203 lines
10 KiB
Markdown
203 lines
10 KiB
Markdown
# STTIL Shield — Product Architecture v2
|
|
|
|
**Design date:** 2026-06-22
|
|
**Design by:** Pi
|
|
**Status:** Draft — review by Kisa before sharing with Claude Code
|
|
|
|
---
|
|
|
|
## 1. Product Definition
|
|
|
|
**What Shield is:**
|
|
A global compliance automation platform for small healthcare operations and SaaS companies that handle PHI and/or personal data and need to prove compliance across jurisdictions. Think "Dash ComplyOps, but built for a global audience from day one — US HIPAA + EU GDPR, with an open-source AI Consent Engine as the lead-gen engine."
|
|
|
|
**What Shield is NOT:**
|
|
|
|
- Not DMEPOS-specific (that's Signal's lane)
|
|
- Not a consulting service (self-serve compliance tooling)
|
|
- Not limited to the US market
|
|
|
|
**Target customer:**
|
|
|
|
- **Small healthcare ops globally** — clinics, therapy practices, home health agencies, DME suppliers who handle PHI and need HIPAA and/or GDPR compliance
|
|
- **Healthcare-adjacent SaaS globally** — startups building AI/health tools, digital health apps, telemedicine platforms, patient communication tools serving US and/or EU markets
|
|
- **AI companies handling personal data** — any company building AI products that touch health or personal data and need to prove compliance to customers worldwide
|
|
- **Shield + Signal bundle** — DMEPOS suppliers on Signal Tier 3 get Shield included
|
|
|
|
**Core value proposition:**
|
|
"One platform to prove HIPAA and GDPR compliance. Pre-built policies, automated evidence collection, audit-ready reporting — starting at less than any US-only competitor."
|
|
|
|
---
|
|
|
|
## 2. Competitive Positioning
|
|
|
|
| Competitor | Price | Coverage | Global? | Shield Advantage |
|
|
|-----------|-------|---------|---------|-----------------|
|
|
| **Vanta** | $10K-$100K+/yr | SOC 2, HIPAA, ISO, PCI | Partial | Overpriced for small ops |
|
|
| **Drata** | $7.5K-$100K+/yr | SOC 2, HIPAA, ISO, PCI | Partial | Overpriced for small ops |
|
|
| **Secureframe** | $7.5K-$80K+/yr | SOC 2, HIPAA, ISO, PCI | No | Overpriced for small ops |
|
|
| **Dash ComplyOps** | **$3K/yr flat** | HIPAA, SOC 2, PCI, ISO, NIST | **US only** | **Direct competitor but US-only** |
|
|
| **Shield** | **TBD** | **HIPAA + GDPR native** | **Global** | Global by design, cheaper, Consent Engine |
|
|
|
|
**Key insight:** No major competitor in the sub-$3K/yr space offers HIPAA + GDPR in one platform. Dash is US-only. Vanta/Drata add GDPR as an afterthought at enterprise prices. Shield's global-first approach is a genuine moat.
|
|
|
|
---
|
|
|
|
## 3. Shield MVP — Core Feature Set
|
|
|
|
### MVP Scope (v1.0)
|
|
|
|
The MVP focuses on what small healthcare ops and AI SaaS need most: proving HIPAA and GDPR compliance with minimal effort.
|
|
|
|
**HIPAA + GDPR Overlap:**
|
|
Both frameworks require:
|
|
|
|
- Data mapping and classification
|
|
- Risk assessments
|
|
- Access controls
|
|
- Breach notification procedures
|
|
- Vendor/subprocessor management
|
|
- Training documentation
|
|
- Policy adoption and review cadence
|
|
|
|
Shield's architecture treats these as shared controls, then layers jurisdiction-specific requirements on top rather than building separate modules.
|
|
|
|
| Feature | HIPAA | GDPR | Shared |
|
|
|---------|-------|------|--------|
|
|
| Policy templates (12+) | ✓ | ✓ | ✓ |
|
|
| Data mapping / ROPA | ✓ | ✓ | ✓ |
|
|
| Risk assessment | ✓ | ✓ | ✓ |
|
|
| Breach notification playbook | ✓ | ✓ | ✓ |
|
|
| Subprocessor tracking | ✓ | ✓ | ✓ |
|
|
| Evidence collection | ✓ | ✓ | ✓ |
|
|
| Audit reports | ✓ | ✓ | ✓ |
|
|
| Consent management reference | ✓ | ✓ | ✓ |
|
|
|
|
**Key MVP deliverables:**
|
|
|
|
1. **Policy Library** — 12+ pre-built admin policies with HIPAA and GDPR variants. User picks their jurisdiction at onboarding.
