end up with a CMS that can no longer move.
Agents (Cursor, GSD, skills) are how we code, not a runtime you have to install. You receive a standard repository.
SYS/NEXT
Next step
Describe the process or product to build: we'll say whether custom SaaS is the right answer, and which MVP to start with. Written scope within 48h, no commitment.
The other levers of Digital Product Design