From 9b3e32f3bd4b73ee4827e586f11dfd5612c6bd90 Mon Sep 17 00:00:00 2001 From: Kisa Date: Mon, 22 Jun 2026 09:04:44 -0400 Subject: [PATCH] =?UTF-8?q?feat(shield):=20add=20product=20architecture=20?= =?UTF-8?q?design=20draft=20=E2=80=94=20positioning,=20features,=20pricing?= =?UTF-8?q?,=20tech=20stack?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- .../specs/2026-06-22-shield-architecture.md | 184 ++++++++++++++++++ 1 file changed, 184 insertions(+) create mode 100644 docs/superpowers/specs/2026-06-22-shield-architecture.md diff --git a/docs/superpowers/specs/2026-06-22-shield-architecture.md b/docs/superpowers/specs/2026-06-22-shield-architecture.md new file mode 100644 index 0000000..a7ebe7b --- /dev/null +++ b/docs/superpowers/specs/2026-06-22-shield-architecture.md @@ -0,0 +1,184 @@ +# STTIL Shield — Product Architecture + +**Design date:** 2026-06-22 +**Design by:** Pi +**Status:** Draft — review by Kisa before sharing with Claude Code + +--- + +## 1. Product Definition + +**What Shield is:** +A standalone compliance automation platform for healthcare-adjacent SaaS companies, startups, and small supplier operations. Think "Dash ComplyOps, but simpler and cheaper, with an AI Consent Addendum as the lead-gen engine." + +**What Shield is NOT:** + +- Not DMEPOS-specific (that's Signal's lane) +- Not a replacement for Vanta/Drata (different tier — Shield targets micro-SaaS) +- Not a consulting service (self-serve compliance tooling) + +**Target customer:** + +- Micro-SaaS companies that need HIPAA/SOC 2 readiness (1-20 employees) +- Healthcare adjacent startups building on top of HIPAA-covered infrastructure +- Small DME suppliers who want compliance basics without Signal (Shield standalone) +- DMEPOS suppliers who want both: Shield + Signal bundle (optional upsell) + +**Core value proposition:** +"Get compliant in days, not months. Pre-built policies, automated evidence collection, and audit-ready reporting — starting at less than Dash ComplyOps." + +--- + +## 2. Competitive Positioning + +| Competitor | Price | Frameworks | Target | Shield Advantage | +|-----------|-------|-----------|--------|-----------------| +| **Vanta** | $10K-$100K+/yr | SOC 2, HIPAA, ISO, PCI | Enterprise | Too expensive for micro | +| **Drata** | $7.5K-$100K+/yr | SOC 2, HIPAA, ISO, PCI | Mid-market | Too expensive for micro | +| **Secureframe** | $7.5K-$80K+/yr | SOC 2, HIPAA, ISO, PCI | Mid-market | Too expensive for micro | +| **Dash ComplyOps** | **$3K/yr flat** | HIPAA, SOC 2, PCI, ISO, NIST | Small teams | **Direct competitor — closest** | +| **Shield** | **TBD (target $1.2K-$2.4K/yr)** | HIPAA-first, SOC 2, expand | **Micro-SaaS** | Cheaper + Consent Addendum hook | + +**Differentiation strategy:** + +- Price under Dash (target $100-200/mo instead of $250) +- AI Consent Addendum is a unique lead-gen asset Dash can't match +- Simpler UI — focused on HIPAA-first workflows +- Optional Signal bundle for DMEPOS suppliers who also need documentation readiness + +--- + +## 3. Feature Set (MVP) + +### Core Features (v1) + +| Feature | Description | Why | +|---------|-------------|-----| +| **Policy Templates** | 12+ pre-built admin policies (HIPAA-focused) | Instant compliance documentation | +| **Evidence Collection** | Manual upload + API integrations for cloud infra | Prove controls are active | +| **Audit Reports** | One-click SOC 2 / HIPAA evidence bundles | Answer auditor requests fast | +| **Risk Assessment** | Simple asset register + risk scoring | Foundational HIPAA requirement | +| **User Management** | Unlimited users (team collaboration) | Match Dash's offering | +| **Framework Support** | HIPAA v1, SOC 2 v2, expand to PCI/ISO | Start narrow, grow | + +### AI Consent Addendum (Open-Source Lead Magnet) + +**Purpose:** Drive leads to Shield. The addendum is a simple, open-source document generator that creates AI/healthcare consent forms. It showcases STTIL's compliance expertise and includes a subtle "Need the full compliance suite? Check out Shield." CTA. + +**Implementation:** + +- Standalone single-page app (Vite/React or simple HTML/JS) +- User fills in: company name, AI tool name, data types processed +- Generates a formatted HIPAA-compliant consent document PDF +- No login required for basic use +- "Want automated policy management, evidence collection, and