Everything Tiger ships
The boring-but-essential substrate every site and SaaS needs — auth, multi-tenancy, a CMS, a
clean /api, i18n, and more — already built. A tour of what’s in the box.
Foundation
The substrate every app stands on
Multi-tenant core
Orgs, users, and memberships out of the box — roles live on the membership, not the user.
Zero build toolchain
No npm, no webpack, no Sass. composer install and the UI renders.
Front-end agnostic
Server-rendered .phtml or any SPA — all against one JSON /api.
Built for speed
A lean, OPcache-tuned core — ~10ms pages, even on a $5 shared host.
Self-host anywhere
cPanel, a $5 VPS, or a fleet behind a load balancer. No vendor cloud required.
Authentication & security
Enterprise-grade, wired from commit one
Credentials & 2FA
Password policy, lockout, email codes, and TOTP — identity kept separate from credentials.
Deny-by-default ACL
Every request authorized before it runs; roles resolved live, per tenant.
Sessions & auto-logout
DB-backed sessions with a server-authoritative idle timeout and lock screen.
Login audit log
Every sign-in attempt recorded — the substrate for rate-limiting and anomaly detection.
Zero-downtime rotation
Rotate the encryption key and password pepper with no forced resets.
Content & theming
A CMS that doesn’t lock you in
Database CMS
Pages, layouts, and partials as rows — edit content without a deploy.
Visual builder
GrapesJS drag-and-drop, plus Markdown, HTML, or trusted PHTML bodies.
Custom menus
Admin-authored, tenant-cascading navigation with a drag-drop builder.
Versioning & scheduling
Every save snapshots a version; a future publish date schedules go-live.
Themes & skins, live
Light/dark and swappable skins that hot-swap with no reload — per user or per org.
Site identity
Name, logo, favicon, and socials — editable, and wired into the page head.
Web services — the /api pattern
REST without the bloat
One endpoint
A single /api; the message names the service + method. Add a method, it’s live.
Secured by ACL
Authorized before it runs — resource = the service, privilege = the method.
DataTables built in
Server-side grids fetch rows from /api, never server-rendered HTML.
Self-describing
Because routing is data, an OpenAPI catalog falls out of the pattern.
Developer experience
Built to be built on
Everything is a module
Drop a folder — controllers, services, models, migrations, views, ACL — it plugs in.
Batteries-included CLI
make:module scaffolds a live feature; migrate, install:admin, and secret rotation ship in.
Docs in the code
Docblocks generate the API reference; an AGENTS.md guides your AI before it writes.
BSD-licensed
No copyleft — build commercial products and ship closed-source modules.
Additive migrations
A dependency-free runner scans core, app, and every module for schema changes.
International & configurable
Change it in production, no deploy
Live config overrides
Any setting overridable at request time — global or per-org — with no deploy.
Live translations
Override or add any string at request time; semantic, owner-prefixed keys.
Localized URLs
/es/ works on every route; resolution and persistence are built in.
SEO & marketing
Findable by default
Head registry
title, description, canonical, and robots — contributed, never hardcoded.
Open Graph & Twitter
Rich share cards, with the hero image resolved to real dimensions.
Sitemap & robots
Every public URL mapped and served as a route — pages, blog, and docs.
JSON-LD structured data
Organization, WebSite, Breadcrumb, and Article for rich results.
See it running
One command scaffolds a running, themed, multi-tenant app with all of the above.
$ cd my-app && vendor/bin/tiger install:admin