Distributors do not win on catalog alone. They win on how quickly a partner can order, activate, bill, and get an answer. Here is what Elev8 Cloud is building, and what it runs on.
Each one exists because a partner hits it on a normal Tuesday, not because it looked good on a roadmap slide.
One searchable catalog across every vendor Elev8 Cloud carries.
Ordering and activation are the same action, not two.
One statement that reconciles to what you deployed.
The commercial tooling around the catalog.
Escalation that already knows your account.
The back office that keeps the other five honest.
A pragmatic stack chosen for operational surface area rather than novelty. Fewer moving parts means fewer things to secure and fewer things to explain during an audit.
| Layer | Approach |
|---|---|
| Cloud infrastructure | AWS, using ECS Fargate, RDS PostgreSQL, and infrastructure as code |
| Backend services | FastAPI services split by domain: catalog, provisioning, billing, partner management |
| Partner portal | React and Vite front end with a separate admin console |
| Identity | Managed identity provider with SSO, MFA, and role based access for partner accounts |
| Billing and payments | Stripe for partner billing, with a usage reconciliation layer above it |
| Vendor integration | Per vendor API connectors for provisioning and usage, synchronised through a queue |
| Notifications | Transactional email for orders, provisioning events, and billing |
| Observability | Centralised metrics, error tracking, and immutable audit logging |
Selling security tooling on a platform with weak controls would be self defeating. The platform's own posture is part of the offer, and partners are welcome to test the claim.
SSO and MFA on partner accounts, role based permissions, and least privilege by default. A partner technician should not be able to see another partner's client list, and the model enforces it rather than trusting it.
Every commercial and provisioning action is logged immutably: who ordered, who changed a seat count, who adjusted a price. Regulated partners are asked to evidence this, so it exists from the first release.
Encryption in transit and at rest, secrets held in a managed store rather than configuration, and a documented data retention position before the first partner is live.
Partners handling regulated client data will ask for a report. Controls are designed in from the start and the audit is a scheduled milestone, not a retrofit.
Founding partners get access as each subsystem lands, and their feedback decides what gets built next.
