From 20e6556afcf90333cf9e8bf04370f7af8d693c47 Mon Sep 17 00:00:00 2001 From: Kisa Date: Mon, 22 Jun 2026 10:14:57 -0400 Subject: [PATCH] =?UTF-8?q?docs(shield):=20v2=20=E2=80=94=20HIPAA+GDPR=20g?= =?UTF-8?q?lobal=20scope,=20user's=20pricing=20model=20(free=20print,=20$4?= =?UTF-8?q?9=20PMS=20integration),=20Signal=20Tier=203=20bundle,=20Shield?= =?UTF-8?q?=20MVP=20first?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- .../specs/2026-06-22-shield-architecture.md | 328 +++++++----------- 1 file changed, 122 insertions(+), 206 deletions(-) diff --git a/docs/superpowers/specs/2026-06-22-shield-architecture.md b/docs/superpowers/specs/2026-06-22-shield-architecture.md index d052cea..14b90be 100644 --- a/docs/superpowers/specs/2026-06-22-shield-architecture.md +++ b/docs/superpowers/specs/2026-06-22-shield-architecture.md @@ -1,4 +1,4 @@ -# STTIL Shield — Product Architecture +# STTIL Shield — Product Architecture v2 **Design date:** 2026-06-22 **Design by:** Pi @@ -9,278 +9,194 @@ ## 1. Product Definition **What Shield is:** -A standalone compliance automation platform for small healthcare operations and SaaS companies that engage with PHI and AI and need compliance — without paying enterprise prices. +A global compliance automation platform for small healthcare operations and SaaS companies that handle PHI and/or personal data and need to prove compliance across jurisdictions. Think "Dash ComplyOps, but built for a global audience from day one — US HIPAA + EU GDPR, with an open-source AI Consent Engine as the lead-gen engine." **What Shield is NOT:** - Not DMEPOS-specific (that's Signal's lane) -- Not a replacement for Vanta/Drata (different tier — Shield targets smaller orgs) - Not a consulting service (self-serve compliance tooling) +- Not limited to the US market **Target customer:** -- **Small healthcare ops** — clinics, therapy practices, home health agencies, DME suppliers of any type who handle PHI and need HIPAA compliance -- **Healthcare-adjacent SaaS** — startups building AI tools for healthcare, digital health apps, telemedicine platforms, patient communication tools -- **AI companies handling PHI** — any company building AI/ML products that touch protected health information and need to prove compliance to customers -- **Shield + Signal bundle** — DMEPOS suppliers who need both documentation readiness (Signal) and overall compliance (Shield) +- **Small healthcare ops globally** — clinics, therapy practices, home health agencies, DME suppliers who handle PHI and need HIPAA and/or GDPR compliance +- **Healthcare-adjacent SaaS globally** — startups building AI/health tools, digital health apps, telemedicine platforms, patient communication tools serving US and/or EU markets +- **AI companies handling personal data** — any company building AI products that touch health or personal data and need to prove compliance to customers worldwide +- **Shield + Signal bundle** — DMEPOS suppliers on Signal Tier 3 get Shield included **Core value proposition:** -"Get HIPAA compliant in days, not months. Pre-built policies, automated evidence collection, audit-ready reporting, and a free open-source AI Consent Engine — starting at less than any competitor." +"One platform to prove HIPAA and GDPR compliance. Pre-built policies, automated evidence collection, audit-ready reporting — starting at less than any US-only competitor." --- ## 2. Competitive Positioning -| Competitor | Price | Frameworks | Target | Shield Advantage | -|-----------|-------|-----------|--------|-----------------| -| **Vanta** | $10K-$100K+/yr | SOC 2, HIPAA, ISO, PCI | Enterprise | Overkill for small ops | -| **Drata** | $7.5K-$100K+/yr | SOC 2, HIPAA, ISO, PCI | Mid-market | Overkill for small ops | -| **Secureframe** | $7.5K-$80K+/yr | SOC 2, HIPAA, ISO, PCI | Mid-market | Overkill for small ops | -| **Dash ComplyOps** | **$3K/yr flat** | HIPAA, SOC 2, PCI, ISO, NIST | Small teams | **Direct competitor** | -| **Shield** | **TBD (target $1.2K-$2.4K/yr)** | HIPAA-first, SOC 2, expand | **Small healthcare ops + AI SaaS** | Cheaper + Consent Engine lead magnet | +| Competitor | Price | Coverage | Global? | Shield Advantage | +|-----------|-------|---------|---------|-----------------| +| **Vanta** | $10K-$100K+/yr | SOC 2, HIPAA, ISO, PCI | Partial | Overpriced for small ops | +| **Drata** | $7.5K-$100K+/yr | SOC 2, HIPAA, ISO, PCI | Partial | Overpriced for small ops | +| **Secureframe** | $7.5K-$80K+/yr | SOC 2, HIPAA, ISO, PCI | No | Overpriced for small ops | +| **Dash ComplyOps** | **$3K/yr flat** | HIPAA, SOC 2, PCI, ISO, NIST | **US only** | **Direct competitor but US-only** | +| **Shield** | **TBD** | **HIPAA + GDPR native** | **Global** | Global by design, cheaper, Consent Engine | -**Differentiation strategy:** - -- Price under Dash (target $100-200/mo instead of $250) -- AI Consent Engine is a unique open-source lead-gen asset no competitor has -- Purpose-built for small healthcare operations and AI companies — not enterprise compliance repackaged -- Optional Signal bundle for DMEPOS suppliers who also need documentation readiness +**Key insight:** No major competitor in the sub-$3K/yr space offers HIPAA + GDPR in one platform. Dash is US-only. Vanta/Drata add GDPR as an afterthought at enterprise prices. Shield's global-first approach is a genuine moat. --- -## 3. Feature Set (MVP) +## 3. Shield MVP — Core Feature Set -### Core Features (v1) +### MVP Scope (v1.0) -| Feature | Description | Why | -|---------|-------------|-----| -| **Policy Templates** | 12+ pre-built admin policies (HIPAA-focused) | Instant compliance documentation | -| **Evidence Collection** | Manual upload + API integrations for cloud infra | Prove controls are active | -| **Audit Reports** | One-click SOC 2 / HIPAA evidence bundles | Answer auditor requests fast | -| **Risk Assessment** | Simple asset register + risk scoring | Foundational HIPAA requirement | -| **User Management** | Unlimited users (team collaboration) | Match Dash's offering | -| **Framework Support** | HIPAA v1, SOC 2 v2, expand to PCI/ISO | Start narrow, grow | +The MVP focuses on what small healthcare ops and AI SaaS need most: proving HIPAA and GDPR compliance with minimal effort. -### AI Consent Engine (Open-Source Lead Magnet) +**HIPAA + GDPR Overlap:** +Both frameworks require: -**What it does:** -An open-source tool that lets any healthcare organization generate HIPAA-compliant AI/healthcare consent forms for their patients or end-users. A client (clinic, SaaS, AI company) takes the Consent Engine, brands it with their logo and custom language, and serves it to their own patients so patients can generate consent documents. +- Data mapping and classification +- Risk assessments +- Access controls +- Breach notification procedures +- Vendor/subprocessor management +- Training documentation +- Policy adoption and review cadence -**How the client uses it:** +Shield's architecture treats these as shared controls, then layers jurisdiction-specific requirements on top rather than building separate modules. -1. Fork or clone the open-source GitHub repo -2. Edit a config file (JSON or YAML) with their logo URL, company name, clinic name, custom consent clauses, and branding colors -3. Deploy via one-click to Vercel/Netlify, or self-host -4. Their patients visit their branded consent page, fill in AI tool name and data types, and receive a formatted HIPAA-compliant consent PDF -5. The footer includes: "Powered by STTIL Shield — Need full compliance? Learn more." +| Feature | HIPAA | GDPR | Shared | +|---------|-------|------|--------| +| Policy templates (12+) | ✓ | ✓ | ✓ | +| Data mapping / ROPA | ✓ | ✓ | ✓ | +| Risk assessment | ✓ | ✓ | ✓ | +| Breach notification playbook | ✓ | ✓ | ✓ | +| Subprocessor tracking | ✓ | ✓ | ✓ | +| Evidence collection | ✓ | ✓ | ✓ | +| Audit reports | ✓ | ✓ | ✓ | +| Consent management reference | ✓ | ✓ | ✓ | -**Why open source on GitHub:** +**Key MVP deliverables:** -- Builds community trust and brand credibility -- SEO magnet for "AI consent form healthcare HIPAA GitHub" -- Low friction — any developer can try it in 5 minutes -- GitHub stars = social proof for Shield -- PR contributions from the community improve the tool -- Client owns their instance, no data flows through STTIL +1. **Policy Library** — 12+ pre-built admin policies with HIPAA and GDPR variants. User picks their jurisdiction at onboarding. +2. **Data Mapping / ROPA** — Wizard-style interface to document data flows, classify data types, identify processors. Outputs a GDPR-compliant Record of Processing Activities (ROPA) or HIPAA-compliant data flow map. +3. **Risk Assessment** — Simple asset register + control mapping. Pre-populated with common healthcare SaaS controls. +4. **Evidence Collection** — Manual uploads first (MVP). API integrations later (Phase 2). +5. **Audit Reports** — One-click evidence bundles formatted for HIPAA audits and/or GDPR supervisory authority requests. +6. **Subprocessor Register** — Track vendors, BAAs, and data processing agreements. --- -## 4. Consent Engine — Delivery Options +## 4. AI Consent Engine -### Option A: GitHub Template Repo (User's Suggestion) — RECOMMENDED +### Purpose -Create a GitHub template repository that clients can use with one click. +An open-source lead-generation tool. Not the core product. Builds trust, drives organic traffic, and serves as a low-friction entry point to Shield. -**How it works:** +### Pricing Model -1. Client clicks "Use this template" on the GitHub repo -2. Their own copy is created with all the code -3. They edit a single `config.yaml` or `config.json` file: +| Use case | Price | What they get | +|----------|-------|---------------| +| **Print a consent PDF** | **Free** | Visit the hosted tool or use the GitHub repo. Fill in fields, get a HIPAA/GDPR-compliant consent PDF. Done. | +| **DIY integration** | **Free** | Fork the GitHub repo, copy/paste the HTML into their website or practice management system. Supports themselves. | +| **One-click PMS integration** | **$49 one-time** | We provide a pre-built integration connector for major practice management systems (DrChrono, PointClickCare, etc.) that installs the consent form with one click. No coding. | +| **Custom integration** | **Contact us** | We build a custom connector for their specific PMS/EHR. | - ```yaml - organization: - name: "City Family Clinic" - logo_url: "https://clinic.com/logo.png" - primary_color: "#2563eb" - website: "https://clinic.com" - consent: - jurisdiction: "US-HIPAA" - custom_clauses: - - "I consent to my data being used for AI-assisted diagnosis" - - "I understand I can revoke consent at any time" - footer_text: "This consent form is managed by City Family Clinic" - ``` +### How it Works -4. Deploy button (Vercel/Netlify) — one click to production -5. Client gets a live, branded consent form at `consent.clinic.com` or a Vercel subdomain -6. The form is ready for their patients to use +1. **GitHub template repo** — "Use this template," edit `config.yaml` (logo, company name, jurisdiction [HIPAA/GDPR/both], custom clauses), deploy to Vercel/Netlify with one click. +2. **Hosted version** (optional, later) — `consent.sttilsolutions.com` for non-technical users. +3. **$49 PMS integration** — A script that auto-installs the consent form into the practice management system via their API or embed mechanism. One-time purchase, no subscription. -**Pros:** +### README