Phase 3 — Scale ready (rolling)
Complete these when you are past first revenue and need enterprise-grade operations.
- Mobile store: Remote iOS build numbers, production EAS profiles without dev client, privacy manifest (
PrivacyInfo.xcprivacy), push notification production credentials verified on device. - Realtime: Redis adapter + sticky sessions if you run multiple API processes behind a load balancer.
- Jobs & queues: Visibility into failed cron/queue work; paging on stuck jobs.
- API hardening: Global
unhandledRejectionhandler; Stripe webhook unknown-event logging (not silent drop). - Trust center: Status page, security questionnaire (CAIQ/SIG lite), optional SOC 2 Type I kickoff.
- Product: Demo/sandbox tenant, outbound webhooks for integrations, public OpenAPI or Postman collection if you sell API access.
This list is maintained alongside the main engineering roadmap.