HSK Stack. Our SaaS foundation
A battery-included foundation. Auth, billing, multi-tenancy, RBAC, audit logs, background workers and a polished admin panel — pre-wired, opinionated, production-tested across six of our own products.
What HSK
ships with.
Sixteen capabilities you'd otherwise build, integrate, debug and document yourself. Every one is opt-in, every one is documented, every one is in production at HSBR.
Auth & SSO
Email + password, magic links, Google / Microsoft / GitHub OAuth, SAML SSO, TOTP & WebAuthn 2FA.
CoreMulti-tenancy
Row-level by default. Schema or domain isolation when you outgrow it. Tenant-scoped queues + cache.
CoreRBAC & gates
Roles, abilities, team membership, granular policy gates with inheritance.
CoreBilling
Stripe + Razorpay + Paddle. Plans, seats, metered, trials, dunning, customer portal.
CoreAudit log
Every model change, every actor, every IP. Diffable, exportable, GDPR-compliant.
CoreFeature flags
Per-tenant, per-user, percentage rollouts. Local overrides for dev. UI in admin.
CoreQueues & jobs
Horizon-backed. Retry policies, rate limits, named queues per workload class.
CoreAdmin panel
Filament-based. CRUD, search, filters, bulk actions, impersonate, soft-delete UI.
CoreTransactional email
Postmark / SES adapters, signed unsubscribe, MJML templates, preview UI.
CoreWebhooks
Inbound & outbound. Signatures, replay protection, retry queue, dead-letter handler.
CoreAPI gateway
OpenAPI-first. Token + OAuth2 client creds, rate-limit tiers, scoped abilities.
CoreNotifications
In-app inbox, email, push, SMS — same API, per-user preferences, digest support.
CoreObservability
Sentry, OpenTelemetry, structured logs, request IDs, slow-query inspector.
Add-onFile storage
S3 / R2 adapters, image variants on-demand, signed URLs, virus scan hook.
CoreSearch
Meilisearch / Typesense scout drivers, per-tenant indexes, async indexing.
Add-onCompliance
GDPR delete & export, data retention, encrypted at rest, redaction policies.
Add-onOpinionated.
Not magical.
-
/01Architecture
Modular monolith, not microservices.
One repo, one deploy, one database. Modules are PHP namespaces, not network boundaries — you only pay the distributed-systems tax when scale earns it.
-
/02Pattern
Action classes over fat controllers.
Every business operation is an invokable Action. Easy to test, easy to queue, easy to call from a controller, command or job.
-
/03Frontend
Livewire-first UI, Vue when you need it.
Server-rendered, reactive components for 90% of the admin and tenant UI. Vue islands for richer surfaces — same backend.
-
/04Infra
Queue everything that isn't a render.
Email, webhooks, exports, reports, even some lookups. Horizon dashboards, retry policies, rate limits — all wired.
-
/05Testing
Tests that match the shape of the code.
Pest unit tests at the Action layer, browser tests for the critical user flows. CI fails fast on the things that matter.
-
/06Operations
Observability is not optional.
Every Action logs structured events, every request carries a trace ID, every slow query gets logged. You'll know what broke before the user calls.