Przemysław Zalewski

For owners who built their own system, with AI or without

Your company tool, sold to other companies

You built a TMS, a CRM or a scheduling app for your own company, maybe with Claude or Lovable. It works, and other companies ask to buy it. Today each of them would need a separate copy. I turn it into one product for many clients, without rewriting what already works.

See price and start date → Book a free 30‑min call

Przemysław Zalewski

Sound familiar?

Internal tool to SaaS: problems I fix in 2026

How do we answer a client’s security questionnaire?

Poland’s NIS2 law, the amended National Cybersecurity System Act, took effect on 3 April 2026, and covered companies must have its obligations in place by 3 April 2027. Larger clients pass that work down to their suppliers as questionnaires.

I led Google’s CASA security assessment to a pass twice, in January and October 2026, and turned its controls into Playwright checks that run on every pull request. I set up the same for your product, so you answer the questionnaire with evidence from your own code. In May 2025, before the first line of an email client, I read Google’s and Yahoo’s policies, showed that the planned way of making money would break them and proposed a compliant one; months later it passed Google’s OAuth verification and the CASA security assessment.

Can a client leave our SaaS and take its data with it?

Under the EU Data Act, business customers of in‑scope cloud and SaaS services can switch providers with at most two months’ notice since 12 September 2025, and from 12 January 2027 switching charges are banned. A tool that cannot export one client’s data cleanly becomes a contract problem.

I build a complete per‑client export in open formats into the multi-tenant model from the start, so a switching request is a button, not a project. In November 2023 I fixed Sandtime’s Excel export so totals over 24 hours stay correct, tested on Mac and Windows, and in October 2026 wrote the help article on exporting members’ daily timesheets.

Can one client see another client’s data in our app?

In February 2026 Wiz found Moltbook’s production database open to anyone: the app, whose founder said he did not write a single line of its code, had no row‑level security in Supabase, so a key in its public JavaScript let anyone without a login read and edit the data, including 1.5 million API tokens and 35,000 email addresses. One copy per company hides that risk; one product for many companies multiplies it.

I split client data the way your numbers call for, then add tests that run on every change, sign in as one client and try to read another’s records. Sandtime.io, the multi-tenant SaaS where I was founding engineer, has run in production since 2018. In 2024 I scoped access keys on seven endpoints of a multi-tenant SaaS and covered each with tests, after replacing guessable sequential IDs with random ones the year before.

Facing one of these? Book a free 30‑min call →

Scope

What changes in your app

Client data, split the right way

Shared tables with a client column, a schema per client or separate databases for those whose contracts require it, chosen on your numbers.

Sign-up, invitations and roles

A new company signs up, invites its people and gets the right permissions without you touching the database.

Billing and invoices

Plans and subscriptions with Stripe or Polish payment providers, invoices that can go to KSeF.

One deploy for everyone

A release updates every client at once, and a single client can be restored on its own.

Process

How it works

  1. Pick the model

    Clients now and in two years, contracts, what differs between clients. The free calculator gives a first answer.

  2. Four to ten weeks

    The changes in your code, with your own company moved in as the first client and nothing lost.

  3. First paying clients

    We onboard the first three clients together, so you see where they get stuck.

  4. Then I can stay

    As the engineer of the product, a few days a month or more, as it grows.

Where it fits

  • A company tool other firms in your industry already ask about.
  • An MVP built with Lovable, Bolt, Replit or Claude that now has paying clients.
  • A separate copy per client, and too many servers to update.

Track record

Proof

Sandtime.io, the multi-tenant SaaS in the first case below, has run in production since 2018 and serves 4,000+ freelancers and teams. I was its founding engineer. Check your own case in the free multi‑tenant calculator.

Sandtime.io, built at Sanddev: founding engineer, eight platforms, one codebase

The problem
A time-tracking SaaS had to live where people work: desktop tray, browser, phone and app stores.
What I did
I authored the original product vision and architecture in 2018 and made the first commit. React Native wrappers for iOS and Android, Electron for macOS, Windows and Linux, a Chrome extension, multi-tenant routing, SSO, Dockerized services, Paddle and Mac App Store subscriptions, CI/CD.
Result
Eight platforms shipped and run in production. The only engineer active in every year of the product, 8,000+ commits and close to half of all merges to trunk. In 2026 alone: 270+ tagged releases in ten months, about 99% of support answered by me, and a vulnerability disclosure program with a public Hall of Fame.

