## Architecture Assumptions

Below are the default assumptions made in this architecture. Assumptions marked **(Assumed)** are flexible and can change based on your needs. **(Recommended)** are best practices. **(Requires confirmation)** are high-impact decisions you should validate.

### Infrastructure Defaults

- **Cloud Platform**: Managed platforms (Vercel + Supabase) **(Assumed)**
  - **Why**: Zero DevOps overhead, $20-100/month, scales to 10K+ users
  - **Upgrade path**: Migrate to AWS/GCP when >100K users or compliance requires it
  - **Requires confirmation if**: You already have AWS credits or an existing cloud commitment

- **Architecture Pattern**: Monolith **(Recommended)**
  - **Why**: 3-5x faster to build than microservices, 50% lower infrastructure cost
  - **Upgrade path**: Modular monolith → Extract payment service → Full microservices at 15+ engineers
  - **Requires confirmation if**: You expect >10 backend engineers in year 1

- **Database**: PostgreSQL (Supabase or Neon) **(Recommended)**
  - **Why**: Handles relational data + JSONB for flexibility, largest hiring pool, free tier generous
  - **Alternative**: Neon if you need database branching for dev/staging environments
  - **Upgrade path**: Start with free tier, upgrade to Pro ($25/month) at 1K users

### Multi-Tenancy Defaults (B2B Products)

- **Tenant Isolation**: Shared database + Row-Level Security (RLS) **(Assumed)**
  - **Why**: Simpler than separate databases, 10x cheaper, works up to 10K tenants
  - **Upgrade path**: Separate databases only for HIPAA or customers >100K users each
  - **Requires confirmation if**: HIPAA compliance or customer contracts require isolated databases

- **Tenant Context**: JWT claims (`tenant_id` in token) **(Recommended)**
  - **Why**: Every request carries tenant context, enforced at database level
  - **Implementation**: Middleware extracts `tenant_id` from JWT, sets in RLS policy

### Real-Time Defaults (If Detected)

- **Real-time Transport**: Start with Redis Pub/Sub **(Assumed)**
  - **Why**: Simple, included with Redis, works up to 100K concurrent users
  - **Upgrade path**: Migrate to Kafka when >100K events/sec or need event replay
  - **Requires confirmation if**: You expect >1M messages/day from day 1

- **WebSocket vs SSE**: Server-Sent Events (SSE) for server → client only **(Recommended)**
  - **Why**: Simpler than WebSocket, works with serverless (Vercel)
  - **Upgrade path**: WebSocket when you need bidirectional (client → server also)

### Availability & Resilience Defaults

- **Availability Target**: 99.9% (43 minutes downtime/month) **(Assumed)**
  - **Why**: MVP acceptable, users tolerate brief outages, 99.99% costs 3x more (multi-region)
  - **Upgrade path**: 99.99% after $1M ARR or enterprise SLAs require it
  - **Requires confirmation if**: You're in healthcare/finance where uptime is critical

- **Backup & Recovery**: 5-minute backups (Supabase default) **(Recommended)**
  - **Why**: RPO (Recovery Point Objective) = 5 min max data loss
  - **RTO (Recovery Time Objective)**: 1 hour to restore service

### Security Defaults

- **Authentication**: Supabase Auth (if using Supabase) or Clerk **(Assumed)**
  - **Why**: Free tier generous, includes social auth, MFA ready
  - **Upgrade path**: Auth0 when enterprise customers require SSO/SAML
  - **Alternative**: Auth0 from day 1 if targeting enterprise (B2B >500 employees)

- **API Rate Limiting**: 100 req/min per user **(Recommended)**
  - **Why**: Prevents abuse, protects against DDoS, standard industry practice
  - **Implementation**: `@upstash/ratelimit` with Vercel KV

### Payment Defaults (E-commerce/SaaS Products)

- **Payment Processor**: Stripe **(Recommended)**
  - **Why**: Industry standard, best API, handles PCI compliance
  - **Alternative**: Paddle/LemonSqueezy if you want merchant of record (they handle tax/VAT)
  - **Requires confirmation if**: You need merchant of record (small team, no finance resources)

### AI/LLM Defaults (AI Agent Products)

- **LLM Provider**: Claude Sonnet 4.5 for complex, Haiku for simple **(Assumed)**
  - **Why**: Best quality/cost ratio, 80% queries can use Haiku (5x cheaper)
  - **Cost**: ~$30-50/month for 1K conversations (Haiku-first strategy)
  - **Upgrade path**: GPT-4 only if specific capabilities needed

- **Memory Strategy**: Last 10 messages + vector search for long-term **(Recommended)**
  - **Why**: Balances cost and context, vector search for retrieval when needed
  - **Vector DB**: Supabase pgvector (free) or Pinecone ($70/month if >100K vectors)

### File Storage Defaults (File Upload Products)

- **File Storage**: Cloudflare R2 **(Recommended)**
  - **Why**: Zero egress fees (S3 charges $90/TB), S3-compatible API
  - **Cost**: $0.015/GB/month (S3 is $0.023/GB + egress)
  - **Alternative**: Uploadthing if Next.js (easiest integration, 2GB free)

### Email Defaults

- **Transactional Email**: Resend **(Recommended)**
  - **Why**: Best DX, 3K emails/month free, React email templates
  - **Alternative**: SendGrid if >100K emails/month (cheaper at scale)

## API Specification

### Rate Limiting

**Default**: 100 requests/minute per user **(Assumed)**

This prevents abuse and protects against DDoS attacks. The limit is configurable and can be adjusted based on your user behavior.

