Every kit on this page ships auth and Stripe. This is the only one where the AI layer is load-bearing rather than a demo route: OpenAI, Claude and Gemini behind one interface — GPT-5.6, Claude Opus 5 and Gemini 3.6 — reachable through direct provider APIs or OpenRouter, behind a server-only boundary that sends zero-data-retention payloads and fails over to another provider when one degrades, with a circuit breaker in front. Add LangChain orchestration, SSE streaming, prompt caching, a multi-agent registry, token and cost tracking where one credit equals one token, and a knowledge base for PDF, TXT and MD documents on pgvector with HNSW indexing. Nothing else here comes close on that axis.
It also refuses the usual either-or. The account-centric multi-tenant model gives business customers organisations, invitations, roles and admin dashboards, while credit packs, licence keys, multi-currency pricing and an installable PWA cover consumer products from the same codebase. An affiliate programme with cash commissions and configurable tiers — recurring or one-time — is built in, where every competitor sends you to a paid third-party service.
Two more things the field mostly ignores. It ships a Docker and Coolify path, so you can run the whole stack on a VPS at fixed cost rather than watching a serverless bill scale with your success. And it implements EU AI Act Article 50 disclosure, which stops being optional the moment you sell an AI feature into Europe. Underneath: Next.js 16, React 19, strict TypeScript, Tailwind v4 and shadcn/ui.
The operational plumbing is there too, which is where most kits thin out. Scheduled cron jobs and background workers ship as first-class modules — the thing you need on day three for usage rollups, dunning emails, digest sends and index rebuilds, and the thing you would otherwise bolt on with a third-party scheduler. Add API keys, a notification centre, a media library and caching, and the day-two work is already done.
It is also the one kit here built to be vibe-coded. The repository ships an agent workspace — rules, skills, instructions and subagents — so Claude Code or Cursor reads the architecture instead of inferring it from file names. In practice that is the difference between an agent that extends your billing logic correctly and one that invents a second, parallel version of it three folders away.
Then there is the part most kits skip entirely: somewhere to actually run the business. The platform admin console opens on total users, organisations, active subscriptions and MRR and ARR, with AI spend broken out by requests, tokens, cost and top users across today, seven and thirty days. Behind it sit twelve working sections — users, organisations with member limits, subscriptions by plan, referrals and affiliates with manual reversal, licences with revenue and expiry, dynamic roles, CMS, background jobs with run history, error logs, platform settings and a multi-locale changelog.
That is the difference between an admin panel and an operations console. Most kits give you a table of users; this one lets you reverse a fraudulent affiliate conversion, extend a licence, watch a cron handler's run history and read the error that broke it, without opening a database client or shipping a deploy.
The security posture is the other outlier, and it runs past the usual OWASP checklist — CSP headers, route-scoped rate limiting, RLS policies, CSRF, input sanitisation and Turnstile — into the part nobody advertises: the supply chain. pnpm only, a seven-day quarantine before a new dependency release is allowed in, lifecycle scripts off by default, signature verification at install, SHA-pinned CI and a zero-vulnerability audit gate that fails the build. No other kit in this benchmark treats its own dependency tree as an attack surface.
Testing is where the gap becomes almost unfair. One command spins up a disposable Supabase stack, seeds member, admin, owner and platform-admin personas, proves the product end to end and destroys the database. pgTAP covers schema, RLS and grants — the layer most kits never test at all — while Playwright drives the public site, both dashboards and all 43 admin pages, plus real Stripe, chat/SSE and document flows. The same gate runs WCAG 2.2 A/AA in light and dark, overflow at 320/768/1280, a Chromium/Firefox/WebKit matrix, visual baselines and Lighthouse budgets, on top of 640 unit tests and 68 accessibility and responsive tests.
Compliance is shipped rather than described. Article 50 transparency is implemented — AI-interaction notice, durable output marking, a public transparency page — and the operator paperwork comes as templates: Article 30 records of processing, an Article 35 DPIA scaffold, a breach runbook, a subprocessor and DPA register, an append-only Article 7 consent trail and an Article 15 export running to 28 sections.
The catch is the licence. $174 buys one project and twelve months of updates. Makerkit, supastarter, Achromatic and ShipFast all sell unlimited projects with lifetime updates at a comparable price. That is the one axis where it finishes last of the paid kits, and it is the strongest argument against buying here if you plan to ship a portfolio of products from a single purchase.
Buy it if you are building a real SaaS — AI features, paying teams, an affiliate channel, EU customers — and you want those wired on day one. Look elsewhere if one licence has to cover several projects.