audit prep?" → links to Shield signup +- Hosted at `consent.sttilsolutions.com` or similar + +**Why open source:** + +- Builds brand trust and community +- SEO magnet for "AI consent form healthcare HIPAA" searches +- Low friction entry point — user sees STTIL quality before buying Shield + +--- + +## 4. Technical Architecture + +### Option A: Standalone (Recommended) + +Build Shield as a new, independent codebase. No shared infrastructure with Signal. + +**Stack:** + +- Frontend: Vite/React (same stack as Signal — reuse patterns) +- Backend: Python/FastAPI (same stack — reuse patterns) +- Database: Supabase (separate project from Signal's DB) +- Auth: Clerk (separate instance or same with org separation) +- Hosting: Railway (separate project) + Vercel (separate deployment) + +**Pros:** + +- Clean separation — Signal issues never affect Shield or vice versa +- Independent pricing and scaling +- Can sell standalone without bundling concerns +- Easier to spin out or sell separately later + +**Cons:** + +- More upfront build time +- Separate Supabase project (extra $25/mo for Pro plan) + +### Option B: Signal Extension (Not Recommended) + +Build Shield as a module inside the Signal codebase. + +**Why not:** Already decided Shield is a standalone product. Sharing infrastructure couples two products with different pricing, compliance posture, and target customers. Avoid. + +### AI Consent Addendum Architecture + +- Standalone single-page app, Vite/React +- No backend needed — PDF generation happens client-side (using a library like jsPDF or pdf-lib) +- Hosted on Vercel under a subdomain +- Links to Shield signup — no data collection on the addendum page itself (privacy-friendly) +- Open-source repo under STTIL GitHub org + +--- + +## 5. Pricing Tiers (Suggested) + +| Tier | Price (monthly) | Features | Target | +|-----|----------------|---------|--------| +| **Free** | $0 | AI Consent Addendum, 1 policy template | Lead gen | +| **Starter** | **$99/mo** | 12 policies, evidence upload, audit reports | Solopreneurs, tiny teams | +| **Growth** | **$199/mo** | Starter + API integrations, risk assessments, unlimited users | Growing startups | +| **Enterprise** | Custom | Growth + dedicated support, custom frameworks, Signal bundle | DMEPOS suppliers | + +**Rationale:** + +- Undercut Dash ($250/mo) at both Starter ($99) and Growth ($199) +- Free tier = Consent Addendum (zero cost to STTIL, drives organic traffic) +- Signal bundle upsell to $299/mo for suppliers who need both Signal + Shield + +--- + +## 6. Go-to-Market + +### Consent Addendum as Growth Engine + +1. Developer discovers "AI consent form" via search +2. Uses the free open-source tool → impressed by quality +3. Sees "Need HIPAA compliance for your whole stack? Try Shield." CTA +4. Signs up for Shield Starter ($99/mo) +5. Upgrades to Growth when they need audit prep + +### Channels + +- **SEO:** "HIPAA compliance for startups," "AI consent form," "SOC 2 for micro-SaaS" +- **Content:** Blog posts comparing Dash vs Shield, "I built HIPAA compliance in a weekend" type content +- **Signal cross-sell:** When a DMEPOS supplier signs up for Signal, offer Shield bundle +- **Open-source community:** GitHub stars, HN posts about the Consent Addendum + +--- + +## 7. Build Phases + +| Phase | Scope | Est. | +|-------|-------|------| +| **Phase 0: Consent Addendum** | Open-source mini-app, client-side PDF gen, hosted on Vercel | 1 session | +| **Phase 1: Shield MVP** | Policy templates, evidence upload, audit reports, user auth | 3-4 sessions | +| **Phase 2: Risk + Integrations** | Risk assessment module, API integrations (AWS, GCP, Railway) | 2-3 sessions | +| **Phase 3: Signal Bundle** | Shared dashboard for suppliers using both products | 1 session | + +--- + +## 8. Open Questions (For Kisa) + +1. **Pricing:** Does $99/$199 feel right? Too low? Too high relative to Dash at $250? +2. **Frameworks:** Start with HIPAA-only and add SOC 2 later? Or launch with both? +3. **Consent Addendum name:** "AI Consent Addendum" vs "STTIL Consent Builder" vs something else? +4. **Signal bundle:** A shared login/dashboard, or just a discount code? +5. **Timeline:** Build Consent Addendum first (fast win) or wait for full Shield MVP? + +--- + +*This is a design draft. Please review and adjust before sharing with Claude Code for build.*