Builder account control plane

In scope

Builder account/profile, team users and roles, communication preferences, authentication/session state, BuildWithHQ subscription and Stripe reconciliation, SaaS portfolio, shared resource pools, domains, API clients, backups/destinations, integrations, and audit history.

Out of scope

The builder-account portal is not the SaaS application’s end-user CRM/product database, end-user subscription ledger, direct SQL admin UI, or the visual page/template builder itself.

Request boundary

The React/browser layer does not talk directly to SQL Server or Stripe. A backend API validates identity, injects CustomerAccountId/BuilderUserId/SaaSAppId context, checks authorization, maps routes to stored procedures/services, and converts failures into safe responses.

Data mutation rule

Use controlled stored procedures/service roles rather than direct browser-facing table DML.