Requirements (to get it right) -- True open source — client owns the code and deployment -- Developer-friendly — uses familiar GitHub workflow -- No data flows through STTIL — privacy advantage -- Community contributions via PRs -- Huge SEO value for "HIPAA consent form GitHub" +The GitHub README must answer, in order: -**Cons:** - -- Requires some technical ability (fork, edit config, deploy) -- No usage analytics for STTIL (can't track how many consents are generated) -- Client self-manages hosting costs (usually free on Vercel/Netlify free tier) - -### Option B: Hosted Multi-Tenant (SaaS) - -A hosted version at `consent.sttilsolutions.com` where clients log in, upload their logo, customize language through a UI, and get a branded page. - -**How it works:** - -1. Client signs up (no payment needed) -2. Uploads logo, sets colors, writes custom clauses in a WYSIWYG editor -3. Gets a branded URL: `consent.sttilsolutions.com/city-family-clinic` -4. Links their patients to that URL -5. Or embeds via iframe on their own website - -**Pros:** - -- Zero technical skills required -- STTIL controls the full experience -- Can track usage, collect emails, measure conversion to Shield paid -- Can A/B test CTAs and optimize lead generation - -**Cons:** - -- STTIL hosts the service (potential PHI adjacency concerns) -- More operational overhead -- Less open/community feel -- Client doesn't own their instance - -### Option C: Hybrid (Recommended as Final State) - -Start with Option A (GitHub template) for the developer audience and open-source community. Later add Option B (hosted) for non-technical clients who want a simpler setup. - -**Phased rollout:** - -1. **Phase 0a:** GitHub template repo — config-driven, deploy button -2. **Phase 0b (later):** Hosted version at consent.sttilsolutions.com — for clinics without developers -3. Both share the same rendering engine (the GitHub repo is the source of truth) - -**Best of both worlds:** - -- Developers and open-source community get the GitHub experience -- Non-technical clinics get the hosted experience -- The rendering engine is MIT-licensed on GitHub regardless +1. **What is this?** — One-sentence: "Generate HIPAA and GDPR-compliant AI/healthcare consent forms for your patients or end-users." +2. **Quick start (60 seconds)** — "Click 'Use this template,' edit config.yaml, deploy to Vercel" — with screenshots +3. **Config reference** — Every field in `config.yaml` documented with examples +4. **Custom domains** — How to point `consent.yourclinic.com` to your deployment +5. **Practice management system integration** — "Want one-click install into DrChrono/PointClickCare? $49 — [Buy now](link)" +6. **Compliance notes** — What makes this form HIPAA-compliant and/or GDPR-compliant. Legal disclaimer. +7. **Contributing** — How to submit PRs, report issues +8. **License** — MIT +9. **Shield upsell** — "Need full compliance automation for your organization? Check out Shield." --- -## 5. Technical Architecture +## 5. Signal Tier 3 Bundle + +Signal pricing tiers (proposed): + +| Tier | Features | Shield included? | +|------|----------|-----------------| +| **Tier 1** | Core Signal (documentation readiness worklist) | No | +| **Tier 2** | Signal + Advanced Analytics | No | +| **Tier 3** | Signal + Shield (compliance automation) | **Yes — Shield included at no extra cost** | + +This makes Tier 3 the premium offering for DMEPOS suppliers who need both documentation readiness AND overall compliance. Shield also sells standalone to non-DMEPOS customers (clinics, AI SaaS, etc.). + +--- + +## 6. Technical Architecture ### Standalone Codebase (Not Signal Module) -Build Shield as a new, independent codebase. No shared infrastructure with Signal. +Same reasoning as v1 — clean separation enables independent