DEV Community

Cover image for How to Audit Multi-Tenant SaaS Architecture for True Agency White-Labeling
And we got to get ourselves back to the garden.
And we got to get ourselves back to the garden.

Posted on

How to Audit Multi-Tenant SaaS Architecture for True Agency White-Labeling

#architecture #backend #infrastructure #saas

When building or integrating third-party SaaS solutions into multi-tenant agency setups, marketing pages rarely reveal the true technical constraints under the hood. Vague claims like "Custom Branding" or "Enterprise White-Labeling" usually obscure backend engineering limitations.

To accurately evaluate SaaS infrastructure—whether you are vetting vendor platforms or building multi-tenant tools yourself—you need to audit the codebase, DNS behavior, and middleware logic directly.

Below is a technical framework for evaluating SaaS multi-tenancy, custom CNAME routing, and tracking isolation.

  1. Domain Masking & Zero-Footprint Footprints

True white-labeling requires zero-footprint tracking. Many platforms allow custom domains via CNAME records but leak vendor footprints in:

Open Graph (OG) / Meta Tags: Hardcoded asset URLs pointing to vendor CDNs ([cdn.vendorsaas.com/assets/](https://cdn.vendorsaas.com/assets/)...).

OAuth Callback URLs: Redirect parameters containing the core vendor domain during third-party authentication loops.

WebSockets / API Endpoints: Client-side JavaScript making AJAX calls to vendor-owned subdomains.
Enter fullscreen mode Exit fullscreen mode

Inspecting Asset Paths

When auditing a vendor dashboard or customer-facing view, inspect asset networks via CLI or browser tools to check for external host leakage:
Bash

Check headers and asset origin leakage on a target custom domain

curl -I -L https://app.clientdomain.com | grep -iE 'x-powered-by|server|set-cookie'

If cookies or backend response headers expose default vendor middleware signatures (e.g., specific header parameters or static bucket origins), the environment isn't fully isolated.

  1. Dynamic CNAME & TLS Certificate Management

A robust multi-tenant architecture needs to provision, validate, and renew SSL/TLS certificates dynamically when end users map custom domains.

In modern stacks (Node.js/Go backend with Caddy, NGINX, or Cloudflare for Platforms), the TLS termination workflow generally follows this lifecycle:

[ Client Request ] ---> [ Reverse Proxy / Anycast IP ]
                                |
                   (Check TLS Certificate Cache)
                                |
                  +-------------+-------------+
                  |                           |
            [ Valid TLS ]              [ Missing TLS ]
                  |                           |
       (Proxy to Backend)           (Trigger ACME Challenge)
                                              |
                                    (Issue via Let's Encrypt)
Enter fullscreen mode Exit fullscreen mode

Example: On-Demand TLS with Caddy

If you are engineering a multi-tenant platform, Caddy provides built-in On-Demand TLS out of the box:
JSON

{
  "apps": {
    "tls": {
      "automation": {
        "policies": [
          {
            "on_demand": true
          }
        ]
      }
    }
  }
}
Enter fullscreen mode Exit fullscreen mode

Note: Always implement an internal API endpoint check for on_demand requests to prevent Denial-of-Service (DoS) attacks from malicious domain pointing.

  1. Sub-Account Multi-Tenancy & Data Isolation

A key technical requirement for agency management is dynamic tenant switching without re-authenticating across sub-accounts.
Database Architecture: Shared Database, Separate Schema/Tenant Key

Most B2B SaaS platforms utilize row-level security (RLS) or tenant isolation keys within a shared database instance:

-- Example Row-Level Security in PostgreSQL for tenant isolation
ALTER TABLE client_data ENABLE ROW LEVEL SECURITY;

CREATE POLICY tenant_isolation_policy ON client_data
    USING (tenant_id = current_setting('app.current_tenant_id'));
Enter fullscreen mode Exit fullscreen mode

When auditing a vendor platform, verify whether agency account managers can switch tenant_id context dynamically via JWT scoping without requiring separate login sessions.4. Unmasking Technical SpecsAt WebPopulous, we index and audit these exact technical parameters across B2B SaaS tools—looking beyond marketing pages to benchmark: DNS & Custom Routing Support: CNAME, A-Record, and Wildcard SSL configurations.Sub-Account Billing Mechanics: API-driven usage tracking and margin splits.Middleware Logic: Webhook reliability, API rate limits, and agentic loop integrations.How do you audit multi-tenant SaaS tools or handle dynamic CNAME routing in your own stack? Let's discuss in the comments below!

Top comments (0)