8 platforms 8,000+ commits since 2018 Open ↗

See also: Mobile & desktop apps · SaaS & MVP

Suppression-list platform: MVP to product, 300+ GB in production

The problem
A UK email publisher needed suppression lists built to grow to terabyte scale with constant-time sign‑up and zero-downtime deploys.
What I did
I led a small team from MVP to the full platform. Postgres partitioning by tenant and list, parallel request pipelines, blue/green deploys. One‑click unsubscribe shipped four months before Google and Yahoo announced the requirement.
Result
300+ GB and millions of events in production, zero-downtime deploys, an opt‑out path that kept working through a deliberate backend outage, and a compliance feature that landed before the deadline existed. In August 2026 I found orphaned table partitions left behind by deleted accounts and sales demos, stopped them piling up and recovered about 140 GB.

300+ GB outage-tested opt‑out blue/green

See also: TypeScript & Node.js · Full‑stack & custom software

CASA Tier 2 turned into a Playwright suite

The problem
OAuth access to Gmail requires Google’s CASA assessment every year. A questionnaire does not stop regressions.
What I did
Each CASA and OWASP ASVS control encoded as a Playwright test. E2E and visual regression across six browser and device targets, run on every pull request.
Result
CASA Tier 2 passed, Yahoo’s OAuth review passed, and an annual chore became a continuous check.

CASA Tier 2 OWASP ASVS 6 targets

See also: TypeScript & Node.js · Mobile & desktop apps

Want the number before the call?

See price and start date → Book a free 30‑min call

Good to know

What changes when an internal tool becomes a SaaS

Every client needs a DPA

Under GDPR the SaaS processes its clients’ data and needs a processing contract with each of them; sub-processors need the client’s written authorization (GDPR art. 28).

Consumer sales across the EU have a 10,000 EUR threshold

Above 10,000 EUR a year of cross-border consumer sales, VAT is due in each customer’s country, reported through one OSS return (Your Europe).

The 14-day withdrawal right needs explicit consent to waive

A consumer keeps the right to withdraw from digital content unless they consented to the start and acknowledged losing that right, so the consent belongs in checkout (Directive 2011/83/EU art. 16).

BLIK subscriptions cap at 2,000 PLN

Stripe supports recurring BLIK, but each charge is capped at 2,000 PLN, in PLN only, at supported banks (Stripe docs).

Client SSO needs a multitenant app

For sign‑in through clients’ Microsoft accounts, the Entra app registration must accept accounts in any directory (Microsoft Learn).

FAQ

Questions

Do we have to rewrite the app?
Usually not. The client identifier goes into the tables and the queries, login learns which client a person belongs to, and your own company becomes the first client.
What about clients who want a separate database?
They get one, on the same code and the same release, often as a higher plan.
Can you also become our technical partner?
Yes, as a paid engineer of the product after the build, a few days a month or more, or as a business partner for equity or a share of revenue. We decide after the first clients, on numbers.
How long does it take?
Four to ten weeks, depending on how many separate copies you run today, separate databases and per‑client fields.
Do we need a DPA when we sell our internal tool to other companies?
Yes. GDPR article 28 requires a processing contract with each client, and clients must authorize your sub-processors in writing (GDPR).
Who owns the code if someone outside the company built the tool?
Under Polish law a copyright transfer covers only the fields of use the contract names and must be in writing (Copyright Act). Check that before you sell it.
How do we answer a client’s security questionnaire?
Poland’s NIS2 law, the amended National Cybersecurity System Act, took effect on 3 April 2026, and covered companies must have its obligations in place by 3 April 2027. Larger clients pass that work down to their suppliers as questionnaires. I led Google’s CASA security assessment to a pass twice, in January and October 2026, and turned its controls into Playwright checks that run on every pull request. I set up the same for your product, so you answer the questionnaire with evidence from your own code. In May 2025, before the first line of an email client, I read Google’s and Yahoo’s policies, showed that the planned way of making money would break them and proposed a compliant one; months later it passed Google’s OAuth verification and the CASA security assessment.

In 30 minutes you will know if we are a fit

You bring the problem, I bring the questions. Want a number first? The configurator shows hours, a price range and the start date.

Book a free 30‑min call Email me instead

or write to ciunkos@gmail.com

After you book you get a calendar invite. Nothing else to fill in.

My pledge

  • Reply within 24 hours. I reply within 24 hours on working days, personally, not a bot. Weekend messages: by Monday noon.
  • Late means free. If I am late, the first hour of work is free. You do not have to ask.
  • Scope in writing within 24 hours. A free 30‑minute call with no company deck, then the scope and the price in writing within 24 hours. You decide.
  • The person who does the work. You talk to the person who does the work. No sales layer, no handoff.
  • Follow‑up only with news. I follow up only when I have something new for you. Never a “did you see my offer”.
  • Honest “not a fit”. If I am not the right person, I say so on the call and point you to someone who is.

Calls this week · work can start now · B2B contract · Wrocław, Poland (CET), remote

You own the code, domain and accounts from day one. Nothing is held hostage.