primitives
The missing layer for B2B SaaS

Build what’s yours.We build and run the rest.

Primitives is the missing layer between low-level infrastructure and your product: SSO, fine-grained permissions, events, search and audit behind a few simple APIs. Right the first time, enterprise-ready from day one, and run by us, so your team ships fast and never rebuilds.Get startedSee the callsBuilt onZanzibarPostgresKafkaOpenSearchClickHouseOpenMeter

Why Primitives

  1. The parts exist.

    Zanzibar, Postgres, Kafka, OpenSearch, ClickHouse, OpenMeter. Each is excellent at one thing. None of them is a feature.

  2. Making them fit is the job.

    Syncing identity, filtering search by permission, fanning one event out to notifications and audit. Then upgrades, backups and on-call, for years.

  3. We’re the missing layer.

    Primitives brings every piece together behind a few simple APIs, then upgrades it, backs it up and carries the pager. Your team builds only what sits on top.

  • Sign-in: Orgs and SSO, synced. Built from WorkOS, Postgres.
  • Permissions: Roles and sharing. Built from Zanzibar, Postgres.
  • Events: Publish once, fan out. Built from Postgres, Kafka.
  • Search: Filtered by permission. Built from Zanzibar, Kafka, OpenSearch.
  • Audit: Who did what, and when. Built from Kafka, ClickHouse.
  • Notifications: The right people, told. Built from Zanzibar, Kafka, Knock.
  • Usage: Metered, with quotas. Built from Kafka, OpenMeter.
  • Files: Uploads, permissioned. Built from Zanzibar, Object store.
  • WorkOS
  • Postgres
  • Zanzibar
  • Kafka
  • OpenSearch
  • ClickHouse
  • Knock
  • OpenMeter
  • Object store

Enterprise-ready

Right the first time.

The checklist your first enterprise customer brings, answered before they ask. No rebuild when you grow into it.

  • SSO for every customer

    SAML and OIDC through the WorkOS you already run, set up per organization.

  • Fine-grained permissions

    Your roles plus per-resource sharing, checked on a Zanzibar model on every call.

  • Audit logs

    Every event becomes the resource’s history, ready when a security team asks.

  • Search that never leaks

    Results are filtered to what each user may see, on every query.

  • Usage and quotas

    Metered on OpenMeter, so usage-based pricing and limits are there when you need them.

  • Files under the same rules

    Uploads are permissioned like everything else, with no second access model.

No lock-in

Ours to run. Yours to keep.

  • Open source, open formats

    Your data lives in Zanzibar-style permissions, Postgres, Kafka, OpenSearch, ClickHouse and OpenMeter, open-source systems you can run and read yourself. Events are standard CloudEvents.

  • Self-host the same code

    A hosted cell is the same Primitives you can run yourself, with the same API, so you can take it in-house.

  • Identity stays yours

    Users, organizations and SSO stay in your own WorkOS. Primitives syncs from it and never becomes your identity provider.

What you get

One call instead of the wiring.

Each request does work you would otherwise build across several tools. Real calls, as Neomatter, our example legal app, makes them.

Pick a piece to see its call.

Events

Say what happened. Once.

Publish one event. Search indexes it, rules notify on it and audit records it.

Instead of wiringPostgresKafka
Neomatter, after a lawyer approves a draft
POST /v1/events
{
  "type": "matter.draft_approved",
  "subject": "7f9c…",
  "actor_id": "2b41…",
  "data": { "title": "Acme supply agreement" }
}

→ 202 { "id": "0193…" }

Getting started

Three steps to ship.

  1. Bring your WorkOS

    Users, organizations and SSO stay where they are. WorkOS stays the source of truth; Primitives keeps a synced copy.

  2. Name what matters

    Your resource types and the roles that act on them, set once on your company’s page. Primitives compiles them into a Zanzibar model.

  3. Ship

    Issue a key for your cell and send JSON. Errors come back as RFC 9457 problem details.

Get back to
your roadmap.

Get started