Building an HR SaaS alone: flat pricing vs per-user billing

This is the story of a side project that grew from one question: why does HR software charge per employee instead of a flat monthly price? Most HR tools, BambooHR, Personio, Factorial, bill per employee, so every hire pushes the invoice up. After 15+ years in backend development - PHP, Laravel, Symfony, WHMCS - I decided to build my own answer in my free time. The result is HREvio, an HR platform for SMBs with one fixed monthly price and no per-user fees. I shipped the MVP in about 4 months, working evenings and weekends.

Per-user pricing sounds fair until you do the math. At 50 employees BambooHR, HiBob or Personio cost somewhere around 250 to 1,250 euro a month. Hire one more person and the invoice goes up again. That model hits SMBs hardest: companies of 5 to 250 people, where every hire is already a real budget decision.

So I built a flat-price BambooHR alternative with three plans. The price you sign up for is the price you pay. No surprises in the next invoice when you onboard a new colleague.

Flat pricing vs per-user pricing in numbers

#

Starter covers up to 25 employees, Standard up to 100, Professional up to 250. Prices are without VAT. With per-user billing the last column is fixed and the monthly price grows with the team. With a flat plan it's the other way round: the monthly price stays and the cost per person drops as you hire. At 50 people that's 49 euro against roughly 250 to 1,250, so 5 to 25 times cheaper.

How a single developer ships a SaaS in 4 months

#

Five years ago this would have been a team project. Today one person can do it, for two reasons.

Open-source packages are good now. Multi-tenancy, permissions, audit logs, encryption: all solved by mature libraries. You still have to put them together properly.

And AI is a second pair of hands. It writes boilerplate, helps with tests, drafts docs. The boring 60% of the work goes a lot faster.

The other 40% is still on you: architecture, edge cases, security, business logic. That's where experience matters. AI is fast, but it doesn't understand your product. If you want the short version of who builds and runs the thing, it's one developer, and the about page says so plainly.

The stack

#

I won't list exact version numbers here on purpose, no need to give attackers a free map of my dependencies. But the shape of the system is no secret.

The backend is Laravel with strict types in every file and small Action classes instead of huge services. The frontend is Livewire in CSP-safe mode, Tailwind CSS and a bit of Alpine.js. No React SPA, no extra build complexity. The database is PostgreSQL. Role-based permissions and a full audit trail of important actions were there from day one.

In production it's Docker and Traefik, per-subdomain Let's Encrypt certificates, all behind Cloudflare. When traffic grows I can add request-handling containers without rewriting anything.

No Kubernetes, no microservices, no event-sourced anything. One app, one database, one Redis. That's enough for SMB SaaS and will be enough for a long time. Adding complexity before you have paying customers is the easiest way to waste your own time.

Multi-tenancy in one database

#

I went with the boring solution: every company is fully isolated inside one shared database. For SMB SaaS it's the most reliable approach I know. Cheap to run, simple to back up, easy to reason about. The tricky part is making sure that data from company A can never end up in front of a user from company B. That's the line you don't cross, and I treat it as a hard rule that the test suite has to prove on every change.

GDPR by default

#

The product processes EU employee data, so GDPR has to be built in from day one, not bolted on later:

• Salary and other sensitive fields are encrypted at rest.
• The activity log automatically hides encrypted fields, so the audit history can't be used as a side channel to leak PII.
• Legal acceptance (terms, privacy, DPA) is tracked with IP and timestamp on every accept.
• Self-hosted fonts, no Google Fonts CDN. reCAPTCHA loads only when the user actually clicks into the form.

Nothing fancy. It's what any HR product selling in the EU should be doing in 2026. The basics of online security haven't changed that much over the years. They still hold, and they still get skipped by people who should know better.

Tests, the not-so-secret weapon

#

More than 1,600 automated tests run on every commit, in three layers. Unit tests cover every Action and value object. Feature tests cover every Livewire component and boot the full Laravel stack against a real PostgreSQL container. Not SQLite: "test passes, production breaks" is one of the most expensive bugs you can write. End-to-end tests run the key user flows (signup, invite, leave request, approval) through a real browser against the full app.

Tenant isolation is asserted explicitly. "User from company A can't see data of company B" is a test, not a hope. Nobody brags about this part, and it's the main reason I can refactor without fear and let AI touch the code without panic.

What's left - the "small" part

#

The product works. The tests are green. The infrastructure is solid. The encryption is encrypting. What's left is technically very minor: I just need to find customers, convince them to give me money, support them, write content, do marketing, answer emails, run sales calls, fix the things they'll inevitably break in ways I didn't anticipate, and somehow keep them so happy that they tell their friends.

Honestly, after building the whole thing alone, this part felt like a small detail at first. Then I sat down with a cup of coffee, opened the marketing tab, and realized that "small" was doing some of the heaviest lifting in the entire project. Turns out you can't composer require customers. I checked.

One thing I do believe: the gap between what a senior solo developer can ship in 2026 and what a 50-person SaaS company can ship has shrunk a lot. Honest pricing and lean products are about to put serious pressure on per-seat billing. The old "charge per user forever" model isn't going to age well.

FAQ

#

If per-user HR pricing has been bothering you, take a look at HREvio - flat-price HR software for SMBs. Three plans, fixed monthly price, 30-day free trial, no credit card needed. Honest feedback from a real human (me) included.