Secure Multi-Firm CRM MVP

I need an MVP web application that lets multiple firms log in, manage only their own clients, and never see data from any other firm. In this first cut the only functionality staff require is the ability to create, edit, search, and export client contact details together with internal notes. No external client portals, partner access, or complex case tracking for now—just a rock-solid, staff-only CRM with airtight firm-level separation. Core expectations • Multi-tenant architecture: once a user is tied to a firm, every screen, record, and API call must stay within that tenant. • Secure authentication and role-based authorisation for staff. • CRUD interface for contacts and notes, with simple tagging/filtering and a clean responsive UI. • Audit trail so I can see who changed what and when. • Deployment-ready code (Docker, Kubernetes, or comparable) plus straightforward environment variables for database keys and secrets. • Tech stack is up to you—React + Node, Django, Laravel, or similar are fine—but please choose mature libraries that speed up delivery without locking us in. • Source code in a private Git repo and brief setup docs are part of the hand-off. Acceptance criteria 1. A staff user from Firm A cannot access, query, or infer the existence of data belonging to Firm B—even via direct URL or API manipulation. 2. A new firm can be created through an admin script or seed file and immediately gains a clean data silo. 3. All contact and note operations perform <300 ms round-trip on a modest cloud instance with 100k records. 4. End-to-end tests cover tenant isolation, auth flows, and CRUD actions. If you have recent experience shipping secure multi-tenant SaaS back-ends and can turn around an MVP quickly, let’s talk timelines and milestones.