Independent Fractional CTO / Senior SaaS Architect for 8-Week Technical Oversight & Code Review

About the role

We are engaging a developer to build Phase 1 of a custom multi-tenant SaaS platform and require an independent senior technical representative to protect the client's technical interests throughout development.

You will NOT be building the application.

Your role is to independently review the developer's architecture and implementation, challenge technical decisions where appropriate, inspect code/security at defined milestones, and advise the business owner whether each milestone is technically acceptable.

Current proposed stack

React

Node.js API

PostgreSQL

PostgreSQL RLS

AWS

Private S3 storage

GitHub Actions / CI-CD

The system includes professional profiles, compliance/certification records, private documents, availability, project requirements, automated matching, client portals, controlled data release, onboarding and active-assignment compliance monitoring.

Particular attention is required around:

Multi-tenant isolation; PostgreSQL RLS; authentication/authorization; private document access; AWS IAM/S3; secrets management; API security; database design; automated tenant-isolation testing; backups/recovery; CI/CD; scalability; code maintainability; and developer exit/takeover readiness.

The engagement is expected to require approximately 15–25 hours over 8 weeks, including:

1. 1.Pre-award architecture/proposal review

1. 1.Participation in final developer technical interview

1. 1.Day-14/Milestone 1 review

1. 1.Matching/compliance-engine review

1. 1.Client portal/multi-tenant security review

1. 1.Final production/security/handover review

We prefer someone who has personally architected or reviewed production multi-tenant SaaS applications using Node.js + PostgreSQL + AWS.

Please do not apply based solely on general website development, WordPress, UI/UX or frontend experience.

Please answer the screening questions below. Generic applications that do not address them will not be shortlisted.

Five screening questions

1. 1.Describe one production multi-tenant SaaS system you personally architected or technically reviewed. What stack did it use, approximately what scale did it operate at, and how was tenant isolation implemented?

1. 1.Assume a Node.js application uses PostgreSQL Row-Level Security to isolate Client A from Client B. What specifically would you inspect and test before telling the owner that cross-tenant isolation is adequately implemented?

1. 1.Candidate certificates and confidential documents are stored in private AWS S3. Clients should only access documents deliberately released to them. Briefly describe the architecture/security controls you would expect.

1. 1.The developer proposes building authentication directly into the Node.js application rather than using an external identity provider. What would you review before accepting that architecture?

1. 1.You are reviewing an 8-week project at four milestones. What evidence would you require before recommending that the client release a milestone payment?