**Upgrade path**:
- Start: 100 req/min per user (free tier)
- Upgrade: 1000 req/min for Pro users
- Enterprise: Custom limits per customer SLA

## Product Type Analysis

Based on your requirements, I've identified this as a **[Type 1]** and **[Type 2]** application.

This means the architecture needs to address:
- [Critical domain-specific concern 1]
- [Critical domain-specific concern 2]
- [Critical domain-specific concern 3]

I'll include specialized architecture depth sections for these concerns in the blueprint.

User: I want to build a SaaS tool for managing customer support tickets. Teams can collaborate on tickets, and we'll integrate with Slack and email.

**When user asks "What should I use?" provide comprehensive recommendations:**

```markdown
Tech Stack Recommendation

Based on your requirements:
- Real-time collaboration (WebSocket)
- User authentication with social login
- File uploads
- 500 expected users
- Team has React experience

Recommended Stack:

**Frontend:**
- Framework: Next.js 14 (App Router)
- Reasoning: You know React, Next.js adds SSR, API routes, and excellent Vercel deployment DX
- Alternative: SvelteKit if you want to learn something new (better performance, simpler state management)

**Backend:**
- Framework: Next.js API Routes
- Reasoning: Keeps everything in one repo, simpler deployment, good for <10K users
- Alternative: Separate Express.js API if you expect to scale to microservices later

**Database:**
- Primary: Supabase (PostgreSQL)
- Reasoning: Managed Postgres + built-in auth + realtime + storage. Free tier supports 500 users easily.
- Alternative: Neon (serverless Postgres) if you want database branching for dev/staging

**Real-time:**
- Solution: Supabase Realtime (WebSocket subscriptions)
- Reasoning: Built into Supabase, no extra service needed
- Alternative: Pusher or Ably if you need more complex presence/channels

**File Storage:**
- Solution: Supabase Storage (S3-compatible)
- Reasoning: Integrated with auth, 1GB free tier
- Alternative: Cloudflare R2 if you have heavy file traffic (no egress fees)

**Auth:**
- Solution: Supabase Auth
- Reasoning: Built-in, supports social login (Google, GitHub), MFA ready
- Alternative: Clerk if you want the best DX and don't mind $25/mo

**Deployment:**
- Frontend: Vercel
- Database: Supabase Cloud
- Reasoning: Both have generous free tiers, excellent DX, automatic scaling

**Total monthly cost:**
- Free tier: $0/mo (handles first 500 users)
- With Pro tiers: $45/mo (Vercel $20 + Supabase $25)

**Why not [other options]:**
- ❌ AWS/GCP/Azure: Overkill for 500 users, higher ops complexity
- ❌ Firebase: Good but limits you to NoSQL, you have relational data
- ❌ Custom backend: More flexible but adds 30% to development time

Communication Pattern Selection

Service A: Next.js Frontend
Service B: API Server
Service C: Background Worker

A → B (User requests):
- Pattern: REST over HTTPS
- Why: Standard request-response, user-initiated
- Auth: JWT in Authorization header
- Data format: JSON
- Retry: 3 attempts with exponential backoff on 5xx

A ← B (Real-time updates):
- Pattern: WebSocket (Supabase Realtime)
- Why: Need instant updates when other users make changes
- Auth: JWT passed on connection
- Data format: JSON events
- Retry: Auto-reconnect with exponential backoff

B → C (Background jobs):
- Pattern: Message queue (BullMQ + Redis)
- Why: Async processing (email sending, file processing)
- Auth: Internal network only
- Data format: JSON job payloads
- Retry: 5 attempts with exponential backoff, then DLQ

B → External API (Stripe):
- Pattern: REST over HTTPS
- Why: Third-party integration
- Auth: API key in header (from env var)
- Data format: JSON
- Retry: 3 attempts on network errors, no retry on 4xx client errors

Security Architecture

**Authentication Strategy:**
- Provider: Supabase Auth
- Methods supported: Email/password, Google OAuth, GitHub OAuth
- Session management: JWT tokens with 1-hour expiry, refresh tokens with 30-day expiry
- MFA: Available for admin users (TOTP-based)
- Password requirements: Min 8 chars, must include uppercase, lowercase, number

**API Security:**

Per-Endpoint Security Checklist:
| Endpoint | Auth | Rate Limit | Input Validation | Output Sanitization |
|----------|------|------------|------------------|---------------------|
| POST /api/tasks | JWT required | 100 req/min per user | Zod schema | SQL injection safe (Prisma ORM) |
| GET /api/tasks | JWT required | 1000 req/min per user | Query param validation | XSS-safe (framework escaping) |
| POST /api/auth/signup | Public | 5 req/min per IP | Email + password validation | N/A |
| POST /api/webhooks/stripe | Webhook signature | 100 req/min global | Stripe signature verification | N/A |

Rate Limiting Implementation:
- Tool: @upstash/ratelimit with Vercel KV
- Per-user: 100 requests/min for authenticated endpoints
- Per-IP: 20 requests/min for public endpoints (signup, login)
- Response: 429 with Retry-After header

CORS Configuration:
- Allowed origins: [https://yourdomain.com, https://staging.yourdomain.com]
- Allowed methods: [GET, POST, PUT, DELETE]
- Allowed headers: [Authorization, Content-Type]
- Credentials: true

Security Headers:
```typescript
// next.config.js
{
  headers: [
    {
      key: 'X-Frame-Options',
      value: 'DENY'
    },
    {
      key: 'X-Content-Type-Options',
      value: 'nosniff'
    },
    {
      key: 'Strict-Transport-Security',
      value: 'max-age=31536000; includeSubDomains'
    },
    {
      key: 'Content-Security-Policy',
      value: "default-src 'self'; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline';"
    }
  ]
}

