Customer-Managed Encryption Keys: Envelope Encryption and Real Revocation Time
How envelope encryption with a customer's KMS key works, how long revocation really takes, and a lab measuring AES-GCM cost and what associated data prevents.
All guides
Twenty guides in four topics, newest first. Each topic page suggests a reading order: multi-tenant architecture, billing and entitlements, security and identity, and operations. Guides with a runnable program are also listed on the labs page.
Entitlements for Subscription Plans: Data Model, Caching, and Stale Permissions
Move plan checks into data, cache them safely, and enforce seat limits where they cannot be exceeded. A lab shows how long one lost invalidation message keeps a server wrong.
Failed Payments and Dunning: Declines, Retries, Access States, and a Tested Policy
Which declines to retry, how to limit access while a payment is overdue, what to tell customers, and a tested Go state machine that handles duplicate payment events.
Usage Metering Without Lost or Double-Billed Events: Where to Deduplicate
Design a metering pipeline from event to invoice, and see a lab in which the popular 'set a Redis marker first' pattern lost about 1% of billable usage.
Subscription Proration in Practice: Month Lengths, Rounding, and Plan Changes
Proration is simple arithmetic plus policy. A lab computes one upgrade for every 2026 month and shows where 30-day and 365-day shortcuts change the invoice.
Stripe Webhooks Out of Order: Why created Timestamps Fail and What to Do Instead
Stripe may deliver events late, twice, or out of order. A lab replays 40,000 events through five handlers; only fetching the current object kept every subscription correct.
Preventing Cross-Tenant Data Leaks: Structure, Database Policies, and Probes
Where tenant data leaks come from, which controls catch each path, and a lab in which a popular tenant_id linter missed three unsafe queries and a structural rule caught them.
Shared Tables, Schema per Tenant, or Database per Tenant: Choosing a PostgreSQL Isolation Model
How the three PostgreSQL tenant isolation models differ in leak risk, connections, migrations, and restores, including what per-tenant point-in-time recovery really requires.
Per-Tenant Rate Limiting: Containing Noisy Neighbors in a Shared API
Why a global rate limit hurts the customers it should protect, how a per-tenant token bucket works, and a lab that compares both under the same flood.