BYB: a white-label, multi-tenant platform for startup intake and AI-assisted evaluation
A SaaS venture co-owned 49% by Milannial, built end-to-end and now in pilot with first users: intake through AI pre-analysis, judge matching, scoring, structured feedback and 1:1 sessions - ~12 applications in the first edition, 6 equal-weighted criteria, 3 AI providers switchable at runtime, tenant isolation and GDPR designed in from day one.
Outcomes
- Full 6-stage pipeline live in pilot: intake -> AI pre-analysis -> judge matching -> scoring -> structured feedback -> 1:1 sessions
- ~12 applications in the first edition, scored on 6 equal-weighted evaluation criteria
- Multi-provider AI layer (OpenRouter / OpenAI / Anthropic) switchable at runtime, with per-run cost caps
- Tenant isolation enforced twice: repository-injected org scoping + Postgres RLS, with cross-tenant tests gating CI
- GDPR by design: cascade delete, private decks behind signed URLs, full audit log; EU hosting (Frankfurt)
Stack
applications in first edition
evaluation criteria per edition
AI providers, switchable
tenant-isolation layers (repo + RLS)
BYB is not a client project — it's a product Milannial Software co-owns (49%) and built end-to-end: architecture, backend, AI pipeline, admin and judge portals, infrastructure. It's the clearest possible demonstration of what "end-to-end" means here, because there was no one else to hand anything to.
The product: organizations that receive startup applications — accelerators, competitions, investment programs — run their entire evaluation pipeline through BYB. Intake, deduplication, AI pre-analysis, judge assignment, criteria-based scoring, structured feedback back to the applicants, and 1:1 session booking. White-label, multi-tenant, one codebase.
It is currently in pilot with its first users.
01 · Platform
White-label, multi-tenant
One codebase serves every organization; tenant isolation is enforced twice - repository-injected org scoping plus Postgres RLS, gated by cross-tenant tests in CI.
02 · AI
Async, multi-provider, cost-capped
Analysis never blocks submission: jobs queue on Postgres and run in a worker, with OpenRouter / OpenAI / Anthropic switchable at runtime and per-run cost caps.
03 · Judging
Human-in-the-loop scoring
Judges score against a versioned criteria set, with conflict-of-interest exclusions enforced by the system - AI proposes, humans decide.
04 · Trust
GDPR by design
Cascade delete, private decks behind signed URLs, a full audit log and a public sub-processor list - transparency as a feature.
Anyone who has organized a startup competition knows the spreadsheet phase: hundreds of applications, a dozen volunteer judges, criteria that mean something different to each of them, conflicts of interest nobody tracked, and applicants who never hear anything back beyond "thanks for applying."
Each of those is a solvable engineering problem. Together they're a product:
- Intake at scale — a public application form with draft autosave, anti-spam, and GDPR consent, that doesn't fall over the night before the deadline.
- Fair evaluation — judges score against a versioned criteria set, not vibes; conflict-of-interest exclusions are enforced by the assignment system, not by memory.
- Feedback as a first-class output — applicants get a published feedback packet on a tokenized page, and can request a 1:1 session, instead of silence.
Step 1 · 01 / 06
Intake
A public, brandable application form with draft autosave, anti-spam protection and explicit GDPR consent. Startups are deduplicated on arrival so the same company applying twice doesn't become two records to score.
Step 2 · 02 / 06
Async AI analysis
Submission never waits for AI. Analysis jobs are queued and processed by a separate worker, with per-run cost caps. The prompt and its output schema are generated from the edition's versioned criteria set — criteria are data, not code.
Step 3 · 03 / 06
Judge matching
Admins assign judges with conflict-of-interest exclusions enforced by the system. A judge who invested in an applicant simply cannot be assigned to it.
Step 4 · 04 / 06
Scoring
Judges review in a dedicated portal: criteria-scored evaluations, private notes, and comments shared with fellow judges. AI scores sit alongside as a reference — AI proposes, humans decide.
Step 5 · 05 / 06
Structured feedback
Selected or not, applicants receive a published feedback packet on a tokenized page — no login required, nothing leaked beyond their own application.
Step 6 · 06 / 06
1:1 sessions
From their feedback page, applicants can request one-on-one sessions with the program's mentors or judges, closing the loop from application to conversation.
What follows are real screenshots from the running product - the admin pipeline, AI pre-analysis, judge scorecard, public intake, applicant feedback and 1:1 booking. Scroll through it.
