StackPrism
SaaS and B2B

Tech stack for an enterprise SaaS with SSO and audit logs (2026)

HR analytics platform for large companies, designed by StackPrism from one sentence: 14 components, a reason for each, and the live checks that watch them.

The stack

  • Microsoft Entra ID
  • Okta
  • Next.js
  • Amazon ECS
  • Node.js
  • Amazon S3
  • Amazon ElastiCache
  • Amazon SQS
  • Amazon OpenSearch Service
  • Amazon RDS
  • AWS Secrets Manager
  • Amazon CloudWatch
  • Sentry
EnterpriseSSOAWSUpdated
The idea someone typed
“An HR analytics platform sold to large companies. Each customer is its own tenant with isolated data, their IT team connects Okta or Azure AD for SAML single sign-on and SCIM user provisioning, and every admin action lands in an audit log they can export.”

Their answers on the constraints step

Expected scale
10k+ users
Already uses
AWS

Make it yours. Open this stack in the editor to check its health, harden it and hand it to your coding agent. No sign-up, nothing to generate.

Start from this stack
goes down

Select a component to see what it does and what it connects to, or pick one above to see what breaks if it goes down. Pinch or use the buttons to zoom.

Why this stack

Everything runs in the company’s existing AWS account. A Next.js frontend talks to a Node.js API that keeps each tenant’s data in Amazon RDS for PostgreSQL, caches sessions in ElastiCache for Redis, reads credentials from Secrets Manager and encrypts sensitive fields with KMS. Customers’ IT teams sign their people in through their own Okta or Azure AD over SAML. Slow work such as exports goes onto SQS, and workers on ECS Fargate write the export files to S3 and index admin actions in OpenSearch, so the audit log can be searched and exported. CloudWatch watches the services and Sentry reports errors.

Why each piece

All 14 components on the diagram: what each one does, what it talks to, and what stops if it goes down.

  1. Azure AD

    SAML IdP. Calls Node.js API (saml).

    Nothing else on the diagram depends on it.

  2. Okta

    SAML IdP. Calls Node.js API (saml).

    Nothing else on the diagram depends on it.

  3. Next.js Frontend

    In AWS

    Analytics UI. Calls Node.js API. Called by Sentry (tracks).

    Nothing else on the diagram depends on it.

  4. ECS Fargate Workers

    In Core Services

    Async job workers. Calls Amazon S3 (writes) and Amazon OpenSearch Service (indexes).

    Nothing else on the diagram depends on it.

  5. Node.js API

    In Core Services

    Main backend. Calls Amazon RDS PostgreSQL (queries), Amazon ElastiCache for Redis, AWS SQS (enqueues), AWS Secrets Manager (reads) and AWS KMS (encrypts). Called by Next.js Frontend, Okta (saml), Azure AD (saml) and Sentry (tracks).

    If it goes down, 3 of 13 components stop working.

  6. Amazon S3

    In AWS

    Export artifacts. Called by ECS Fargate Workers (writes).

    If it goes down, 1 of 13 components degrades.

  7. Amazon ElastiCache for Redis

    In AWS

    Session cache. Called by Node.js API.

    If it goes down, 1 of 13 components degrades.

  8. AWS SQS

    In AWS

    Job queue. Called by Node.js API (enqueues).

    If it goes down, 1 of 13 components degrades.

  9. Amazon OpenSearch Service

    In Databases

    Audit log search. Called by ECS Fargate Workers (indexes).

    If it goes down, 1 of 13 components degrades.

  10. Amazon RDS PostgreSQL

    In Databases

    Tenant data store. Called by Node.js API (queries).

    If it goes down, 4 of 13 components stop working.

  11. AWS Secrets Manager

    In Security

    Secrets store. Called by Node.js API (reads).

    If it goes down, 1 of 13 components degrades.

  12. AWS KMS

    In Security

    Key management. Called by Node.js API (encrypts).

    If it goes down, 1 of 13 components degrades.

  13. Amazon CloudWatch

    In AWS

    Logs and metrics. Calls Core Services (monitors).

    If it goes down, 2 of 13 components degrade.

  14. Sentry

    Error tracking. Calls Node.js API (tracks) and Next.js Frontend (tracks).

    If it goes down, 2 of 13 components degrade.

When this stack fits

  • Buyers are large companies whose security reviews ask for SAML SSO, an audit log and isolated data.
  • You already run on AWS and want everything in one account, under one set of access controls.
  • Exports and indexing are heavy enough to need their own workers.

When to pick something else

  • You’d rather not build SAML and SCIM yourself: a service such as WorkOS handles both and plugs into the same API.
  • Customers want a database of their own: this diagram has one RDS database, so per-customer databases need a different data layer.
  • Customers are small teams: the B2B SaaS example on managed services goes live much sooner.

What you need to build this

14 components across 8 areas of the stack.

Build it with your AI agent

Hand the stack to Claude Code, Codex, Cursor or any coding agent as a brief: how it connects, install steps and a build plan.

Frontend1

  • Next.js Frontend

    Analytics UI

    npm install next

    Docs

Backend & APIs2

  • Node.js API

    Main backend

    Docs

  • ECS Fargate Workers · Amazon ECS

    Async job workers

    Docs

Data1

  • Amazon RDS PostgreSQL

    Tenant data store

    Docs

Cache & queues2

  • Amazon ElastiCache for Redis

    Session cache

    Docs

  • AWS SQS · Amazon SQS

    Job queue

    Docs

Search1

  • Amazon OpenSearch Service

    Audit log search

    Docs

Storage & CDN1

  • Amazon S3

    Export artifacts

    Docs

Hosting & infra4

  • AWS Secrets Manager

    Secrets store

    Docs

  • AWS KMS

    Key management

  • Okta

    SAML IdP

  • Azure AD · Microsoft Entra ID

    SAML IdP

    Docs

Observability2

  • Amazon CloudWatch

    Logs and metrics

    Docs

  • Sentry

    Error tracking

    npm install @sentry/nextjs

    Docs

Install

npm install next @sentry/nextjs

SDKs only. Pick your own database driver or ORM.

See all 30 example stacks