Welcome

The only Next.js boilerplate your legal team won't reject

Most Next.js boilerplates get you a landing page and a Stripe button. This one gets you through SOC 2, GDPR, and your CFO's quarterly audit — without a two-week post-launch scramble.

If you've ever shipped a SaaS and then realized your audit log was just console.log(...) calls in CloudWatch, this boilerplate is for you.

What's actually in the box

This isn't a marketing list. Every item below is wired into the codebase, has a migration, a server action, a UI surface, and a rollback plan documented in the project's CLAUDE.md.

• Tamper-evident audit chain — append-only hash chain (SHA-256 linked, per-org, RLS + DB triggers + WORM flag) ready for SOC 2 / HIPAA reviewers.
• Idempotency layer — Idempotency-Key contract on any mutating endpoint, with request-hash mismatch detection, replay headers, and a 24h TTL cache.
• Evidence completeness scoring — generic red / amber / green bars for any audit/compliance entity, with seedable checklists.
• RGPD data export + 30-day account deletion — gzipped JSON archive, signed download link, daily cron for hard-delete, cancel-link grace window.
• Outbound + inbound webhooks — HMAC signed, retried, replayable from the dashboard, with per-endpoint replay-all-failed.
• LLM cost discipline — llm_usage ledger (cents, never floats), per-org daily/monthly budget caps with hard-block, versioned prompts, eval scoring.
• Subscription tiers + tier gates — <TierGate min="pro"> server component, server-action-level assertTier(), requireTier() for upsell rendering.
• Maintenance mode — global flag, edge-safe middleware, allow-list for health probes, optional ETA / status / changelog URLs.
• Saved views + document export (PDF + DOCX) — universal primitives, not domain-specific bespoke flows.

Stack

• Next.js 16, App Router, React 19, React Compiler.
• Tailwind CSS v4 (CSS-first, @theme), next-themes for dark mode.
• Drizzle ORM + PGlite (local) / Postgres (prod).
• NextAuth (current) → migrating to Better Auth (see architecture/auth).
• Stripe webhooks (current) + planned Paddle / Polar adapters.
• Sentry, PostHog, OpenTelemetry-ready.

Where to next

• Quickstart — clone → install → db:setup → dev. Four commands.
• Architecture — how auth, billing, and the database fit together.
• Compliance — the nine compliance primitives in detail.
• Deployment — Vercel, Cloudflare Workers, and env vars.