BYB (co-owned venture)
BYB: a white-label, multi-tenant platform for startup intake and AI-assisted evaluation
A co-owned SaaS venture built end-to-end by Milannial: applications go in, AI pre-analysis, judge matching, scoring and structured feedback come out — with tenant isolation and GDPR designed in from the first migration.
Outcomes
- Full pipeline live in pilot: intake → AI analysis → judge matching → scoring → feedback → 1:1 sessions
- Multi-provider AI layer (OpenRouter / OpenAI / Anthropic) switchable at runtime, with per-run cost caps
- Tenant isolation enforced twice: repository-injected org scoping + RLS, with cross-tenant tests gating CI
- GDPR by design: cascade delete, private decks behind signed URLs, full audit log
Stack
The venture
BYB is not a client project — it's a product Milannial Software co-owns (49%) and built end-to-end: architecture, backend, AI pipeline, admin and judge portals, infrastructure. It's the clearest possible demonstration of what "end-to-end" means here, because there was no one else to hand anything to.
The product: organizations that receive startup applications — accelerators, competitions, investment programs — run their entire evaluation pipeline through BYB. Intake, deduplication, AI pre-analysis, judge assignment, criteria-based scoring, structured feedback back to the applicants, and 1:1 session booking. White-label, multi-tenant, one codebase.
It is currently in pilot with its first users.
The problem
Anyone who has organized a startup competition knows the spreadsheet phase: hundreds of applications, a dozen volunteer judges, criteria that mean something different to each of them, conflicts of interest nobody tracked, and applicants who never hear anything back beyond "thanks for applying."
Each of those is a solvable engineering problem. Together they're a product:
- Intake at scale — a public application form with draft autosave, anti-spam, and GDPR consent, that doesn't fall over the night before the deadline.
- Fair evaluation — judges score against a versioned criteria set, not vibes; conflict-of-interest exclusions are enforced by the assignment system, not by memory.
- Feedback as a first-class output — applicants get a published feedback packet on a tokenized page, and can request a 1:1 session, instead of silence.
How the pipeline works
Step 1 · 01 / 06
Intake
A public, brandable application form with draft autosave, anti-spam protection and explicit GDPR consent. Startups are deduplicated on arrival so the same company applying twice doesn't become two records to score.
Step 2 · 02 / 06
Async AI analysis
Submission never waits for AI. Analysis jobs are queued and processed by a separate worker, with per-run cost caps. The prompt and its output schema are generated from the edition's versioned criteria set — criteria are data, not code.
Step 3 · 03 / 06
Judge matching
Admins assign judges with conflict-of-interest exclusions enforced by the system. A judge who invested in an applicant simply cannot be assigned to it.
Step 4 · 04 / 06
Scoring
Judges review in a dedicated portal: criteria-scored evaluations, private notes, and comments shared with fellow judges. AI scores sit alongside as a reference — AI proposes, humans decide.
Step 5 · 05 / 06
Structured feedback
Selected or not, applicants receive a published feedback packet on a tokenized page — no login required, nothing leaked beyond their own application.
Step 6 · 06 / 06
1:1 sessions
From their feedback page, applicants can request one-on-one sessions with the program's mentors or judges, closing the loop from application to conversation.
Inside the product
No screenshots below — what follows is the product's actual UI, rebuilt in code for this page. Scroll through it.
Admin · 01 / 03
One pipeline, not twelve spreadsheets
Every application lands in a single pipeline: deduplicated on intake, AI-scored asynchronously, tracked from first draft to final decision — with an audit log on every admin action.
AI · 02 / 03
AI pre-analysis on every application
The AI reads each application against the edition's versioned criteria and produces structured scores plus a written rationale. Providers are switchable at runtime, and every run has a hard cost cap.
Judges · 03 / 03
Judges score criteria, not vibes
Judges review in their own portal with criteria-based scoring, private notes, and comments shared with fellow judges. Conflict-of-interest exclusions are enforced by the system — a conflicted judge can't be assigned at all.
New3
NovaGrid
Energy
PlutoPay
Fintech
Ferrolab
DeepTech
In review2
Aerly
Logistics
Mediqo
HealthTech
Selected1
Solvent
SaaS
Dedupe on intake · audit log on every action · CSV export
Admin · 01 / 03
One pipeline, not twelve spreadsheets
Every application lands in a single pipeline: deduplicated on intake, AI-scored asynchronously, tracked from first draft to final decision — with an audit log on every admin action.
New3
NovaGrid
Energy
PlutoPay
Fintech
Ferrolab
DeepTech
In review2
Aerly
Logistics
Mediqo
HealthTech
Selected1
Solvent
SaaS
Dedupe on intake · audit log on every action · CSV export
AI · 02 / 03
AI pre-analysis on every application
The AI reads each application against the edition's versioned criteria and produces structured scores plus a written rationale. Providers are switchable at runtime, and every run has a hard cost cap.
Rationale
▍
Judges · 03 / 03
Judges score criteria, not vibes
Judges review in their own portal with criteria-based scoring, private notes, and comments shared with fellow judges. Conflict-of-interest exclusions are enforced by the system — a conflicted judge can't be assigned at all.
Private note · visible to admins only
Impressive founding team. Ask about churn in the pilot cohort.
The architecture decisions that matter
System architecture · hover or tap a node
Postgres
Row-level security is the safety net under the repository layer: isolation is enforced twice, and cross-tenant tests in CI block any deploy that regresses either layer.
Tenant isolation, enforced twice
Every organization's data lives in the same Postgres. That only works if isolation is unbreakable, so BYB enforces it at two independent layers: every server-side query goes through a repository that injects the organization id from a tenant context — that's the rule — and Postgres row-level security is the safety net underneath it. Cross-tenant isolation tests run in CI and block the deploy if either layer regresses.
AI is async, multi-provider, and cost-capped
AI analysis never runs inside a request. Jobs are queued on Postgres (pg-boss — deliberately no Redis to operate) and processed by a separate worker service. The AI layer is provider-agnostic: OpenRouter, OpenAI or Anthropic, switchable at runtime per organization, with cost caps so a misconfigured edition can't burn a budget overnight.
Human-in-the-loop by design
The AI produces a structured pre-analysis against the edition's criteria — it never decides. Judges see the AI's assessment next to their own scoring workflow. This is the pattern we recommend to every client shipping AI into a real decision process: the model accelerates the humans; it doesn't replace their accountability.
Trust & compliance
Startup applications contain confidential material — decks, financials, founder data. BYB treats that accordingly:
- Private deck storage with time-limited signed URLs; nothing is publicly addressable
- GDPR cascade delete — an applicant's erasure request removes their data across every table, not just the visible row
- Audit log on admin actions
- A public sub-processor list, because GDPR transparency is a feature, not a legal chore
- EU hosting (Frankfurt) end to end
Where it's going
The pilot is running with first users, and the roadmap follows the white-label promise: deeper org-level branding, richer analytics on evaluation quality, and self-serve program setup. Because criteria, prompts and forms are all versioned data, new program types are configuration — not forks.
Want a platform like this for your own intake, evaluation or review process — with AI that assists instead of decides? That's exactly the kind of system we build.