# STTIL Shield — Product Architecture

**Design date:** 2026-06-22
**Design by:** Pi
**Status:** Draft — review by Kisa before sharing with Claude Code

---

## 1. Product Definition

**What Shield is:**
A standalone compliance automation platform for healthcare-adjacent SaaS companies, startups, and small supplier operations. Think "Dash ComplyOps, but simpler and cheaper, with an AI Consent Addendum as the lead-gen engine."

**What Shield is NOT:**

- Not DMEPOS-specific (that's Signal's lane)
- Not a replacement for Vanta/Drata (different tier — Shield targets micro-SaaS)
- Not a consulting service (self-serve compliance tooling)

**Target customer:**

- Micro-SaaS companies that need HIPAA/SOC 2 readiness (1-20 employees)
- Healthcare adjacent startups building on top of HIPAA-covered infrastructure
- Small DME suppliers who want compliance basics without Signal (Shield standalone)
- DMEPOS suppliers who want both: Shield + Signal bundle (optional upsell)

**Core value proposition:**
"Get compliant in days, not months. Pre-built policies, automated evidence collection, and audit-ready reporting — starting at less than Dash ComplyOps."

---

## 2. Competitive Positioning

| Competitor | Price | Frameworks | Target | Shield Advantage |
|-----------|-------|-----------|--------|-----------------|
| **Vanta** | $10K-$100K+/yr | SOC 2, HIPAA, ISO, PCI | Enterprise | Too expensive for micro |
| **Drata** | $7.5K-$100K+/yr | SOC 2, HIPAA, ISO, PCI | Mid-market | Too expensive for micro |
| **Secureframe** | $7.5K-$80K+/yr | SOC 2, HIPAA, ISO, PCI | Mid-market | Too expensive for micro |
| **Dash ComplyOps** | **$3K/yr flat** | HIPAA, SOC 2, PCI, ISO, NIST | Small teams | **Direct competitor — closest** |
| **Shield** | **TBD (target $1.2K-$2.4K/yr)** | HIPAA-first, SOC 2, expand | **Micro-SaaS** | Cheaper + Consent Addendum hook |

**Differentiation strategy:**

- Price under Dash (target $100-200/mo instead of $250)
- AI Consent Addendum is a unique lead-gen asset Dash can't match
- Simpler UI — focused on HIPAA-first workflows
- Optional Signal bundle for DMEPOS suppliers who also need documentation readiness

---

## 3. Feature Set (MVP)

### Core Features (v1)

| Feature | Description | Why |
|---------|-------------|-----|
| **Policy Templates** | 12+ pre-built admin policies (HIPAA-focused) | Instant compliance documentation |
| **Evidence Collection** | Manual upload + API integrations for cloud infra | Prove controls are active |
| **Audit Reports** | One-click SOC 2 / HIPAA evidence bundles | Answer auditor requests fast |
| **Risk Assessment** | Simple asset register + risk scoring | Foundational HIPAA requirement |
| **User Management** | Unlimited users (team collaboration) | Match Dash's offering |
| **Framework Support** | HIPAA v1, SOC 2 v2, expand to PCI/ISO | Start narrow, grow |

### AI Consent Addendum (Open-Source Lead Magnet)

**Purpose:** Drive leads to Shield. The addendum is a simple, open-source document generator that creates AI/healthcare consent forms. It showcases STTIL's compliance expertise and includes a subtle "Need the full compliance suite? Check out Shield." CTA.

**Implementation:**

- Standalone single-page app (Vite/React or simple HTML/JS)
- User fills in: company name, AI tool name, data types processed
- Generates a formatted HIPAA-compliant consent document PDF
- No login required for basic use
- "Want automated policy management, evidence collection, and audit prep?" → links to Shield signup
- Hosted at `consent.sttilsolutions.com` or similar

**Why open source:**

- Builds brand trust and community
- SEO magnet for "AI consent form healthcare HIPAA" searches
- Low friction entry point — user sees STTIL quality before buying Shield

---

## 4. Technical Architecture

### Option A: Standalone (Recommended)

Build Shield as a new, independent codebase. No shared infrastructure with Signal.