|
|
2. **Data Mapping / ROPA** — Wizard-style interface to document data flows, classify data types, identify processors. Outputs a GDPR-compliant Record of Processing Activities (ROPA) or HIPAA-compliant data flow map.
|
|
3. **Risk Assessment** — Simple asset register + control mapping. Pre-populated with common healthcare SaaS controls.
|
|
4. **Evidence Collection** — Manual uploads first (MVP). API integrations later (Phase 2).
|
|
5. **Audit Reports** — One-click evidence bundles formatted for HIPAA audits and/or GDPR supervisory authority requests.
|
|
6. **Subprocessor Register** — Track vendors, BAAs, and data processing agreements.
|
|
|
|
---
|
|
|
|
## 4. AI Consent Engine
|
|
|
|
### Purpose
|
|
|
|
An open-source lead-generation tool. Not the core product. Builds trust, drives organic traffic, and serves as a low-friction entry point to Shield.
|
|
|
|
### Pricing Model
|
|
|
|
| Use case | Price | What they get |
|
|
|----------|-------|---------------|
|
|
| **Print a consent PDF** | **Free** | Visit the hosted tool or use the GitHub repo. Fill in fields, get a HIPAA/GDPR-compliant consent PDF. Done. |
|
|
| **DIY integration** | **Free** | Fork the GitHub repo, copy/paste the HTML into their website or practice management system. Supports themselves. |
|
|
| **One-click PMS integration** | **$49 one-time** | We provide a pre-built integration connector for major practice management systems (DrChrono, PointClickCare, etc.) that installs the consent form with one click. No coding. |
|
|
| **Custom integration** | **Contact us** | We build a custom connector for their specific PMS/EHR. |
|
|
|
|
### How it Works
|
|
|
|
1. **GitHub template repo** — "Use this template," edit `config.yaml` (logo, company name, jurisdiction [HIPAA/GDPR/both], custom clauses), deploy to Vercel/Netlify with one click.
|
|
2. **Hosted version** (optional, later) — `consent.sttilsolutions.com` for non-technical users.
|
|
3. **$49 PMS integration** — A script that auto-installs the consent form into the practice management system via their API or embed mechanism. One-time purchase, no subscription.
|
|
|
|
### README Requirements (to get it right)
|
|
|
|
The GitHub README must answer, in order:
|
|
|
|
1. **What is this?** — One-sentence: "Generate HIPAA and GDPR-compliant AI/healthcare consent forms for your patients or end-users."
|
|
2. **Quick start (60 seconds)** — "Click 'Use this template,' edit config.yaml, deploy to Vercel" — with screenshots
|
|
3. **Config reference** — Every field in `config.yaml` documented with examples
|
|
4. **Custom domains** — How to point `consent.yourclinic.com` to your deployment
|
|
5. **Practice management system integration** — "Want one-click install into DrChrono/PointClickCare? $49 — [Buy now](link)"
|
|
6. **Compliance notes** — What makes this form HIPAA-compliant and/or GDPR-compliant. Legal disclaimer.
|
|
7. **Contributing** — How to submit PRs, report issues
|
|
8. **License** — MIT
|
|
9. **Shield upsell** — "Need full compliance automation for your organization? Check out Shield."
|
|
|
|
---
|
|
|
|
## 5. Signal Tier 3 Bundle
|
|
|
|
Signal pricing tiers (proposed):
|
|
|
|
| Tier | Features | Shield included? |
|
|
|------|----------|-----------------|
|
|
| **Tier 1** | Core Signal (documentation readiness worklist) | No |
|
|
| **Tier 2** | Signal + Advanced Analytics | No |
|
|
| **Tier 3** | Signal + Shield (compliance automation) | **Yes — Shield included at no extra cost** |
|
|
|
|
This makes Tier 3 the premium offering for DMEPOS suppliers who need both documentation readiness AND overall compliance. Shield also sells standalone to non-DMEPOS customers (clinics, AI SaaS, etc.).