Admin · 01 / 06
One pipeline, not twelve spreadsheets
Every application lands in a single pipeline: deduplicated on intake, AI-scored asynchronously, and tracked from first draft to final decision - with an audit log on every admin action.
AI · 02 / 06
AI pre-analysis on every application
The AI reads each application against the edition's versioned criteria and produces structured scores plus a written rationale. Providers are switchable at runtime, and every run records its model, tokens and real cost against a hard cap.
Judges · 03 / 06
Judges score criteria, not vibes
Judges review in their own portal with criteria-based scoring, private notes, and comments shared with the applicant. Conflict-of-interest exclusions are enforced by the system - a conflicted judge can't be assigned at all.
Intake · 04 / 06
A public intake that respects consent
The application form is generated from a versioned schema, with draft autosave, anti-spam, and explicit GDPR consent - including consent to AI-assisted analysis - captured at submit.
Feedback · 05 / 06
Structured feedback, not a rejection email
Applicants get a tokenized page - no login - with a message from the team, the judges' shared comments, and optional scores. Numeric scores stay internal unless an admin opts to share them.
1:1 · 06 / 06
From feedback to a real conversation
From the same feedback page, applicants can request a 1:1 session with the team - turning a one-way decision into an ongoing relationship.
Admin · 01 / 06
One pipeline, not twelve spreadsheets
Every application lands in a single pipeline: deduplicated on intake, AI-scored asynchronously, and tracked from first draft to final decision - with an audit log on every admin action.
AI · 02 / 06
AI pre-analysis on every application
The AI reads each application against the edition's versioned criteria and produces structured scores plus a written rationale. Providers are switchable at runtime, and every run records its model, tokens and real cost against a hard cap.
Judges · 03 / 06
Judges score criteria, not vibes
Judges review in their own portal with criteria-based scoring, private notes, and comments shared with the applicant. Conflict-of-interest exclusions are enforced by the system - a conflicted judge can't be assigned at all.
Intake · 04 / 06
A public intake that respects consent
The application form is generated from a versioned schema, with draft autosave, anti-spam, and explicit GDPR consent - including consent to AI-assisted analysis - captured at submit.
Feedback · 05 / 06
Structured feedback, not a rejection email
Applicants get a tokenized page - no login - with a message from the team, the judges' shared comments, and optional scores. Numeric scores stay internal unless an admin opts to share them.
1:1 · 06 / 06
From feedback to a real conversation
From the same feedback page, applicants can request a 1:1 session with the team - turning a one-way decision into an ongoing relationship.
System architecture · hover or tap a node
Postgres
Row-level security is the safety net under the repository layer: isolation is enforced twice, and cross-tenant tests in CI block any deploy that regresses either layer.
Every organization's data lives in the same Postgres. That only works if isolation is unbreakable, so BYB enforces it at two independent layers: every server-side query goes through a repository that injects the organization id from a tenant context — that's the rule — and Postgres row-level security is the safety net underneath it. Cross-tenant isolation tests run in CI and block the deploy if either layer regresses.
AI analysis never runs inside a request. Jobs are queued on Postgres (pg-boss — deliberately no Redis to operate) and processed by a separate worker service. The AI layer is provider-agnostic: OpenRouter, OpenAI or Anthropic, switchable at runtime per organization, with cost caps so a misconfigured edition can't burn a budget overnight.
The AI produces a structured pre-analysis against the edition's criteria — it never decides. Judges see the AI's assessment next to their own scoring workflow. This is the pattern we recommend to every client shipping AI into a real decision process: the model accelerates the humans; it doesn't replace their accountability.
Startup applications contain confidential material — decks, financials, founder data. BYB treats that accordingly:
- Private deck storage with time-limited signed URLs; nothing is publicly addressable
- GDPR cascade delete — an applicant's erasure request removes their data across every table, not just the visible row
- Audit log on admin actions
- A public sub-processor list, because GDPR transparency is a feature, not a legal chore
- EU hosting (Frankfurt) end to end
The pilot is running with first users, and the roadmap follows the white-label promise: deeper org-level branding, richer analytics on evaluation quality, and self-serve program setup. Because criteria, prompts and forms are all versioned data, new program types are configuration — not forks.
Want a platform like this for your own intake, evaluation or review process — with AI that assists instead of decides? That's exactly the kind of system we build.