ty! i'll be in touch once we need to scale it a bit more. right now we're still focussing on latency and reliability of the underlying signals

Make OIDC (e.g. Continue with Microsoft) available at all levels so you're not storing user creds, cheaper and less liability for you, better for SaaS subscriber security posture as well. (And SAML should be available too, but perhaps at Pro and up as you do have to build out or SaaS-lease an admin flow.)

Sign in looks like: https://id.atlassian.com/login

In US market, Microsoft (85%!) and Google "Continue with" pick up most SMB IdP-using companies, and Apple and Google most indie devs.

There's no reason to start firms out with a credential flow when neither side wants that. Forcing "call us" to get table stakes security practice wastes everyone's time as well.