From MVP to Paid SaaS: The 10 Missing Components for Production
Published on 2026-11-14 by frfrand
Authentication, plans, billing, limits, support, and operations to charge real users.
A working demo is not yet a SaaS business
An MVP can demonstrate that the problem exists and that a solution is of interest. To charge real customers you need a reliable operation: security, sign-ups and cancellations, billing, service limits, recovery and support. This does not require building a giant platform, but it does require avoiding failures that damage trust or data.
1. Identity and permissions
Define users, organizations, roles and access recovery. Check on the server that no one can see another customer's data by changing an identifier in the URL. Use secure sessions, MFA when appropriate and auditing of administrative actions.
2. Separation between customers
Choose a multi-tenant strategy or separate instances according to risk and operation. In a shared database, all sensitive queries must apply the customer scope, preferably with additional controls. Specifically test cross-access.
3. Plans and catalog
Write what each plan includes: number of users, projects, storage, messages or API consumption. Distinguish price presentation from actual authorization. The application must verify limits in the backend, not just hide buttons.
4. Checkout and subscriptions
Select a payment provider according to markets and business obligations. Register transaction identifiers, subscription status, and events. Do not grant definitive access just because the browser returns to a success URL: process authenticated webhooks idempotently.
5. Changes and cancellation
Model free trials, upgrades, downgrades, failed payments, grace periods, cancellations, and reactivation. Explicitly define what happens to data if payment stops and communicate the policy.
6. Usage metering
Measurable limits need reliable counters and a retry policy. If you charge by consumption, keep auditable records to explain invoices and resolve disputes. Avoid counting the same event twice.
7. Infrastructure and backups
Implement HTTPS, secret management, environments, logs, monitoring, alerts, and tested restorations. A single VPS may be sufficient at first if risks are known, but document how to scale capacity and recovery times.
8. Email and asynchronous processes
Configure account verification, password recovery, billing notices, and notifications through a suitable provider. Use queues and retries with idempotency. Have procedures for job errors, bounced emails, and delayed webhooks.
9. Customer support
Support needs a contact channel, an incident system, owners, and a way to reproduce errors. Record availability and critical operations metrics. Transparency during incidents is worth more than promising a perfect service.
10. Privacy, contracts, and ownership
Prepare terms of service, privacy information, data retention and export in line with the markets where you operate. Define who operates the product, who can access sensitive information, and how to delete an account.
Recommended implementation order
First ensure identity, isolation, and a reliable core operation. Then add billing and limits that are properly tested. Complete observability, support, incident management, and automations before seeking accelerated growth.
Read real payments in AI-built apps, emails and cron in production and launch checklist. ArduMaker offers infrastructure and development, but SaaS obligations must be designed for the specific product.
Frequently asked questions
### Do I have to develop billing from scratch? No. Integrate a suitable provider and maintain consistent internal accounting of events. ### Do I need microservices? Not at the beginning; a modular monolith can facilitate operations and maintenance. ### Which indicator is most important? It depends on the phase: start with activation, retention, and reliability before optimizing superficial metrics.