Supero is a platform for building multi-tenant business applications. You describe your data model in one Python file; the platform gives you a REST API, an admin panel, role-based access control, and a front-end you own and edit directly.

supero-apps is 19 complete applications built that way — healthcare, insurance, clinical trials, billing, CRM, marketplace, field service, property management and more. Every one of them is running live right now, and the source in that repo is the code behind it.

This is open-core, and we would rather say so on the front page than have you find out three days in.

• The applications are MIT. All 19 of them — schemas, access policies, workflows, and the React front-end. Clone one, change anything, ship it commercially. No attribution required.
• The platform they call is a hosted service, and it is not open source. Schema resolution, the multi-tenant runtime, access-control enforcement and orchestration run on api.supero.dev. You do not get that source.
• Your data is yours and it is reachable. Everything lives behind the same REST API the apps use, so an export is a loop over GET /api/v1/crud/{domain}/{type} with your own project key.
• The supero SDK is MIT-licensed and distributed as a wheel on PyPI.

If a closed hosted runtime is a dealbreaker, it should be — and you now know before you invested an afternoon.

Look first, install nothing. lumen.supero.live is one of the 19. Its login page lists every demo account with role and password — click a row and you are in. Sign in as the front desk, then as the patient, and watch the record change.

Then run one yourself, in about two minutes:

git clone https://github.com/supero-platform/supero-apps
cd supero-apps/apps/healthcare/lumen
cp .env.example .env    # set SUPERO_DOMAIN, SUPERO_ADMIN_EMAIL and SUPERO_PASSWORD
./run.sh

No account, no invite, no credit card. Domain registration is open — the name you pick becomes yours if it is free.

Several of the reference apps model healthcare and financial workflows. They demonstrate the shape of that access control — they are not HIPAA-certified, ship with no BAA, and are not PCI or SOC 2 attestations. Running one as shipped sends what you enter to api.supero.dev. Treat them as synthetic-data demonstrations until you have the agreements you need; SECURITY.md is specific about what to ask for.