**Stack:**

- Frontend: Vite/React (same stack as Signal — reuse patterns)
- Backend: Python/FastAPI (same stack — reuse patterns)
- Database: Supabase (separate project from Signal's DB)
- Auth: Clerk (separate instance or same with org separation)
- Hosting: Railway (separate project) + Vercel (separate deployment)

**Pros:**

- Clean separation — Signal issues never affect Shield or vice versa
- Independent pricing and scaling
- Can sell standalone without bundling concerns
- Easier to spin out or sell separately later

**Cons:**

- More upfront build time
- Separate Supabase project (extra $25/mo for Pro plan)

### Option B: Signal Extension (Not Recommended)

Build Shield as a module inside the Signal codebase.

**Why not:** Already decided Shield is a standalone product. Sharing infrastructure couples two products with different pricing, compliance posture, and target customers. Avoid.

### AI Consent Addendum Architecture

- Standalone single-page app, Vite/React
- No backend needed — PDF generation happens client-side (using a library like jsPDF or pdf-lib)
- Hosted on Vercel under a subdomain
- Links to Shield signup — no data collection on the addendum page itself (privacy-friendly)
- Open-source repo under STTIL GitHub org

---

## 5. Pricing Tiers (Suggested)

| Tier | Price (monthly) | Features | Target |
|-----|----------------|---------|--------|
| **Free** | $0 | AI Consent Addendum, 1 policy template | Lead gen |
| **Starter** | **$99/mo** | 12 policies, evidence upload, audit reports | Solopreneurs, tiny teams |
| **Growth** | **$199/mo** | Starter + API integrations, risk assessments, unlimited users | Growing startups |
| **Enterprise** | Custom | Growth + dedicated support, custom frameworks, Signal bundle | DMEPOS suppliers |

**Rationale:**

- Undercut Dash ($250/mo) at both Starter ($99) and Growth ($199)
- Free tier = Consent Addendum (zero cost to STTIL, drives organic traffic)
- Signal bundle upsell to $299/mo for suppliers who need both Signal + Shield

---

## 6. Go-to-Market

### Consent Addendum as Growth Engine

1. Developer discovers "AI consent form" via search
2. Uses the free open-source tool → impressed by quality
3. Sees "Need HIPAA compliance for your whole stack? Try Shield." CTA
4. Signs up for Shield Starter ($99/mo)
5. Upgrades to Growth when they need audit prep

### Channels

- **SEO:** "HIPAA compliance for startups," "AI consent form," "SOC 2 for micro-SaaS"
- **Content:** Blog posts comparing Dash vs Shield, "I built HIPAA compliance in a weekend" type content
- **Signal cross-sell:** When a DMEPOS supplier signs up for Signal, offer Shield bundle
- **Open-source community:** GitHub stars, HN posts about the Consent Addendum

---

## 7. Build Phases

| Phase | Scope | Est. |
|-------|-------|------|
| **Phase 0: Consent Addendum** | Open-source mini-app, client-side PDF gen, hosted on Vercel | 1 session |
| **Phase 1: Shield MVP** | Policy templates, evidence upload, audit reports, user auth | 3-4 sessions |
| **Phase 2: Risk + Integrations** | Risk assessment module, API integrations (AWS, GCP, Railway) | 2-3 sessions |
| **Phase 3: Signal Bundle** | Shared dashboard for suppliers using both products | 1 session |

---

## 8. Open Questions (For Kisa)

1. **Pricing:** Does $99/$199 feel right? Too low? Too high relative to Dash at $250?
2. **Frameworks:** Start with HIPAA-only and add SOC 2 later? Or launch with both?
3. **Consent Addendum name:** "AI Consent Addendum" vs "STTIL Consent Builder" vs something else?
4. **Signal bundle:** A shared login/dashboard, or just a discount code?
5. **Timeline:** Build Consent Addendum first (fast win) or wait for full Shield MVP?

---

*This is a design draft. Please review and adjust before sharing with Claude Code for build.*