sttil/Signal
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
Signal/docs/superpowers/specs/2026-06-22-shield-architecture.md

7.5 KiB
Raw Blame History

STTIL Shield — Product Architecture

Design date: 2026-06-22 Design by: Pi Status: Draft — review by Kisa before sharing with Claude Code

1. Product Definition

What Shield is: A standalone compliance automation platform for healthcare-adjacent SaaS companies, startups, and small supplier operations. Think "Dash ComplyOps, but simpler and cheaper, with an AI Consent Addendum as the lead-gen engine."

What Shield is NOT:

  • Not DMEPOS-specific (that's Signal's lane)
  • Not a replacement for Vanta/Drata (different tier — Shield targets micro-SaaS)
  • Not a consulting service (self-serve compliance tooling)

Target customer:

  • Micro-SaaS companies that need HIPAA/SOC 2 readiness (1-20 employees)
  • Healthcare adjacent startups building on top of HIPAA-covered infrastructure
  • Small DME suppliers who want compliance basics without Signal (Shield standalone)
  • DMEPOS suppliers who want both: Shield + Signal bundle (optional upsell)

Core value proposition: "Get compliant in days, not months. Pre-built policies, automated evidence collection, and audit-ready reporting — starting at less than Dash ComplyOps."

2. Competitive Positioning

Competitor Price Frameworks Target Shield Advantage
Vanta $10K-$100K+/yr SOC 2, HIPAA, ISO, PCI Enterprise Too expensive for micro
Drata $7.5K-$100K+/yr SOC 2, HIPAA, ISO, PCI Mid-market Too expensive for micro
Secureframe $7.5K-$80K+/yr SOC 2, HIPAA, ISO, PCI Mid-market Too expensive for micro
Dash ComplyOps $3K/yr flat HIPAA, SOC 2, PCI, ISO, NIST Small teams Direct competitor — closest
Shield TBD (target $1.2K-$2.4K/yr) HIPAA-first, SOC 2, expand Micro-SaaS Cheaper + Consent Addendum hook

Differentiation strategy:

  • Price under Dash (target $100-200/mo instead of $250)
  • AI Consent Addendum is a unique lead-gen asset Dash can't match
  • Simpler UI — focused on HIPAA-first workflows
  • Optional Signal bundle for DMEPOS suppliers who also need documentation readiness

3. Feature Set (MVP)

Core Features (v1)

Feature Description Why
Policy Templates 12+ pre-built admin policies (HIPAA-focused) Instant compliance documentation
Evidence Collection Manual upload + API integrations for cloud infra Prove controls are active
Audit Reports One-click SOC 2 / HIPAA evidence bundles Answer auditor requests fast
Risk Assessment Simple asset register + risk scoring Foundational HIPAA requirement
User Management Unlimited users (team collaboration) Match Dash's offering
Framework Support HIPAA v1, SOC 2 v2, expand to PCI/ISO Start narrow, grow

AI Consent Addendum (Open-Source Lead Magnet)

Purpose: Drive leads to Shield. The addendum is a simple, open-source document generator that creates AI/healthcare consent forms. It showcases STTIL's compliance expertise and includes a subtle "Need the full compliance suite? Check out Shield." CTA.

Implementation:

  • Standalone single-page app (Vite/React or simple HTML/JS)
  • User fills in: company name, AI tool name, data types processed
  • Generates a formatted HIPAA-compliant consent document PDF
  • No login required for basic use
  • "Want automated policy management, evidence collection, and audit prep?" → links to Shield signup
  • Hosted at consent.sttilsolutions.com or similar

Why open source:

  • Builds brand trust and community
  • SEO magnet for "AI consent form healthcare HIPAA" searches
  • Low friction entry point — user sees STTIL quality before buying Shield

4. Technical Architecture

Option A: Standalone (Recommended)

Build Shield as a new, independent codebase. No shared infrastructure with Signal.

Stack:

  • Frontend: Vite/React (same stack as Signal — reuse patterns)
  • Backend: Python/FastAPI (same stack — reuse patterns)
  • Database: Supabase (separate project from Signal's DB)
  • Auth: Clerk (separate instance or same with org separation)
  • Hosting: Railway (separate project) + Vercel (separate deployment)

Pros:

  • Clean separation — Signal issues never affect Shield or vice versa
  • Independent pricing and scaling
  • Can sell standalone without bundling concerns
  • Easier to spin out or sell separately later

Cons:

  • More upfront build time
  • Separate Supabase project (extra $25/mo for Pro plan)

Option B: Signal Extension (Not Recommended)

Build Shield as a module inside the Signal codebase.

Why not: Already decided Shield is a standalone product. Sharing infrastructure couples two products with different pricing, compliance posture, and target customers. Avoid.

AI Consent Addendum Architecture

  • Standalone single-page app, Vite/React
  • No backend needed — PDF generation happens client-side (using a library like jsPDF or pdf-lib)
  • Hosted on Vercel under a subdomain
  • Links to Shield signup — no data collection on the addendum page itself (privacy-friendly)
  • Open-source repo under STTIL GitHub org

5. Pricing Tiers (Suggested)

Tier Price (monthly) Features Target
Free $0 AI Consent Addendum, 1 policy template Lead gen
Starter $99/mo 12 policies, evidence upload, audit reports Solopreneurs, tiny teams
Growth $199/mo Starter + API integrations, risk assessments, unlimited users Growing startups
Enterprise Custom Growth + dedicated support, custom frameworks, Signal bundle DMEPOS suppliers

Rationale:

  • Undercut Dash ($250/mo) at both Starter ($99) and Growth ($199)
  • Free tier = Consent Addendum (zero cost to STTIL, drives organic traffic)
  • Signal bundle upsell to $299/mo for suppliers who need both Signal + Shield

6. Go-to-Market

Consent Addendum as Growth Engine

  1. Developer discovers "AI consent form" via search
  2. Uses the free open-source tool → impressed by quality
  3. Sees "Need HIPAA compliance for your whole stack? Try Shield." CTA
  4. Signs up for Shield Starter ($99/mo)
  5. Upgrades to Growth when they need audit prep

Channels

  • SEO: "HIPAA compliance for startups," "AI consent form," "SOC 2 for micro-SaaS"
  • Content: Blog posts comparing Dash vs Shield, "I built HIPAA compliance in a weekend" type content
  • Signal cross-sell: When a DMEPOS supplier signs up for Signal, offer Shield bundle
  • Open-source community: GitHub stars, HN posts about the Consent Addendum

7. Build Phases

Phase Scope Est.
Phase 0: Consent Addendum Open-source mini-app, client-side PDF gen, hosted on Vercel 1 session
Phase 1: Shield MVP Policy templates, evidence upload, audit reports, user auth 3-4 sessions
Phase 2: Risk + Integrations Risk assessment module, API integrations (AWS, GCP, Railway) 2-3 sessions
Phase 3: Signal Bundle Shared dashboard for suppliers using both products 1 session

8. Open Questions (For Kisa)

  1. Pricing: Does $99/$199 feel right? Too low? Too high relative to Dash at $250?
  2. Frameworks: Start with HIPAA-only and add SOC 2 later? Or launch with both?
  3. Consent Addendum name: "AI Consent Addendum" vs "STTIL Consent Builder" vs something else?
  4. Signal bundle: A shared login/dashboard, or just a discount code?
  5. Timeline: Build Consent Addendum first (fast win) or wait for full Shield MVP?

This is a design draft. Please review and adjust before sharing with Claude Code for build.