Tenant isolation proven by tests
A behavioural matrix proves tenant A cannot read tenant B across every tenant-owned store.
Bookings, customers, billing, websites, inventory and industry workflows in one multi-tenant platform. See exactly what ships today, what is in build, and what is planned.
Each of these is enforced in code and covered by a test, not asserted in a brochure.
A behavioural matrix proves tenant A cannot read tenant B across every tenant-owned store.
TOTP validated against RFC 6238 vectors; a permission never declared cannot be granted.
Append-only logs on every sensitive action, exportable from the admin console.
Integer minor units end to end, tax in basis points, issued invoices frozen.
Who uses what, and where it lives.
Guided setup, today's dashboard, calendar, customer records, inventory, orders, team and settings — one app per business, scoped to that business only.
Every tenant gets a website on its own host: pages, blog, services, locations, forms, FAQ and testimonials, with an embeddable booking widget that takes real appointments.
Tenants, users, subscriptions, module toggles, configuration, partner accounts, the audit trail and operational health in one console.
Scoped bearer tokens, one response envelope across every module, public booking and form endpoints, and signed payment webhooks.
Every industry has a live workspace with real sample data. No sign-up, nothing to fill in.
Choose an industry12 capability groups. Status is stated per group, including the parts that are not finished.
The booking engine, from working hours to a confirmed, conflict-free appointment with a deposit taken.
Leads through to repeat customers, the services you sell, and the people who deliver them.
Plans, entitlements and money — with the accounting rules that keep an invoice defensible.
A real public web presence per tenant, not a profile page.
Stock, orders and documents for businesses that sell things as well as time.
The messages that make customers show up, and the rules that send them without anyone remembering to.
Who can sign in, what they can touch, and proof of both.
The guarantee everything else rests on: your data is yours, provably.
The shared services every module is built on, so no module invents its own.
Provider-neutral by design: the seam exists and is metered before a single assistant ships.
Resell ServiceOS under your own brand.
Deliberately held until after go-live (status.md §4a) — a plugin contract designed against zero real plugins fits nothing.
Listed from the running registry, so this cannot claim something that is not installed.
Platform core module registry, health, and shared primitives
Platform and tenant users, actor identity, and authentication foundation
Subscription plans, pricing, entitlements, and payments
Provider-neutral AI completion and assistant contracts
Platform administration console for staff
Leads, contacts, customers, and service business records
Outbound email, SMS, and messaging provider abstractions
Tenant calendars and appointment scheduling primitives
Event-driven workflow triggers and rule-based actions
Tenant-facing application: onboarding, dashboard, customers, calendar, settings
Inventory, orders, documents and finance operations
Tenant website engine: themes, widgets, pages, and routing
Tenant branding, partner accounts and reseller operations
Seventeen modules with declared dependencies boot in order from their own manifests. One deployment, clear seams — so a module can be extracted when there is evidence it should be, not before.
No tenant resolved means no data. No entitlement means 402. A permission that was never declared cannot be granted. The default answer to an unclear question is no.
Integer minor units end to end (ADR-0002); tax in basis points. Invoice totals are derived from lines, and an issued invoice is frozen — corrections go through void-and-reissue.
Email, SMS, payments, AI, search and storage each sit behind one contract. Switching provider is an env change, and no SDK leaks past its adapter.
PHP 8.3, Laravel 12, MariaDB, Apache. Database-backed cache, sessions and queues. No Docker, no Redis (ADR-0003) — fewer moving parts to be woken up for.
Structural guards fail the build if a tenant-owned model, job or table skips its safeguard, and a behavioural matrix proves A cannot read B across every tenant-owned store.
Listed on the front page on purpose. Finding these out later is worse than reading them now.