ClickMasters Standard UK SaaS Architecture Stack
| Layer | Technology | UK GDPR / Compliance Reason | Monthly Cost (AWS eu-west-2) |
|---|---|---|---|
| Frontend | Next.js App Router + Tailwind + Clerk (auth) | Clerk EU region — auth data stays in EU. Server Components — personal data processed server-side. | Vercel: £0–£200 or self-hosted ECS: £80–£200 |
| API layer | Node.js/Fastify + Prisma + PostgreSQL RLS | Prisma + RLS: per-tenant data isolation enforced at DB level — UK GDPR Article 25. | ECS Fargate: £80–£400 |
| Database | RDS PostgreSQL Multi-AZ (eu-west-2) | Multi-AZ: FCA PS21/3 resilience. eu-west-2: data residency. Automated backups: data retention control. | db.t3.medium: £60–£120 |
| File storage | S3 (eu-west-2) + CloudFront | eu-west-2: personal data in files (documents, images). S3 bucket policies: per-tenant access control. | £5–£50 |
| GOV.UK Notify or SendGrid (EU) | GOV.UK Notify: NCSC approved, free for UK gov. SendGrid EU: Article 28 DPA available. UK GDPR email data residency. | GOV.UK Notify: free | |
| Billing | Stripe (UK entity, EU data) | Stripe Tax: UK VAT automation. Stripe EU: Article 28 DPA. PCI-DSS SAQ-A. | 1.5% + 20p per transaction |
| Observability | CloudWatch + X-Ray (eu-west-2) | eu-west-2: access logs in UK jurisdiction. 7-year retention: NHS DSP Toolkit standard. Immutable: FCA audit trail. | £20–£60 |
| Secrets | AWS Secrets Manager (eu-west-2) | No hardcoded credentials — Cyber Essentials. Automatic rotation. eu-west-2. | £0.40 per secret/month |
Multi-Tenancy Strategies — UK GDPR Comparison
| Strategy | How It Works | UK GDPR Isolation | ClickMasters Recommendation |
|---|---|---|---|
| Shared database + RLS | One DB, all tenants, RLS policies filter by tenant_id | Good — enforced at DB level | ✅ Default for most UK SaaS (< 1,000 tenants) |
| Separate schema per tenant | One DB, separate PostgreSQL schema per tenant | Better — schema isolation | Medium-large SaaS (1,000–10,000 tenants) |
| Separate database per tenant | Separate RDS instance per tenant | ✅ Strongest — DB-level isolation | NHS DTAC Article 9, FCA with strict data isolation requirements |
| Hybrid (shared + isolated) | Shared for most tenants, dedicated for enterprise/NHS | Flexible — match to tenant requirements | ✅ ClickMasters default for regulated SaaS (NHS/FCA enterprise tiers) |
UK SaaS Subscription Billing — Stripe Patterns
UK VAT: Stripe Tax (£20/month flat rate) calculates UK VAT automatically — 20% standard rate, 0% for zero-rated services. Stripe Tax is cheaper and more reliable than manual VAT calculation.
B2B invoices: Stripe Invoicing (PDF invoices with UK company registration number, VAT number) — UK businesses require invoices, not just receipts.
Annual vs monthly: Stripe subscriptions support both. UK SaaS: offer monthly (lower commitment) and annual with 2-month discount — annual improves cash flow and reduces churn.
Trial periods: Stripe trial handling — 14-day trial then card charge. UK GDPR: explicit consent to charging after trial required (not hidden small print).
UK Companies House integration: B2B onboarding — verify company number at signup via Companies House API (prevents fake signups, confirms VAT registration).
UK SaaS billing requires UK VAT automation, B2B invoice generation, and GBP settlement. ClickMasters Stripe patterns: