# Building software for Indian SMBs

What it costs and how it is built: custom CRM pricing in India, multi-tenant architecture for multi-branch businesses, auth that works for native apps from day one, and the QA process we run before launch.

The posts in this guide are written from builds we have shipped: a gym-management platform with biometric attendance, a WhatsApp CRM, an offline-first inventory system. They cover the decisions that decide whether a custom build is worth it, how to structure it so a second branch or a mobile app does not mean a rewrite, and the mistakes that show up when apps are generated rather than engineered.

Start with the cost post if you are deciding between building and buying. Start with the architecture posts if you have already decided to build.

## In this guide

1. [How much does it cost to build a custom CRM in India?](https://botbrained.com/blog/custom-crm-cost-india/index.md): An honest breakdown of what drives custom CRM cost in India: scope, integrations and maintenance, plus when a bespoke build is worth it and when a product like Pariq is the smarter call.
2. [Shopify vs a custom storefront for Indian D2C brands](https://botbrained.com/blog/shopify-vs-custom-storefront-india/index.md): A practical breakdown of when Shopify is the right call for an Indian D2C brand and when a custom or headless build pays off, covering payments, COD, scale, and total cost.
3. [Multi-tenant SaaS architecture for Indian SMBs, explained](https://botbrained.com/blog/multi-tenant-saas-architecture-indian-smbs/index.md): A practical breakdown of multi-tenant SaaS architecture (row-level, schema-per-tenant, and database-per-tenant models) and why RLS-based isolation matters most for Indian franchise and multi-branch businesses.
4. [Why we build every app native-app-ready from day one](https://botbrained.com/blog/native-app-ready-architecture-from-day-one/index.md): Most web apps assume the browser is the only client. We design every app so a mobile app can plug in later without a rewrite: token auth, API-first, no server-only shortcuts.
5. [Single sign-on across a product suite, explained](https://botbrained.com/blog/single-sign-on-across-product-suite/index.md): Why we built one login across our whole product suite (sign in once, move between products, sign out everywhere) and the principles that keep it secure without a heavyweight identity provider.
6. [Bearer JWT vs cookie sessions: why we build token-only](https://botbrained.com/blog/bearer-jwt-vs-cookie-sessions-token-only/index.md): A practitioner's case for Bearer JWT over cookie sessions: token-only auth makes every app native-ready by default, but you have to get storage, expiry, and refresh right.
7. [Metered billing vs per-seat pricing for SaaS](https://botbrained.com/blog/metered-billing-vs-per-seat-pricing-saas/index.md): Per-seat pricing charges by the number of users; metered billing charges by what you actually consume. For most Indian SMBs, a small base fee plus a usage wallet is the fairer model.
8. [How biometric attendance works in modern gym software](https://botbrained.com/blog/biometric-attendance-gym-software/index.md): A practitioner's walkthrough of how fingerprint readers, a desktop bridge, and cloud software combine to track gym attendance across one branch or many, and where the real work hides.
9. [How we QA a CRM before it touches a customer: a 254-point pre-launch sweep](https://botbrained.com/blog/crm-qa-process-before-launch-254-point-sweep/index.md): Before any CRM we build reaches a customer, it goes through a 254-point pre-launch quality sweep. A look at what that covers, and how to get the same rigour on your product.
10. [The most common security mistakes in AI-built apps](https://botbrained.com/blog/security-mistakes-ai-built-apps/index.md): AI coding tools ship working apps fast, but they also ship predictable security holes: secrets in the client bundle, open databases, missing auth, and exposed storage. Here's what to check and fix.
11. [How to keep secrets out of your frontend bundle](https://botbrained.com/blog/keep-secrets-out-of-frontend-bundle/index.md): Anything shipped in your JavaScript bundle is public. Here is what is actually safe to expose, why API keys leak, and how to audit your own build before a key ends up on Pastebin.

[Talk to BotBrained](https://botbrained.com/#contact)