# Eleven open-source Go packages for SaaS backends

> Tenancy, permissions, approvals, audit logs, settings, feature flags, translations, media, notifications, backups and an admin panel, as MIT-licensed Go modules.

- URL: https://byteminus.com/blog/go-packages-for-saas-backends/
- Published: 2026-10-24
- Author: Byte Minus Engineering (Byte Minus)
- Topics: Open source, Go, PostgreSQL, Multi-tenant SaaS

**In short:** Byte Minus has released eleven MIT-licensed Go modules for multi-tenant SaaS backends — go-tenancy, go-permission, go-approvals, go-activitylog, go-settings, go-featureflags, go-translatable, go-medialibrary, go-notifications, go-backup and go-admin. Each needs Go 1.26 or later, those that store data use PostgreSQL through pgx v5, and all are at v0.2.0 on github.com/byteminus.

Every multi-tenant product ends up writing the same layer before it writes anything that is actually its own: who belongs to which tenant, who may do what, who changed what, which settings and flags apply to whom, where uploads go, how people are told things, and how it all gets backed up. In Laravel there is a well-worn package for most of it; in Go it usually gets written from scratch, product by product.

So we have released eleven of those pieces as separate Go modules, under the **MIT license**, each installed on its own.

```bash
go get github.com/byteminus/go-tenancy
```

Every module needs **Go 1.26 or later**. The ones that store data do it in **PostgreSQL through pgx v5**. All are tagged **v0.2.0**: usable today, and — as a v0 Go module — free to change their API before 1.0, so pin the version.

## Who belongs, and who may do what

**[go-tenancy](https://github.com/byteminus/go-tenancy)** is the foundation: tenants with slugs and custom domains, memberships with roles and a last-owner guard that holds under concurrency, and single-use invitations whose tokens are stored only as hashes. HTTP middleware resolves the tenant of each request, and PostgreSQL row-level security keeps tenants apart inside shared tables — integrity lives in the database, not in every query remembering a `WHERE` clause.

**[go-permission](https://github.com/byteminus/go-permission)** answers the next question with one call:

```go
ok, err := authz.Can(ctx, alice, "posts.publish", "team-1")
```

Permissions group into roles, roles are assigned per tenant or team, and wildcards like `posts.*` work. Rules that depend on the resource itself — "authors may edit their own posts" — are typed policy functions that can call the role checks. Effective permissions are cached, and the cache is invalidated across every instance through PostgreSQL `LISTEN/NOTIFY`.

**[go-approvals](https://github.com/byteminus/go-approvals)** runs multi-step workflows: an expense approved by a manager and then by finance, an access request that expires if nobody answers. Steps can need any, all or a quorum of approvers; separation of duties is on by default; requests snapshot their steps so a deploy never breaks work in flight; and your hooks run in the same transaction as each transition.

## What happened, and what applies

**[go-activitylog](https://github.com/byteminus/go-activitylog)** records every create, update and delete in the same database transaction as the change, with the actor, tenant and request details you put in the context once, and exactly which fields changed. Secrets are marked as changed without their values, at any depth.

**[go-settings](https://github.com/byteminus/go-settings)** gives you typed settings: declare a `Key[T]` with a default and a validation rule, override it globally, per tenant or per user, and the most specific value wins. Secrets are encrypted at rest with rotating AES-256-GCM keys.

**[go-featureflags](https://github.com/byteminus/go-featureflags)** evaluates flags against an immutable in-memory snapshot, so a request never waits on the database: kill switches, user and tenant targeting, attribute rules, sticky percentage rollouts and weighted variants. Snapshots refresh by polling or are pushed from PostgreSQL.

**[go-translatable](https://github.com/byteminus/go-translatable)** keeps translations in your own tables as `jsonb`, with fallback chains (`pt-BR` → `pt` → `en`), the request locale from the URL, a cookie or `Accept-Language`, and the same fallback applied inside SQL for sorting and filtering. For a product that ships in Bangla and English, that is most of the job.

## Files, messages, backups and the back office

**[go-medialibrary](https://github.com/byteminus/go-medialibrary)** attaches uploads to your models — avatars, product photos, invoice PDFs. It checks the real content type, stores files on local disk or any S3-compatible bucket (AWS S3, Cloudflare R2, MinIO), records them in PostgreSQL, and makes image conversions inline or through your own job queue. Writes are ordered so a record never points at a missing file.

**[go-notifications](https://github.com/byteminus/go-notifications)** sends email, SMS, push and in-app notifications through one dispatcher. A notification is a Go type that says how it renders on each channel; the dispatcher respects opt-outs and tells you what happened per recipient and channel, including which push tokens to delete. SMTP, Twilio and Firebase Cloud Messaging are built in.

**[go-backup](https://github.com/byteminus/go-backup)** dumps PostgreSQL with `pg_dump`, archives upload directories, encrypts with [age](https://age-encryption.org), ships to a local volume and S3-compatible storage at once, verifies every checksum, prunes grandfather-father-son, and restores. A backup counts as complete only once every byte and its manifest are stored.

**[go-admin](https://github.com/byteminus/go-admin)** turns resource definitions written in Go into a server-rendered admin panel: lists with search, filters and bulk actions, detail pages, validated forms and a dashboard. It is a plain `http.Handler` with no code generation, it never authenticates users itself, it asks your authoriser before every page and write, and it ships a strict Content-Security-Policy.

## Using them

Each repository's README opens with a quick start, and the API documentation is on pkg.go.dev — [go-tenancy's](https://pkg.go.dev/github.com/byteminus/go-tenancy), for example. The [open-source page](https://byteminus.com/open-source/#go) lists all eleven with their install lines.

Issues and pull requests are welcome on each repository. Security reports go to [contact@byteminus.com](mailto:contact@byteminus.com?subject=Security%20report), not a public issue.