pricing, global scaling, and future spinout. **Stack:** -- Frontend: Vite/React (same stack as Signal — reuse patterns) -- Backend: Python/FastAPI (same stack — reuse patterns) -- Database: Supabase (separate project from Signal's DB) -- Auth: Clerk (separate instance or same with org separation) -- Hosting: Railway (separate project) + Vercel (separate deployment) +- Frontend: Vite/React +- Backend: Python/FastAPI +- Database: Supabase (separate project) +- Auth: Clerk (global-ready — supports multiple identity providers) +- Hosting: Railway + Vercel -**Why standalone:** +### Global-Ready Architecture Decisions -- Clean separation — Signal issues never affect Shield or vice versa -- Independent pricing and scaling -- Can sell standalone without bundling concerns -- Easier to spin out or sell separately later - -### Consent Engine Architecture (GitHub Template) - -``` -shield-consent-engine/ -├── README.md # Quick start, config guide -├── config.yaml # THE config file — client edits this -├── template/ # HTML/CSS/JS rendering engine -│ ├── index.html # Main consent form page -│ ├── style.css # Uses CSS variables from config -│ ├── script.js # Form logic, PDF generation -│ └── preview.png # Screenshot for GitHub social -├── CNAME # Custom domain support -├── vercel.json # One-click deploy config -├── netlify.toml # Netlify deploy config -├── LICENSE # MIT license -└── .github/ - └── CONTRIBUTING.md # How to contribute -``` - -**Key technical decisions:** - -- Client-side PDF generation only (jsPDF or pdf-lib) — no backend needed -- CSS custom properties driven by config — instant branding -- Zero data storage — forms generate PDF in-browser, nothing is sent to a server -- Deploy preview on every PR via Vercel/Netlify -- GitHub Actions for CI (validate config, build preview) +| Decision | Why | +|----------|-----| +| Multi-jurisdiction from day one | User selects "HIPAA," "GDPR," or "Both" at onboarding. Policies, risk templates, and reports adjust accordingly | +| Data residency awareness | MVP: document where data lives. Phase 2: EU hosting option | +| Language-ready UI | i18n from day one (English + EU languages as we grow) | +| Consent Engine supports both standards | Config toggle between HIPAA, GDPR, or combined consent language | --- -## 6. Pricing Tiers (Suggested) +## 7. Pricing Tiers (Shield Standalone) | Tier | Price (monthly) | Features | Target | |-----|----------------|---------|--------| -| **Free** | $0 | AI Consent Engine (GitHub template, self-hosted) | Lead gen, community | -| **Starter** | **$99/mo** | 12 policies, evidence upload, audit reports | Solo practitioners, tiny teams | -| **Growth** | **$199/mo** | Starter + API integrations, risk assessments, unlimited users | Growing healthcare ops, SaaS | -| **Enterprise** | Custom | Growth + dedicated support, custom frameworks, Signal bundle | DMEPOS suppliers, larger orgs | +| **Starter** | **$99/mo** | HIPAA or GDPR (pick one), 12 policies, data mapping, risk assessment, evidence upload | Solo practitioners, tiny teams | +| **Growth** | **$199/mo** | HIPAA + GDPR (both), audit reports, subprocessor register, unlimited users | Growing healthcare ops, AI SaaS | +| **Enterprise** | Custom | Growth + dedicated support, custom frameworks, API integrations, Signal Tier 3 bundle | DMEPOS suppliers, larger orgs | -**Rationale:** +**Key pricing principles:** -- Undercut Dash ($250/mo) at both Starter ($99) and Growth ($199) -- Free tier = Consent Engine (zero cost to STTIL, drives organic traffic and SEO) -- Signal bundle upsell to $299/mo for suppliers who need both Signal + Shield +- Dash costs $250/mo for US-only HIPAA + SOC 2 +- Shield at $199/mo for HIPAA + GDPR is cheaper AND broader in geographic scope +- Signal Tier 3 covers Shield — creates a bundle upsell for DMEPOS