Skip to content

ADR-0003: Kinde for Authentication and Multi-Tenancy

Status: Accepted Date: 2025-01-15 (Estimated) Deciders: GetCimple Team Tags: architecture, security, authentication, multi-tenant

Context

GetCimple requires authentication and multi-tenancy for a SaaS platform serving Australian businesses with boards. Key needs:

Requirements: - Multi-tenant architecture (orgs with multiple users, users in multiple orgs) - Role-based access control (Director, Manager, Staff) - Australian company preferred (data sovereignty considerations) - SSO/OAuth 2.0 support - MFA for compliance - Organization/tenant management - Simple developer experience - Startup-friendly pricing

Constraints: - Must integrate with Supabase backend (JWT validation) - Australian data residency preference - Budget: <$50/month for MVP authentication - 3-person team (no time to build custom auth)

Options Considered

Option A: Kinde

Description: Australian authentication and multi-tenancy platform with built-in organizations, roles, and SSO.

Pros: - ✅ Australian company: Based in Australia, understands local compliance needs - ✅ Multi-tenancy built-in: Organizations, roles, user management out-of-the-box - ✅ Simple pricing: $25/month for up to 1000 MAU (Monthly Active Users) - ✅ Excellent DX: SDKs for React, simple integration - ✅ MFA included: Required for ACSC Essential 8 compliance - ✅ SSO support: Can add enterprise SSO later - ✅ OAuth 2.0 / OIDC: Standard protocols, works with Supabase - ✅ Organization switching: Users can belong to multiple orgs - ✅ Custom roles: Define Director, Manager, Staff roles - ✅ Stripe billing integration: (verify current alpha/beta status)

Cons: - ❌ Smaller vendor (less mature than Auth0/Okta) - ❌ Fewer integrations than larger platforms - ❌ Australian data center specifics unclear (need to verify) - ❌ Some features in beta (Stripe integration)

Estimated Effort: 2-3 days integration

Option B: Auth0

Description: Enterprise authentication platform by Okta with comprehensive features.

Pros: - ✅ Industry-leading platform - ✅ Comprehensive features (SSO, MFA, organizations) - ✅ Extensive integrations - ✅ Proven at scale

Cons: - ❌ Expensive: $240/month minimum for organizations feature - ❌ US company (data sovereignty concerns) - ❌ Complex pricing (per MAU, feature add-ons) - ❌ Over-engineered for MVP needs - ❌ Steeper learning curve

Estimated Effort: 3-5 days integration

Option C: Supabase Auth

Description: Built-in authentication in Supabase with OAuth providers.

Pros: - ✅ Included free with Supabase - ✅ OAuth 2.0 support - ✅ Simple integration (already using Supabase) - ✅ Row Level Security integration

Cons: - ❌ No multi-tenant management: Must build org management manually - ❌ No SSO: Limited to email/password and OAuth providers - ❌ Basic role management (must implement custom RBAC) - ❌ No organization switching features - ❌ Additional development effort (2-3 weeks for multi-tenancy)

Estimated Effort: 3-4 weeks (building multi-tenancy layer)

Option D: Clerk

Description: Modern authentication platform with React-first design.

Pros: - ✅ Excellent React integration - ✅ Organizations feature available - ✅ Beautiful pre-built UI components - ✅ Good DX

Cons: - ❌ $25/month + $0.02 per MAU (gets expensive quickly) - ❌ US company - ❌ Relatively new (less proven) - ❌ Limited Australian market presence

Estimated Effort: 2-3 days integration

Decision

We chose: Option A - Kinde

Rationale: 1. Australian company: Aligns with target market and data sovereignty philosophy 2. Multi-tenancy built-in: Organizations, roles, user management saves 3-4 weeks of development 3. Cost-effective: $25/month for up to 1000 MAU is startup-friendly and scales reasonably 4. Perfect fit for use case: Designed exactly for multi-tenant B2B SaaS (our model) 5. Compliance ready: MFA, audit logs, organization isolation support ACSC Essential 8 6. Fast integration: 2-3 days vs 3-4 weeks building on Supabase Auth 7. Future-ready: Can add SSO for enterprise customers post-MVP

