feat(shield): add product architecture design draft — positioning, features, pricing, tech stack
This commit is contained in:
Kisa
parent
e2a59ae7a0
commit
9b3e32f3bd
1 changed files with 184 additions and 0 deletions
184
docs/superpowers/specs/2026-06-22-shield-architecture.md
Normal file
184
docs/superpowers/specs/2026-06-22-shield-architecture.md
Normal file
|
|
@ -0,0 +1,184 @@
|
|||
# STTIL Shield — Product Architecture
|
||||
|
||||
**Design date:** 2026-06-22
|
||||
**Design by:** Pi
|
||||
**Status:** Draft — review by Kisa before sharing with Claude Code
|
||||
|
||||
---
|
||||
|
||||
## 1. Product Definition
|
||||
|
||||
**What Shield is:**
|
||||
A standalone compliance automation platform for healthcare-adjacent SaaS companies, startups, and small supplier operations. Think "Dash ComplyOps, but simpler and cheaper, with an AI Consent Addendum as the lead-gen engine."
|
||||
|
||||
**What Shield is NOT:**
|
||||
|
||||
- Not DMEPOS-specific (that's Signal's lane)
|
||||
- Not a replacement for Vanta/Drata (different tier — Shield targets micro-SaaS)
|
||||
- Not a consulting service (self-serve compliance tooling)
|
||||
|
||||
**Target customer:**
|
||||
|
||||
- Micro-SaaS companies that need HIPAA/SOC 2 readiness (1-20 employees)
|
||||
- Healthcare adjacent startups building on top of HIPAA-covered infrastructure
|
||||
- Small DME suppliers who want compliance basics without Signal (Shield standalone)
|
||||
- DMEPOS suppliers who want both: Shield + Signal bundle (optional upsell)
|
||||
|
||||
**Core value proposition:**
|
||||
"Get compliant in days, not months. Pre-built policies, automated evidence collection, and audit-ready reporting — starting at less than Dash ComplyOps."
|
||||
|
||||
---
|
||||
|
||||
## 2. Competitive Positioning
|
||||
|
||||
| Competitor | Price | Frameworks | Target | Shield Advantage |
|
||||
|-----------|-------|-----------|--------|-----------------|
|
||||
| **Vanta** | $10K-$100K+/yr | SOC 2, HIPAA, ISO, PCI | Enterprise | Too expensive for micro |
|
||||
| **Drata** | $7.5K-$100K+/yr | SOC 2, HIPAA, ISO, PCI | Mid-market | Too expensive for micro |
|
||||
| **Secureframe** | $7.5K-$80K+/yr | SOC 2, HIPAA, ISO, PCI | Mid-market | Too expensive for micro |
|
||||
| **Dash ComplyOps** | **$3K/yr flat** | HIPAA, SOC 2, PCI, ISO, NIST | Small teams | **Direct competitor — closest** |
|
||||
| **Shield** | **TBD (target $1.2K-$2.4K/yr)** | HIPAA-first, SOC 2, expand | **Micro-SaaS** | Cheaper + Consent Addendum hook |
|
||||
|
||||
**Differentiation strategy:**
|
||||
|
||||
- Price under Dash (target $100-200/mo instead of $250)
|
||||
- AI Consent Addendum is a unique lead-gen asset Dash can't match
|
||||
- Simpler UI — focused on HIPAA-first workflows
|
||||
- Optional Signal bundle for DMEPOS suppliers who also need documentation readiness
|
||||
|
||||
---
|
||||
|
||||
## 3. Feature Set (MVP)
|
||||
|
||||
### Core Features (v1)
|
||||
|
||||
| Feature | Description | Why |
|
||||
|---------|-------------|-----|
|
||||
| **Policy Templates** | 12+ pre-built admin policies (HIPAA-focused) | Instant compliance documentation |
|
||||
| **Evidence Collection** | Manual upload + API integrations for cloud infra | Prove controls are active |
|
||||
| **Audit Reports** | One-click SOC 2 / HIPAA evidence bundles | Answer auditor requests fast |
|
||||
| **Risk Assessment** | Simple asset register + risk scoring | Foundational HIPAA requirement |
|
||||
| **User Management** | Unlimited users (team collaboration) | Match Dash's offering |
|
||||
| **Framework Support** | HIPAA v1, SOC 2 v2, expand to PCI/ISO | Start narrow, grow |
|
||||
|
||||
### AI Consent Addendum (Open-Source Lead Magnet)
|
||||
|
||||
**Purpose:** Drive leads to Shield. The addendum is a simple, open-source document generator that creates AI/healthcare consent forms. It showcases STTIL's compliance expertise and includes a subtle "Need the full compliance suite? Check out Shield." CTA.
|
||||
|
||||
**Implementation:**
|
||||
|
||||
- Standalone single-page app (Vite/React or simple HTML/JS)
|
||||
- User fills in: company name, AI tool name, data types processed
|
||||
- Generates a formatted HIPAA-compliant consent document PDF
|
||||
- No login required for basic use
|
||||
- "Want automated policy management, evidence collection, and audit prep?" → links to Shield signup
|
||||
- Hosted at `consent.sttilsolutions.com` or similar
|
||||
|
||||
**Why open source:**
|
||||
|
||||
- Builds brand trust and community
|
||||
- SEO magnet for "AI consent form healthcare HIPAA" searches
|
||||
- Low friction entry point — user sees STTIL quality before buying Shield
|
||||
|
||||
---
|
||||
|
||||
## 4. Technical Architecture
|
||||
|
||||
### Option A: Standalone (Recommended)
|
||||
|
||||
Build Shield as a new, independent codebase. No shared infrastructure with Signal.
