Aeion Platform for Agencies Running Many Client Tenants
Agencies, consultancies, and managed-service providers that build and operate software for a roster of clients need each client on its own isolated footing — its own data boundary, its own domain and mail, its own backup and restore window, and its own bill — without hand-managing a bespoke stack per client. Aeion Platform provisions a fresh tenant per client across Hetzner, Contabo, DigitalOcean, or Vultr, isolates each client's data at the PostgreSQL row level, backs each one up with Aegis point-in-time restore, and lets you share exactly the events you choose between your agency workspace and a client's workspace through a signed Digital Alliance — no per-client integration code.
The Multi-Client Problem
An agency or MSP operating software for a dozen clients faces the same structural tension every time. Each client wants isolation — their data must never be visible to another client, and ideally not even to another client's staff. Each client wants their own domain and, often, their own email on that domain. Each client needs a backup and disaster-recovery story you can actually stand behind when they ask. And each client is a separate commercial relationship that has to be billed and reported on its own terms.
One Tenant Per Client — Isolation, Domains, and Mail
Every client you host becomes its own tenant, and isolation is enforced at every layer rather than left to application logic:
Agency ↔ Client Sharing — Code-Free Digital Alliances
The one thing per-client isolation makes awkward is deliberate sharing — pushing a signal or a delivered artifact from your agency workspace into a specific client's separate workspace. Aeion handles that with Digital Alliances: two tenants sign a data contract, and only the events on an explicit whitelist flow between their real-time streams — no webhooks, no custom API integration per client.
Per-Client Billing and What to Expect
Each client tenant carries its own subscription plan and billing history, so a client's platform spend lives on that client's own invoice. Pricing is à la carte per module — a client activates only the modules it needs — with tiered modules gated by feature (for example, finance at $49 / $99 / $199 by tier) and an All-Access plan around $399/mo for a client that wants everything included; self-hosted VPS runs roughly $200–500/mo per tenant depending on the box. Subscription lifecycle is handled for you: upgrades grant entitlements immediately, cancellations keep a client live through the period they already paid for and then suspend cleanly, reactivation resumes suspended instances in one step, and a failed renewal payment moves the account to past-due and kicks off a dunning sequence.
What Aeion Platform Is Not (for Agencies)
- It is not a white-label branding engine. Each client gets its own domain (
platform_domains) and its own hosted mail, and the data is fully isolated — but the platform's job here is tenant infrastructure, not re-skinning the product per client. Treat the domain-and-mail isolation as the substance; don't promise a client a fully rebranded shell the platform doesn't claim to produce.
FAQ
Every table is keyed on `tenant_id`, and a client's data is queryable only by users holding that tenant's permissions. PostgreSQL row-level security is available on top for stricter separation. Nothing crosses between clients unless you create an explicit Digital Alliance data contract, and even then only whitelisted events cross — never a live query into another tenant's tables.
Provisioning a client tenant — server, domain, entitlements — runs as a background job queue with automatic 3-attempt retry on transient failures, and stuck instances are auto-polled and flipped to active once the provider confirms they're up. It's a provisioning flow rather than a per-client build project.
Yes. Each tenant carries its own custom domains, and MailService can provision a real Postfix + Dovecot + OpenDKIM mail server on the tenant's own VPS, generate DKIM keys, and verify MX / SPF / DKIM / DMARC before enabling mail. Those mailboxes auto-connect to the Inbox module.
Backups, WAL archive, PITR base, and verification snapshots write to your own BYOB S3-compatible bucket (AWS S3, Cloudflare R2, Wasabi, Backblaze B2, MinIO, or DO Spaces) using credentials only you hold. Aeion staff cannot access your clients' backups. Each client tenant has its own independent PITR window and weekly restore-and-verify run.
Yes, through a Digital Alliance data contract — for example, an uploaded campaign asset's `vault.document.created` event refreshing a live-preview panel in the client's separate workspace. It's push-based, read-only event forwarding on an explicit whitelist, deep-cloned and re-stamped with the consumer's tenant ID, with `system.*` / `platform.*` / `cron.*` hard-blocked. It is not a live cross-tenant query proxy.
Not today. Each client tenant carries its own subscription and billing history, so spend is visible per client — but there's no built-in cross-tenant billing aggregation or automated chargeback engine. Consolidating or re-allocating cost across clients is a manual reconciliation from the per-tenant invoices.
Yes — the platform runs anywhere Docker + PostgreSQL 17 + Redis 7 run (Hetzner, OVH, Linode, AWS, GCP, Azure, or bare metal). Provisioning is most optimized for Hetzner, but self-hosting is supported.
Tenant termination is reversible by default — the tenant flips to a terminated state and members are disabled, but Aegis backups, event-store history, and Aegis records survive so an accidental termination can be undone. A super-admin-only purge path (GDPR Article 17 erasure) exists for permanent, non-reversible deletion when a client requires it.
Every client on its own isolated tenant.
Per-client isolation + per-client domains and mail + per-client Aegis backup + code-free agency-to-client event sharing — provisioned in a job queue, not a build project.