feat(shield): add product architecture design draft — positioning, features, pricing, tech stack

docs/superpowers/specs/2026-06-22-shield-architecture.md

@@ -0,0 +1,184 @@
+# STTIL Shield — Product Architecture
+
+**Design date:** 2026-06-22
+**Design by:** Pi
+**Status:** Draft — review by Kisa before sharing with Claude Code
+
+---
+
+## 1. Product Definition
+
+**What Shield is:**
+A standalone compliance automation platform for healthcare-adjacent SaaS companies, startups, and small supplier operations. Think "Dash ComplyOps, but simpler and cheaper, with an AI Consent Addendum as the lead-gen engine."
+
+**What Shield is NOT:**
+
+- Not DMEPOS-specific (that's Signal's lane)
+- Not a replacement for Vanta/Drata (different tier — Shield targets micro-SaaS)
+- Not a consulting service (self-serve compliance tooling)
+
+**Target customer:**
+
+- Micro-SaaS companies that need HIPAA/SOC 2 readiness (1-20 employees)
+- Healthcare adjacent startups building on top of HIPAA-covered infrastructure
+- Small DME suppliers who want compliance basics without Signal (Shield standalone)
+- DMEPOS suppliers who want both: Shield + Signal bundle (optional upsell)
+
+**Core value proposition:**
+"Get compliant in days, not months. Pre-built policies, automated evidence collection, and audit-ready reporting — starting at less than Dash ComplyOps."
+
+---
+
+## 2. Competitive Positioning
+
+| Competitor | Price | Frameworks | Target | Shield Advantage |
+|-----------|-------|-----------|--------|-----------------|
+| **Vanta** | $10K-$100K+/yr | SOC 2, HIPAA, ISO, PCI | Enterprise | Too expensive for micro |
+| **Drata** | $7.5K-$100K+/yr | SOC 2, HIPAA, ISO, PCI | Mid-market | Too expensive for micro |
+| **Secureframe** | $7.5K-$80K+/yr | SOC 2, HIPAA, ISO, PCI | Mid-market | Too expensive for micro |
+| **Dash ComplyOps** | **$3K/yr flat** | HIPAA, SOC 2, PCI, ISO, NIST | Small teams | **Direct competitor — closest** |
+| **Shield** | **TBD (target $1.2K-$2.4K/yr)** | HIPAA-first, SOC 2, expand | **Micro-SaaS** | Cheaper + Consent Addendum hook |
+
+**Differentiation strategy:**
+
+- Price under Dash (target $100-200/mo instead of $250)
+- AI Consent Addendum is a unique lead-gen asset Dash can't match
+- Simpler UI — focused on HIPAA-first workflows
+- Optional Signal bundle for DMEPOS suppliers who also need documentation readiness
+
+---
+
+## 3. Feature Set (MVP)
+
+### Core Features (v1)
+
+| Feature | Description | Why |
+|---------|-------------|-----|
+| **Policy Templates** | 12+ pre-built admin policies (HIPAA-focused) | Instant compliance documentation |
+| **Evidence Collection** | Manual upload + API integrations for cloud infra | Prove controls are active |
+| **Audit Reports** | One-click SOC 2 / HIPAA evidence bundles | Answer auditor requests fast |
+| **Risk Assessment** | Simple asset register + risk scoring | Foundational HIPAA requirement |
+| **User Management** | Unlimited users (team collaboration) | Match Dash's offering |
+| **Framework Support** | HIPAA v1, SOC 2 v2, expand to PCI/ISO | Start narrow, grow |
+
+### AI Consent Addendum (Open-Source Lead Magnet)
+
+**Purpose:** Drive leads to Shield. The addendum is a simple, open-source document generator that creates AI/healthcare consent forms. It showcases STTIL's compliance expertise and includes a subtle "Need the full compliance suite? Check out Shield." CTA.
+
+**Implementation:**
+
+- Standalone single-page app (Vite/React or simple HTML/JS)
+- User fills in: company name, AI tool name, data types processed
+- Generates a formatted HIPAA-compliant consent document PDF
+- No login required for basic use
+- "Want automated policy management, evidence collection, and audit prep?" → links to Shield signup
+- Hosted at `consent.sttilsolutions.com` or similar
+
+**Why open source:**
+
+- Builds brand trust and community
+- SEO magnet for "AI consent form healthcare HIPAA" searches
+- Low friction entry point — user sees STTIL quality before buying Shield
+
+---
+
+## 4. Technical Architecture
+
+### Option A: Standalone (Recommended)
+
+Build Shield as a new, independent codebase. No shared infrastructure with Signal.
