Humzio

Multi-tenant HR SaaS built end to end

Designed and developed a multi-tenant HR management platform with organization isolation, role-based access, leave management, subscriptions, and secure authentication.

Role: Founder & Lead Engineer
System: Python / FastAPI / PostgreSQL / Redis / Next.js / TypeScript / Docker
Focus: Multi-tenancy · Security · Product architecture

01 / Overview

Overview

Designed and developed a multi-tenant HR management platform with organization isolation, role-based access, leave management, subscriptions, and secure authentication.

02 / My contribution

My contribution

Founder & Lead Engineer. Focus areas: Multi-tenancy, Security, Product architecture.

03 / My role

My role

Founder / Lead Engineer.

I founded Humzio and lead its engineering across the backend, the frontend and the infrastructure it runs on.

04 / Product scope

Product scope

The product scope covers:

Organisation administration
Role management
Leave management
Notifications
Billing

05 / Technology

Technology

Python, FastAPI, PostgreSQL, Redis, Next.js, TypeScript, Docker

06 / Architecture

Architecture

Backend: Python 3.12, FastAPI and SQLAlchemy 2.0 in async mode, on PostgreSQL 16.
Frontend: Next.js 15 and TypeScript, with TanStack Query for fetching and caching server data.
Background processing: Redis 7 Streams with a background worker.
Scheduled jobs: run by supercronic, a cron runner built for containers.

The diagram groups the main components by role. It does not show how they communicate.

Humzio components

07 / Multi-tenancy

Multi-tenancy

Tenant data isolation is implemented with PostgreSQL Row Level Security, so the rules that separate one organisation's data from another's are defined in the database itself.

08 / Authentication and access

Authentication and access

JWT-based authentication with refresh-token rotation
Multi-factor authentication (MFA)
Role management within each organisation

09 / Infrastructure and delivery

Infrastructure and delivery

Hosting: a Contabo VPS, with Traefik v3 as the reverse proxy.
CI/CD: Humzio's CI/CD setup uses GitHub Actions and the GitHub Container Registry (GHCR).