SaaS Kit — Multi-Tenant Control Plane for PHP Apps
Turn any single-tenant PHP app into a multi-tenant SaaS with its own database per tenant.
The problem it solves
You have a solid single-tenant PHP app — a booking system, an invoicing tool, a membership manager — and ten customers want it. So you either install it ten times and babysit ten servers, or you rewrite it "multi-tenant" by threading a tenant_id through every query and praying you never forget a WHERE clause.
- One missed scope and Customer A is reading Customer B's data
- A separate database per tenant makes cross-tenant leaks structurally impossible instead of a hoped-for discipline
- The alternative today is ten servers to babysit, or a rewrite you have to get perfectly right
What you get
Fail-closed subdomain routing
A forged Host header, an unknown subdomain, or a suffix-spoof reaches no tenant database at all — proven by a shipped isolation test, not claimed.
Separate database per tenant
SQLite means one file per tenant; MySQL means one database per tenant — not a shared schema with a tenant_id column.
Self-serve signup & provisioning
Signup creates the tenant, creates its database, and runs the product's own installer headlessly, with no duplicated schema code.
BYO-key Stripe billing
Signature-verified, replay-protected webhooks drive the lifecycle from trial through active, past_due, suspended, to cancelled, which is terminal.
Operator console
A KPI dashboard, a filterable tenant list with CSV export, tenant detail with provisioning state, and product-registry health in one place.
24 ready product adapters
Every Ownware catalog app is one config line away from being a SaaS, with a documented reference adapter for wiring your own.
Installable mobile app (PWA)
Add it to a phone or tablet home screen straight from the browser — a full-screen app served from your own server, with no app store involved. Business data is never cached offline, so what you see is always live.
Own It 2.0 — API, 2FA, backups, dark mode
SaaS Kit 2.0 adds the 2.0 owner layer. Upgrade by replacing the files — the database migrates itself, and it is still the same one-time purchase.
- REST API with an OpenAPI spec and signed webhooks
- Two-factor sign-in (TOTP)
Own It 3.0 — works for your AI, not just for you
The control plane gains an append-only audit trail: every tenant lifecycle change with the billing event that caused it, 2FA-aware operator logins, settings saves and backup downloads — when a customer asks why an instance is suspended, the answer is one filtered page. Backup exports are hardened with wider secret redaction. And every app you provision with it carries its own full Own It 3.0 layer.
Pricing — one-time, yours forever
- ✔ Full source included — PHP you can read and change
- ✔ No subscription. One payment, yours forever
- ✔ It never phones home
- ✔ Your data stays on your server
No reviews yet — so here is what we offer instead. Every competitor price on our comparison pages is source-linked and dated, and when a vendor’s price won’t load we say so rather than guess. See the sources for yourself →
Screenshots
Honest limitations
- Not for $3 shared hosting — per-tenant databases need CREATE DATABASE privileges, so a VPS or a host where you control MySQL is required
- You need wildcard DNS (*.yourapp.com) pointed at your server — no wildcard record, no tenant subdomains
- Billing is bring-your-own-Stripe; this is not a payment processor and takes no cut
- Isolation is at the PHP/database level, not container level — not Docker/VM-per-tenant infrastructure isolation
- Not the end business — if you're one company wanting one instance, buy the underlying product itself, not this kit
2-minute web installer (MySQL or SQLite for the control DB); PHP 8+ with PDO, requires a VPS with wildcard DNS for tenant subdomains.
Covered in these guides
The complete, honest guide to the hosted tier: what we run for you, what stays yours at every moment, the 12-month license promise, and when self-hosting is still the better call.
Frequently asked questions
Will it run on my host?
Only on a VPS or any host where you control MySQL and DNS. SQLite mode runs the whole thing locally for evaluation first.
Is the isolation claim marketing?
No — it's a shipped test. Run the isolation test suite and watch cross-tenant reads fail for every product on your box.
What if the seller disappears?
You have the full source; it phones home to nothing. Every tenant's data is a plain database you can back up and walk away with.
Does it take a cut of my billing?
No. Stripe keys are yours, webhooks hit your server, the kit never sees money.
Can I wire my own (non-Ownware) app?
Yes — the boot shim is about six lines in your index.php and the adapter is a copy of the documented reference. Budget about an hour.