+
+**Stack:**
+
+- Frontend: Vite/React (same stack as Signal — reuse patterns)
+- Backend: Python/FastAPI (same stack — reuse patterns)
+- Database: Supabase (separate project from Signal's DB)
+- Auth: Clerk (separate instance or same with org separation)
+- Hosting: Railway (separate project) + Vercel (separate deployment)
+
+**Pros:**
+
+- Clean separation — Signal issues never affect Shield or vice versa
+- Independent pricing and scaling
+- Can sell standalone without bundling concerns
+- Easier to spin out or sell separately later
+
+**Cons:**
+
+- More upfront build time
+- Separate Supabase project (extra $25/mo for Pro plan)
+
+### Option B: Signal Extension (Not Recommended)
+
+Build Shield as a module inside the Signal codebase.
+
+**Why not:** Already decided Shield is a standalone product. Sharing infrastructure couples two products with different pricing, compliance posture, and target customers. Avoid.
+
+### AI Consent Addendum Architecture
+
+- Standalone single-page app, Vite/React
+- No backend needed — PDF generation happens client-side (using a library like jsPDF or pdf-lib)
+- Hosted on Vercel under a subdomain
+- Links to Shield signup — no data collection on the addendum page itself (privacy-friendly)
+- Open-source repo under STTIL GitHub org
+
+---
+
+## 5. Pricing Tiers (Suggested)
+
+| Tier | Price (monthly) | Features | Target |
+|-----|----------------|---------|--------|
+| **Free** | $0 | AI Consent Addendum, 1 policy template | Lead gen |
+| **Starter** | **$99/mo** | 12 policies, evidence upload, audit reports | Solopreneurs, tiny teams |
+| **Growth** | **$199/mo** | Starter + API integrations, risk assessments, unlimited users | Growing startups |
+| **Enterprise** | Custom | Growth + dedicated support, custom frameworks, Signal bundle | DMEPOS suppliers |
+
+**Rationale:**
+
+- Undercut Dash ($250/mo) at both Starter ($99) and Growth ($199)
+- Free tier = Consent Addendum (zero cost to STTIL, drives organic traffic)
+- Signal bundle upsell to $299/mo for suppliers who need both Signal + Shield
+
+---
+
+## 6. Go-to-Market
+
+### Consent Addendum as Growth Engine
+
+1. Developer discovers "AI consent form" via search
+2. Uses the free open-source tool → impressed by quality
+3. Sees "Need HIPAA compliance for your whole stack? Try Shield." CTA
+4. Signs up for Shield Starter ($99/mo)
+5. Upgrades to Growth when they need audit prep
+
+### Channels
+
+- **SEO:** "HIPAA compliance for startups," "AI consent form," "SOC 2 for micro-SaaS"
+- **Content:** Blog posts comparing Dash vs Shield, "I built HIPAA compliance in a weekend" type content
+- **Signal cross-sell:** When a DMEPOS supplier signs up for Signal, offer Shield bundle
+- **Open-source community:** GitHub stars, HN posts about the Consent Addendum
+
+---
+
+## 7. Build Phases
+
+| Phase | Scope | Est. |
+|-------|-------|------|
+| **Phase 0: Consent Addendum** | Open-source mini-app, client-side PDF gen, hosted on Vercel | 1 session |
+| **Phase 1: Shield MVP** | Policy templates, evidence upload, audit reports, user auth | 3-4 sessions |
+| **Phase 2: Risk + Integrations** | Risk assessment module, API integrations (AWS, GCP, Railway) | 2-3 sessions |
+| **Phase 3: Signal Bundle** | Shared dashboard for suppliers using both products | 1 session |
+
+---
+
+## 8. Open Questions (For Kisa)
+
+1. **Pricing:** Does $99/$199 feel right? Too low? Too high relative to Dash at $250?
+2. **Frameworks:** Start with HIPAA-only and add SOC 2 later? Or launch with both?
+3. **Consent Addendum name:** "AI Consent Addendum" vs "STTIL Consent Builder" vs something else?
+4. **Signal bundle:** A shared login/dashboard, or just a discount code?
+5. **Timeline:** Build Consent Addendum first (fast win) or wait for full Shield MVP?
+
+---
+
+*This is a design draft. Please review and adjust before sharing with Claude Code for build.*