|
||||
|
||||
**Stack:**
|
||||
|
||||
- Frontend: Vite/React (same stack as Signal — reuse patterns)
|
||||
- Backend: Python/FastAPI (same stack — reuse patterns)
|
||||
- Database: Supabase (separate project from Signal's DB)
|
||||
- Auth: Clerk (separate instance or same with org separation)
|
||||
- Hosting: Railway (separate project) + Vercel (separate deployment)
|
||||
|
||||
**Pros:**
|
||||
|
||||
- Clean separation — Signal issues never affect Shield or vice versa
|
||||
- Independent pricing and scaling
|
||||
- Can sell standalone without bundling concerns
|
||||
- Easier to spin out or sell separately later
|
||||
|
||||
**Cons:**
|
||||
|
||||
- More upfront build time
|
||||
- Separate Supabase project (extra $25/mo for Pro plan)
|
||||
|
||||
### Option B: Signal Extension (Not Recommended)
|
||||
|
||||
Build Shield as a module inside the Signal codebase.
|
||||
|
||||
**Why not:** Already decided Shield is a standalone product. Sharing infrastructure couples two products with different pricing, compliance posture, and target customers. Avoid.
|
||||
|
||||
### AI Consent Addendum Architecture
|
||||
|
||||
- Standalone single-page app, Vite/React
|
||||
- No backend needed — PDF generation happens client-side (using a library like jsPDF or pdf-lib)
|
||||
- Hosted on Vercel under a subdomain
|
||||
- Links to Shield signup — no data collection on the addendum page itself (privacy-friendly)
|
||||
- Open-source repo under STTIL GitHub org
|
||||
|
||||
---
|
||||
|
||||
## 5. Pricing Tiers (Suggested)
|
||||
|
||||
| Tier | Price (monthly) | Features | Target |
|
||||
|-----|----------------|---------|--------|
|
||||
| **Free** | $0 | AI Consent Addendum, 1 policy template | Lead gen |
|
||||
| **Starter** | **$99/mo** | 12 policies, evidence upload, audit reports | Solopreneurs, tiny teams |
|
||||
| **Growth** | **$199/mo** | Starter + API integrations, risk assessments, unlimited users | Growing startups |
|
||||
| **Enterprise** | Custom | Growth + dedicated support, custom frameworks, Signal bundle | DMEPOS suppliers |
|
||||
|
||||
**Rationale:**
|
||||
|
||||
- Undercut Dash ($250/mo) at both Starter ($99) and Growth ($199)
|
||||
- Free tier = Consent Addendum (zero cost to STTIL, drives organic traffic)
|
||||
- Signal bundle upsell to $299/mo for suppliers who need both Signal + Shield
|
||||
|
||||
---
|
||||
|
||||
## 6. Go-to-Market
|
||||
|
||||
### Consent Addendum as Growth Engine
|
||||
|
||||
1. Developer discovers "AI consent form" via search
|
||||
2. Uses the free open-source tool → impressed by quality
|
||||
3. Sees "Need HIPAA compliance for your whole stack? Try Shield." CTA
|
||||
4. Signs up for Shield Starter ($99/mo)
|
||||
5. Upgrades to Growth when they need audit prep
|
||||
|
||||
### Channels
|
||||
|
||||
- **SEO:** "HIPAA compliance for startups," "AI consent form," "SOC 2 for micro-SaaS"
|
||||
- **Content:** Blog posts comparing Dash vs Shield, "I built HIPAA compliance in a weekend" type content
|
||||
- **Signal cross-sell:** When a DMEPOS supplier signs up for Signal, offer Shield bundle
|
||||
- **Open-source community:** GitHub stars, HN posts about the Consent Addendum
|
||||
|
||||
---
|
||||
|
||||
## 7. Build Phases
|
||||
|
||||
| Phase | Scope | Est. |
|
||||
|-------|-------|------|
|
||||
| **Phase 0: Consent Addendum** | Open-source mini-app, client-side PDF gen, hosted on Vercel | 1 session |
|
||||
| **Phase 1: Shield MVP** | Policy templates, evidence upload, audit reports, user auth | 3-4 sessions |
|
||||
| **Phase 2: Risk + Integrations** | Risk assessment module, API integrations (AWS, GCP, Railway) | 2-3 sessions |
|
||||
| **Phase 3: Signal Bundle** | Shared dashboard for suppliers using both products | 1 session |
|
||||
|
||||
---
|
||||
|
||||
## 8. Open Questions (For Kisa)
|
||||
|
||||
1. **Pricing:** Does $99/$199 feel right? Too low? Too high relative to Dash at $250?
|
||||
2. **Frameworks:** Start with HIPAA-only and add SOC 2 later? Or launch with both?
|
||||
3. **Consent Addendum name:** "AI Consent Addendum" vs "STTIL Consent Builder" vs something else?
|
||||
4. **Signal bundle:** A shared login/dashboard, or just a discount code?
|
||||
5. **Timeline:** Build Consent Addendum first (fast win) or wait for full Shield MVP?
|
||||
|
||||
---
|
||||
|
||||
*This is a design draft. Please review and adjust before sharing with Claude Code for build.*
|
||||
Loading…
Reference in a new issue