Claude Code Plugin

Enterprise grade. One prompt.

Everything in Zapframe plus SSO, RBAC, audit logging, multi-tenancy, API keys, and GDPR compliance. Describe your enterprise app. Claude builds it with org isolation, custom roles, and a full audit trail.

Install Plugin View Source

you /ironframe:create

 

claude What are you building?

you Multi-tenant project management tool with role-based access

 

Scoping project + enterprise features...

Configuring 60+ template variables

Validating credentials OK

Scaffolding Django + Next.js + enterprise apps

Seeding 16 RBAC permissions

Building domain logic with org-scoping + audit logging

verify_enterprise.py: all checks PASS

Review agent: gate 5 PASS

Deploying to Cloudflare Tunnel

 

Live at https://projecthub.softwaresoftware.dev

Beyond SaaS Scaffolding

Enterprise features nobody wants to build twice.

Zapframe gives you auth, billing, and deployment. Ironframe adds the enterprise layer — organizations, role-based access, immutable audit trails, API key management, and GDPR compliance. Every new feature you build automatically integrates with org isolation and audit logging because the patterns are baked into the template.

5 Enterprise apps
16 RBAC permissions
12 Django apps total
$0 Monthly hosting

Enterprise Layer

What Ironframe adds to Zapframe.

Six enterprise capabilities, pre-wired into the template. Every new feature you build inherits them automatically.

01

Multi-Tenancy

Organizations, memberships, and invitations. Every model with customer data is org-scoped. Data never leaks across tenants. Users switch between orgs from the sidebar.

organizations app
02

Role-Based Access Control

Four built-in roles (Owner, Admin, Member, Viewer) plus custom roles with granular permissions. 16 default permissions across 7 categories. Create org-specific roles from the dashboard.

rbac app
03

Audit Logging

Immutable audit trail. Every mutation logged with who, what, when, and from where. Auth events captured automatically via Django signals. CSV export for compliance.

auditlog app
04

API Key Management

Scoped API keys with iron_ prefix. Hashed storage, shown once at creation. Works alongside session auth. Per-org, with last-used tracking and optional expiry.

apikeys app
05

GDPR Compliance

Data export (all user data as JSON, available 24h). Configurable retention policies per resource type. Right-to-deletion with data anonymization and audit trail preservation.

compliance app
06

Enterprise SSO

Google OAuth (via django-allauth) plus generic OIDC and SAML2 support. Connect Okta, Azure AD, Auth0 — configured at runtime by org admins, not at scaffold time.

via allauth

Architecture

Same stack as Zapframe. Enterprise layer on top.

No decision fatigue. Battle-tested defaults. Enterprise patterns baked in.

Frontend

  • Next.js 16 App Router
  • React 19 + TypeScript strict
  • Tailwind CSS + shadcn/ui
  • Org switcher + admin pages

Backend

  • Django 5.1 + DRF
  • 12 Django apps pre-wired
  • Celery + Redis
  • OrganizationMiddleware

Enterprise

  • RBAC with seed_permissions
  • Audit log with signals
  • API keys with auth backend
  • Compliance Celery tasks

Integrations

  • Stripe subscriptions
  • Resend transactional email
  • Google OAuth + OIDC/SAML
  • Sentry error tracking

What Makes It Different

Enterprise patterns, not enterprise complexity.

The template enforces the patterns. Every feature you build inherits org-scoping and audit logging for free.

Org-scoped by default

Every new model gets an organization FK. Every view filters by request.organization. The template rules enforce this — Claude won't build a feature that leaks data across orgs.

Audit everything

Call log_action() after every mutation. Auth events are captured automatically. The enterprise verification script checks that you didn't skip audit logging in new views.

API keys that work

Session auth for browsers, iron_-prefixed API keys for programmatic access. Both registered globally in DRF. No extra wiring needed for new endpoints.

RBAC without the headache

Built-in roles cover 90% of cases. Custom roles for the rest. Permission checks are one-liners: has_permission(request, "projects.manage").

Compliance built in

GDPR data export via Celery. Configurable retention policies. Right-to-deletion that anonymizes audit entries instead of destroying them. Not bolted on — part of the template.

Same quality gates

Ironframe inherits Zapframe's 7-gate process plus verify_enterprise.py — static analysis that checks org-scoping, audit logging, and RBAC integration on every build.

Get Started

Install

Requires Claude Code, Docker, system Nginx, and cloudflared with a configured tunnel.

1

Add the marketplace

Run in your terminal.

claude plugin marketplace add softwaresoftware-dev/softwaresoftware-plugins
2

Install the dependency resolver

Run in your terminal.

claude plugin install softwaresoftware@softwaresoftware-plugins
3

Launch Claude Code and install ironframe + dependencies

Run inside Claude Code.

/softwaresoftware:install ironframe
4

Create a new enterprise project

Run inside Claude Code after reloading plugins.

/ironframe:create

Or develop features on an existing app

/ironframe:dev