Full-Stack SaaS Engineer — Supabase/PostgreSQL Production Readiness

Senior Supabase/PostgreSQL Engineer for Multi-Tenant Education SaaS Production Audit Director’s Desk is a working multi-tenant web application for school arts programs, including band, chorus, orchestra, and theatre. The platform supports directors, students, and parents through role-based portals and includes communications, financial ledgers, forms, practice tracking, skills pathways, file uploads, and program-management tools. The application currently uses React/TypeScript, Supabase/PostgreSQL, Supabase Auth and Storage, Resend, Cloudflare, a custom domain, and a private GitHub repository synchronized with Lovable. It is already operating as a controlled school pilot. We are preparing it for additional organizations and an eventual commercial launch. This initial engagement is a paid, read-only production-readiness and security audit. It is not authorization for an immediate rewrite or migration. The selected engineer will: * Document the current application, deployment, and data architecture * Audit multi-tenant database design and Row Level Security * Review authentication, roles, memberships, invitations and account linking * Review Supabase Storage policies and organization file isolation * Examine service-role usage, edge functions, secrets and webhook security * Review database indexes, slow queries, pagination and scaling risks * Assess mass-email architecture and propose a queued, batched delivery system * Review development, staging and production separation * Assess CI/CD, monitoring, backups, restoration and rollback readiness * Identify risks by severity and recommend a phased remediation plan * Evaluate whether independent frontend hosting would provide a measurable benefit * Provide projected infrastructure requirements and cost assumptions Required qualifications: * Demonstrable production experience with Supabase and PostgreSQL * Strong React and TypeScript experience * Demonstrable experience designing and testing multi-tenant RLS policies * Experience with background jobs or message queues * Experience with transactional email and webhook processing * Experience with CI/CD, monitoring, backups, and load testing * Clear written communication and technical documentation Please include: 1. Two relevant production projects and your exact role in each 2. A description of a multi-tenant RLS system you have designed or audited 3. An anonymized example of an architecture, security, or audit deliverable 4. Your approach to testing cross-tenant data isolation 5. Your proposed scope, timeline, and fixed price for the initial audit 6. Two client references 7. Whether any work would be subcontracted 8. Your availability for a live technical interview The initial engagement should produce findings and recommendations rather than unapproved production changes. All accounts, code, infrastructure, documentation, and work product must remain under the client’s ownership and control.