Five years inside a vertical SaaS platform

The situation

A vertical SaaS platform serving about 2,200 auto repair shops, with multiple users inside each shop. Real customers, real daily usage, and a product that businesses ran their whole day on.

I joined as Director of Development and was promoted to CTO in April 2021. I stayed through February 2026 and wrote production code the entire time.

What I walked into was a system that mostly worked and could not be trusted. Uptime sat around 98 percent. That sounds close to fine until you convert it: roughly a full working day of outage every month, for shops that cannot write an invoice while you are down. When something broke, the mean time to recovery was about six hours. Shipping a fix took about four hours of deployment. Automated test coverage was 3 percent, so nobody could tell the difference between a safe change and a lucky one.

What I changed, and the order it has to go in

Below is the work and the sequence it depends on. Most of these changes do not survive being attempted early, and the dependencies are the part worth reading if you are deciding who to put in charge of your platform.

Stability comes first, because nothing else is measurable without it. Uptime went from about 98 percent to 99.95 percent. HTTP 500 errors dropped about 85 percent. Mean time to recovery fell from about six hours to under ten minutes, which is a monitoring and rollback result before it is a code result.

Then the safety net, because speed without it is just faster breakage. PHPUnit coverage went from 3 percent to 38 percent. Not 90. Enough to make the next change defensible.

Then delivery speed, which the first two steps earn. Deployment time went from about four hours to 15 minutes. A four hour deploy is not a tooling problem, it is a confidence problem, and confidence is what the coverage and the rollback path bought.

Then the backlog, because by that point it is safe to touch. More than 300 priority P2 and P3 issues closed in six months.

Then architecture, last. Substantial portions of the monolith were modernized into event driven services, alongside zero downtime migrations to PHP 8, MySQL 8, and AWS. Zero downtime is the whole point of that sentence. The platform’s 2,200 shops did not experience the rewrite.

And compliance runs in parallel, because it has its own clock. SOC 2 Type II and PCI DSS readiness, led through successful validation.

What it cost, and what it returned

I led 12 or more engineers and about $3 million in annual technology and engineering spending. Across the same period the business scaled revenue from about $800,000 to about $6 million.

The revenue line is a company result with many owners, and it is listed here as context rather than as a claim about me. The engineering numbers above are the ones I own.

What I would not have done

I would not have started with the rewrite.

The event driven architecture is the item on this list that a board understands and a founder gets excited about, and it is the one that had to come last. Doing it first, on 3 percent test coverage, with a six hour recovery time and no reliable deploy, means you have taken the one system your customers depend on and removed the only thing keeping it upright, which is that everyone knows how it currently behaves.

The unglamorous sequence is the actual expertise. Stability, then a safety net, then speed, then debt, then architecture. Most of the value in the five years above came from doing the boring parts in the right order.