Designing and building a security platform
Layerd protects websites and APIs with WAF, bot management, DDoS protection, rate limiting and SSL, and secures APIs and AI agents too. We designed the product UI with Claude Design and built the whole platform: a customer console, an admin console, the APIs behind them and a multi-tenant data layer.
- Industry
- Cybersecurity SaaS
- Product
- Web, API & AI-agent security
- Our role
- UI design, architecture, backend, frontend, QA
- Platform
- Customer console + admin console
What the platform needed
- One platform to protect websites and APIs for many customers: WAF, bots, DDoS, rate limiting, CSP and SSL.
- Every customer's data kept fully separate, with internal staff tools kept out of the customer console.
- Security settings that reach the WAF engines the moment a customer saves them.
- Room to grow into new products: security for APIs, and for AI agents calling tools through MCP.
- A clear, consistent interface for dense security data that security teams use every day.
Designed and built end to end
- A complete product UI and design system, designed with Claude Design
- A customer console and a separate, audited admin console, both on one platform
- Each customer isolated in its own database and deployment
- Configuration changes that reach WAF engines instantly
- Two product lines beyond core protection: API Security and MCP Security
Two consoles, one platform
A customer console for security teams and a separate admin console for the people who run the platform.
Customer security console
73 screens covering WAF configuration, OWASP CRS rule overrides, custom and firewall rules, rate limiting, bot management, DDoS protection, CSP and SSL/TLS.
Detection analytics
Dashboards and event logs for WAF, bot, firewall and rate-limit traffic, backed by ClickHouse, plus posture findings, threat insights and a security score.
API Security suite
17 screens: API discovery and catalogue, schema validation and spec drift, auth checks, DLP, GraphQL hardening, anomaly detection, risk scoring and SIEM export.
MCP & AI-agent security
11 screens to watch AI agents calling tools over MCP: endpoints, tools, agent reputation, sessions, alerts, a policy library and reports.
Admin console
A separate staff console to provision tenants and organisations, manage licences and SKUs, configure each tenant, and support customers through audited, single-use impersonation.
Access, alerts & audit
Role-based access with 58 granular permissions, SSO, IP restrictions, API keys, alert rules by email, in-app and webhook, and exportable audit logs.
Designed with Claude Design
- The full product UI designed with Claude Design, from the customer console to the admin console
- One shared design system: a single token layer for colour, type and spacing, built on Tailwind CSS and shadcn/ui
- 65 screens mocked up and reviewed before development started
- Dense security data made readable: dashboards, world traffic maps and fast virtualised tables
- Every colour pairing contrast-checked, with automated accessibility checks in CI
Tested, accessible, secure
- 1,250+ automated test files across the four apps, with Vitest, Jest and Supertest
- CSRF protection, security headers and secret scanning in CI
- One shared error-code catalogue across the APIs and consoles
- CSV import and export hardened against spreadsheet formula injection
- Ready for multiple languages on both the frontend and the API
How it's built
Five parts: a customer API and console, an admin API and console, and one shared, versioned database schema.
Database per tenant
Each customer runs on its own PostgreSQL database and deployment, so tenant data is isolated by design.
One versioned schema
All 117 models and 61 migrations live in a single versioned package, with a CI check that blocks breaking changes.
Secure service calls
Tenant APIs and the admin API talk over signed JWTs, and tenant database credentials are encrypted with AES-GCM.
Instant config rollout
Each config section saves on its own, and the save and its reload signal commit in one transaction, pushed to WAF engines through PostgreSQL LISTEN/NOTIFY with no polling.
Background work
Redis and BullMQ queues for notifications, plus background jobs for SSL certificate provisioning and renewal.
Tools we used
Building a complex SaaS platform?
Product design, multi-tenant architecture, analytics at volume: tell us what you are working on and we will reply within one working day.