Key Trade-offs Accepted: - We're accepting smaller vendor risk because Kinde's OAuth/OIDC implementation is standard (can migrate to Auth0/Okta later if needed) - We're accepting some beta features (Stripe integration) by verifying stability before use - We're trusting Australian datacenter claims (need to verify and document)

Consequences

Positive

  • ✅ Development velocity: 3-4 weeks saved by not building custom multi-tenancy
  • ✅ Local alignment: Australian vendor understands our market and compliance needs
  • ✅ Complete auth solution: Organizations, roles, MFA, audit logs all included
  • ✅ Easy user experience: Pre-built login UI, smooth org switching
  • ✅ Compliance support: MFA required for Directors satisfies ACSC Essential 8
  • ✅ Supabase integration: JWT validation straightforward via Supabase functions
  • ✅ Billing integration: Stripe connection simplifies subscription management (verify status)

Negative

  • ⚠️ Vendor maturity: Kinde less proven than Auth0/Okta (acceptable for MVP)
  • ⚠️ Feature parity: Some enterprise features (SAML SSO) may lag behind larger vendors
  • ⚠️ Data residency verification needed: Must confirm Australian datacenter location
  • ⚠️ Migration complexity: Switching auth providers later requires user migration effort

Risks

Risk Likelihood Impact Mitigation
Kinde has service outage affecting login LOW HIGH Monitor Kinde status page; implement session caching; acceptable downtime for MVP; consider multi-auth post-MVP
Kinde pricing increases significantly MEDIUM MEDIUM Standard OAuth/OIDC allows migration to Auth0/Okta; estimate 2-week migration effort; lock in annual contract if pricing concerns arise
Australian datacenter not actually in Australia LOW HIGH Verify with Kinde sales/support; document data residency guarantees in contract; audit via API responses
Stripe integration bugs (if in beta) MEDIUM LOW Verify beta stability before use; manual invoicing fallback for MVP; delay billing integration if unstable

Compliance Note

ACSC Essential 8 Impact: - Relevant Control: Multi-Factor Authentication (Maturity Level 2) - Requirement: MFA for all users accessing important data repositories - How Kinde Supports: Built-in MFA (SMS, authenticator app, email codes) - Implementation: Enforce MFA for Director and Manager roles

Australian Data Residency: - User Auth Data: [[NC:kinde-1 @alice]] Verify: Where does Kinde store authentication data? Australian datacenter? - Session Data: JWT tokens signed by Kinde, validated client-side and server-side - Guarantees: Need to document Kinde's data residency SLA in contract

Audit Trail: - Kinde provides audit logs for authentication events - Integration needed: Sync Kinde audit events to Supabase for compliance reporting

Implementation Notes

Prerequisites: - Kinde account created - Application configured in Kinde dashboard - Callback URLs configured for Cloudflare domains - Environment variables set (KINDE_CLIENT_ID, KINDE_CLIENT_SECRET, KINDE_DOMAIN)

Integration Points: - Frontend (React): @kinde-oss/kinde-auth-react SDK - Backend (Supabase): Validate Kinde JWT via Supabase Edge Functions - Database (RLS): Use Kinde user_id in Row Level Security policies - Billing (Stripe): Kinde organizations mapped to Stripe customers

Monitoring: - Track successful vs failed login attempts - Monitor MFA enrollment rates (target: 100% for Directors) - Alert on unusual authentication patterns (brute force attempts)

Documentation Updates Needed: - ✅ Authentication flow in authentication-mvp.md - ✅ Role definitions in database-design-mvp.md - ✅ Integration guide in tech-stack-mvp.md

Revisit

Revisit By: 2025-06-01 or after 500 active users Blast Radius: CRITICAL - Affects all user authentication, authorization, multi-tenancy

Conditions for Revisit: - Kinde service reliability < 99.5% uptime - Australian datacenter verification fails - Pricing increases beyond startup budget - Enterprise customers require SAML SSO (Kinde doesn't support or too expensive) - Security incident related to Kinde platform

Next Review: 2025-04-01 (verify Australian datacenter location and MFA adoption rates)

References

Version History

Version Date Author Changes
1.0 2025-10-20 Claude Initial ADR capturing historical decision + [[NC:kinde-1]] marker for datacenter verification