The platform you own

Own auth, uploads
& security.

One self-hosted developer platform for every app you build — yours and your clients'. Runs on your Postgres and your storage. No per-MAU tax. No vendor hostage situation.

Open your platform See what's live

Auth: Live
Uploads: Live
RLS tenancy: Verified
AI security: Roadmap

extrastate · control plane~/fleet

Live · Auth
Identity on your Postgres
Email, Google, orgs, MFA, JWT, passkeys. better-auth (MIT) — no copyleft, no per-MAU meter.
status: production
Live · Uploads
Files without the S3 dance
Presign → direct PUT → completion under tenant RLS. Typed router DX on storage you already own.
path: auth → storage → files row
Roadmap · Security
Guard fused to identity
Anomaly detection, prompt-injection screening, audit trails — security that can see the auth plane.
year-2 · guard first
Architecture · Tenancy
Agency-grade isolation
Super-admin → accounts → sub-accounts. FORCE RLS, authz in the DAL — not middleware theater.
tenant_id = organization.id

Platform

Everything your apps need — one owned spine.

Four surfaces, one deployment. Status is honest: live means proven on the fleet, not a mockup.

AUTHLive

Identity, owned

Email, Google, orgs, MFA, JWT, passkeys — better-auth under the hood, MIT licensed. Runs in your app against your Postgres. Fork, modify, resell. No copyleft bleed into client code.

Session + JWT with JWKS verification
Orgs & multi-tenant membership
Authz enforced in the DAL, not proxy.ts

UPLOADSLive

Files without the complexity

Type-safe file router on storage you control. Presigned PUT, completion under tenant RLS, signed delivery path. The UploadThing DX — without the UploadThing bill.

Auth’d presign → direct object store PUT
Completion writes files row under RLS
R2 now; MinIO-proven on the fleet

SECURITYSoon

AI security layer

Guard / Scan / Fix — anomaly detection on the identity plane, prompt-injection screening, automated scans. The moat no auth-only or scanner-only product can copy.

Guard fused to login & token events
Passive scan first; active scan gated
Findings you can hand a client

MULTI-TENANTLive

Agency-grade tenancy

Super-app-admin → accounts → sub-accounts. White-label, resold, self-hosted. One deployment, many isolated apps — the reseller motion incumbents ignore.

FORCE ROW LEVEL SECURITY
tenant_id = organization.id
Bleed tests on real Postgres

Right path, right now

What you need depends on who you are.

Pick your lane. Each path ends in a concrete next step — not a generic “learn more.”

Agencies & freelancers

Sell login + files + security under your brand

Flat wholesale economics you mark up. Provision a client tenant, brand it, hand over keys — without becoming an infrastructure company.

See the ownership math

Indie builders & SMB SaaS

Clerk-grade DX without the growth tax

One box for auth + uploads + baseline security. Self-host free, or run managed later. Core stays open so you can trust what you ship on.

Open the platform

Fleet operators

Stop re-plumbing every new app

Drop the same spine into every project on boxes you already pay for. Dogfood first, resell when the proof is real.

Review live pillars

How it works

Stand up once. Wire every app. Stop rebuying plumbing.

Stand up once

Deploy on your fleet — Postgres + object storage + the web app. Your infra, your data plane.

Wire each app

Publishable + secret keys per project. Same integration story as the SaaS you outgrew — owned end to end.

Reuse & resell

Next owner app or next client tenant is minutes, not a new vendor account and a new meter.

Ownership math

Stop paying the SaaS tax on every app and every client.

Incumbents meter growth. extrastate meters almost nothing on the critical path — because the COGS sits on infrastructure you already operate.

ProductEconomicsOwnershipScope

Clerk / Auth0Per-MAU growth taxYou own nothingAuth only

UploadThingStorage + bandwidth storyTheir planeUploads only

Scanners aloneAnother seat / scan billBlind to identitySecurity only

extrastateNear-zero marginal COGSYour fleet, your codeAll three · resellable

Figures are structural, not fabricated benchmarks. Your savings scale with how many apps and client tenants you currently re-plumb.

Security model

Isolation is law, not a slide deck.

Non-owner DB role. FORCE ROW LEVEL SECURITY. SET LOCAL app.current_tenant set in the data access layer — never in the proxy. Authorization lives where the data is touched.

Cross-tenant INSERT blocked on real Postgres
Audit log append-only
Active scans require ownership + scope proof (roadmap)
No secrets in the repo; fleet env stays outside git

tenancy · contract

// authz-in-DAL (not proxy.ts)
await withTenant(tenantId, async (tx) => {
  // SET LOCAL app.current_tenant
  return tx.select().from(files);
});

// FORCE RLS on files
// tenant_id = organization.id

Stack

Built on boring, owned technology.

Next.js 16
better-auth (MIT)
Postgres + pgvector
Drizzle
Cloudflare R2 / MinIO
Workers edge
Stripe Connect (Y2)
Self-hosted fleet

Next step

Your apps already need this spine. Stop renting it.

Open your platform View source

Own auth, uploads& security.