|
|
|
|
---
|
|
|
|
## 6. Technical Architecture
|
|
|
|
### Standalone Codebase (Not Signal Module)
|
|
|
|
Same reasoning as v1 — clean separation enables independent pricing, global scaling, and future spinout.
|
|
|
|
**Stack:**
|
|
|
|
- Frontend: Vite/React
|
|
- Backend: Python/FastAPI
|
|
- Database: Supabase (separate project)
|
|
- Auth: Clerk (global-ready — supports multiple identity providers)
|
|
- Hosting: Railway + Vercel
|
|
|
|
### Global-Ready Architecture Decisions
|
|
|
|
| Decision | Why |
|
|
|----------|-----|
|
|
| Multi-jurisdiction from day one | User selects "HIPAA," "GDPR," or "Both" at onboarding. Policies, risk templates, and reports adjust accordingly |
|
|
| Data residency awareness | MVP: document where data lives. Phase 2: EU hosting option |
|
|
| Language-ready UI | i18n from day one (English + EU languages as we grow) |
|
|
| Consent Engine supports both standards | Config toggle between HIPAA, GDPR, or combined consent language |
|
|
|
|
---
|
|
|
|
## 7. Pricing Tiers (Shield Standalone)
|
|
|
|
| Tier | Price (monthly) | Features | Target |
|
|
|-----|----------------|---------|--------|
|
|
| **Starter** | **$99/mo** | HIPAA or GDPR (pick one), 12 policies, data mapping, risk assessment, evidence upload | Solo practitioners, tiny teams |
|
|
| **Growth** | **$199/mo** | HIPAA + GDPR (both), audit reports, subprocessor register, unlimited users | Growing healthcare ops, AI SaaS |
|
|
| **Enterprise** | Custom | Growth + dedicated support, custom frameworks, API integrations, Signal Tier 3 bundle | DMEPOS suppliers, larger orgs |
|
|
|
|
**Key pricing principles:**
|
|
|
|
- Dash costs $250/mo for US-only HIPAA + SOC 2
|
|
- Shield at $199/mo for HIPAA + GDPR is cheaper AND broader in geographic scope
|
|
- Signal Tier 3 covers Shield — creates a bundle upsell for DMEPOS suppliers
|
|
- Consent Engine generates organic leads that convert to Shield Starter
|
|
|
|
---
|
|
|
|
## 8. Build Phases (Prioritized)
|
|
|
|
| Phase | Scope | Est. | Depends on |
|
|
|-------|-------|------|-----------|
|
|
| **Phase 1: Shield MVP** | Policy library, data mapping/ROPA, risk assessment, evidence upload, audit reports, auth, HIPAA + GDPR frameworks | 4-5 sessions | Nothing |
|
|
| **Phase 2: Consent Engine** | GitHub template repo, config-driven, deploy button, MIT license | 1 session | Phase 1 (or parallel) |
|
|
| **Phase 3: $49 PMS Integrations** | Pre-built connectors for 3-5 major practice management systems | 1-2 sessions | Phase 2 |
|
|
| **Phase 4: API Integrations** | Evidence collection via API (AWS, GCP, Railway, Supabase) | 2-3 sessions | Phase 1 |
|
|
| **Phase 5: Signal Tier 3 Bundle** | Shared dashboard + billing integration | 1 session | Phase 1 + Signal coordination |
|
|
|
|
---
|
|
|
|
## 9. Open Questions (For Kisa)
|
|
|
|
1. **Frameworks:** Start with HIPAA + GDPR as described? Or add SOC 2 at launch too?
|
|
2. **Practice management systems:** Which ones should we target first for the $49 integration? (DrChrono? PointClickCare? PracticeFusion? Kareo?)
|
|
3. **Consent Engine name:** "Open Consent" vs "AI Consent Engine" vs "STTIL Consent Builder" vs something else?
|
|
4. **Build order:** Shield MVP first, then Consent Engine? Or start Consent Engine in parallel?
|
|
5. **Signal Tier 3 pricing:** What's the price of Tier 3 relative to Tier 1/2? Does Shield inclusion justify a premium?
|
|
6. **Data residency:** MVP just documents where data lives, or do we need EU hosting from day one?
|
|
|
|
---
|
|
|
|
*This is a design draft. Please review and adjust before sharing with Claude Code for build.*
|