suppliers +- Consent Engine generates organic leads that convert to Shield Starter --- -## 7. Go-to-Market +## 8. Build Phases (Prioritized) -### Consent Engine as Growth Engine - -1. Developer or clinic ops person discovers "HIPAA consent form" via search -2. Finds the open-source GitHub repo — stars, forks, tries it -3. Impressed by quality → sees Shield CTA in the footer -4. Signs up for Shield Starter ($99/mo) -5. Upgrades to Growth when they need audit prep and evidence collection - -### Channels - -- **GitHub:** Stars, trending, HN posts about the open-source Consent Engine -- **SEO:** "HIPAA consent form generator," "AI consent template GitHub," "HIPAA compliance for startups" -- **Content:** Blog posts: "How we built an open-source HIPAA consent engine," "Shield vs Dash ComplyOps" -- **Signal cross-sell:** When a DMEPOS supplier signs up for Signal, offer Shield bundle -- **Direct outreach:** Small clinics, digital health startups, AI healthcare companies - ---- - -## 8. Build Phases - -| Phase | Scope | Est. | -|-------|-------|------| -| **Phase 0a: Consent Engine GitHub** | Template repo, config-driven, deploy button, MIT license | 1 session | -| **Phase 0b: Consent Engine Hosted** | Multi-tenant hosted version for non-technical users | 1 session (later) | -| **Phase 1: Shield MVP** | Policy templates, evidence upload, audit reports, user auth | 3-4 sessions | -| **Phase 2: Risk + Integrations** | Risk assessment module, API integrations (AWS, GCP, Railway) | 2-3 sessions | -| **Phase 3: Signal Bundle** | Shared dashboard for suppliers using both products | 1 session | +| Phase | Scope | Est. | Depends on | +|-------|-------|------|-----------| +| **Phase 1: Shield MVP** | Policy library, data mapping/ROPA, risk assessment, evidence upload, audit reports, auth, HIPAA + GDPR frameworks | 4-5 sessions | Nothing | +| **Phase 2: Consent Engine** | GitHub template repo, config-driven, deploy button, MIT license | 1 session | Phase 1 (or parallel) | +| **Phase 3: $49 PMS Integrations** | Pre-built connectors for 3-5 major practice management systems | 1-2 sessions | Phase 2 | +| **Phase 4: API Integrations** | Evidence collection via API (AWS, GCP, Railway, Supabase) | 2-3 sessions | Phase 1 | +| **Phase 5: Signal Tier 3 Bundle** | Shared dashboard + billing integration | 1 session | Phase 1 + Signal coordination | --- ## 9. Open Questions (For Kisa) -1. **Pricing:** Does $99/$199 feel right for small healthcare ops? Too low/high vs Dash at $250? -2. **Frameworks:** Start with HIPAA-only and add SOC 2 later? Or launch with both? -3. **Consent Engine name:** "AI Consent Engine" vs "STTIL Consent Builder" vs "Open Consent"? -4. **Consent Engine approach:** Go with Option A (GitHub template only), Option C (hybrid with hosted later), or something else? -5. **Signal bundle:** A shared login/dashboard, or just a discount code for Shield customers? -6. **Build order:** Consent Engine first (fast win) or Shield MVP first? -7. **PHI concerns with hosted:** If we offer Option B (hosted), does the consent form itself generate PHI? (Patient name + health info in a form = potentially PHI) +1. **Frameworks:** Start with HIPAA + GDPR as described? Or add SOC 2 at launch too? +2. **Practice management systems:** Which ones should we target first for the $49 integration? (DrChrono? PointClickCare? PracticeFusion? Kareo?) +3. **Consent Engine name:** "Open Consent" vs "AI Consent Engine" vs "STTIL Consent Builder" vs something else? +4. **Build order:** Shield MVP first, then Consent Engine? Or start Consent Engine in parallel? +5. **Signal Tier 3 pricing:** What's the price of Tier 3 relative to Tier 1/2? Does Shield inclusion justify a premium? +6. **Data residency:** MVP just documents where data lives, or do we need EU hosting from day one? ---