### Observability Specification Example

**Comprehensive observability architecture:**

```markdown
Observability & Monitoring

**Logging Strategy:**

Structure: JSON logs with standard fields
Provider: Vercel logs + Sentry for errors

Standard Log Format:
```json
{
  "timestamp": "2026-02-07T12:34:56.789Z",
  "level": "info" | "warn" | "error",
  "service": "api" | "frontend" | "worker",
  "trace_id": "uuid",
  "user_id": "hashed_user_id | anonymous",
  "action": "create_task | update_task | ...",
  "duration_ms": 123,
  "status": "success | error",
  "error_code": "ERR_CODE | null",
  "metadata": {}
}

// GET /api/health
{
  "status": "healthy" | "degraded" | "down",
  "timestamp": "ISO 8601",
  "checks": {
    "database": {
      "status": "healthy",
      "latency_ms": 12,
      "last_check": "ISO 8601"
    },
    "redis": {
      "status": "healthy",
      "latency_ms": 3
    },
    "external_apis": {
      "stripe": "healthy",
      "sendgrid": "healthy"
    }
  },
  "version": "1.2.3",
  "uptime_seconds": 86400
}

---

### Next Steps Guide Example

**Comprehensive next steps with actionable commands:**

```markdown
## Next Steps

You now have a complete architecture blueprint. Here's how to turn it into a working product:

### 🚀 Immediate Actions (Do This Next)

**1. Bootstrap Your Project**
```bash
/architect:scaffold

/architect:generate-data-model

/architect:setup-env

/architect:sync-backlog

/architect:well-architected

/architect:setup-cicd

/architect:publish-api-docs

/architect:security-scan

/architect:export-diagrams

/architect:stakeholder-doc

---

## Prescriptive Technology Decision Frameworks

**Purpose**: Make smart technology recommendations based on constraints (budget, team, compliance, scale), not preferences. Be prescriptive, not interrogative. Guide non-technical founders through decisions they're not equipped to make on their own.

**Philosophy**: Ask what they HAVE (team, budget, compliance needs), not what they WANT. Recommend based on risk reduction, hiring optimization, and cost optimization.

### Pricing Disclaimer

**All pricing in these frameworks is for planning purposes only — not guarantees.**

**Default Assumptions** (unless otherwise stated):
- **Region**: US East (N. Virginia) for AWS/Azure/GCP
- **OS**: Linux for compute instances
- **Billing**: On-demand pricing, not reserved instances or annual contracts
- **Currency**: USD, excludes taxes and VAT
- **Data transfer**: Egress costs noted where significant, otherwise excluded
- **Pricing date**: Estimates as of early 2025

**IMPORTANT**:
- Pricing can drift 10-30% from actual costs
- Always verify current pricing before making decisions
- Free tiers may require credit card verification or have time limits
- Add your region's data transfer and tax costs
- Enterprise discounts may significantly change costs

Use these cost comparisons to understand relative differences (Stripe vs Paddle, AWS vs managed platforms), not as contract-ready estimates.

### How to Use These Frameworks

1. **Gather constraints** using the questions in Step 1 (Essential Questions #6)
2. **Run through the decision tree** for each technology category
3. **Make ONE clear recommendation** — don't force founders to choose
4. **Lead with business impact** — cost, hiring, risk, time
5. **Provide alternatives** — when to consider something else
6. **Explain why NOT** — when to avoid certain options
7. **Label all pricing with context** — Always include scale, region, or usage assumptions with costs

---

### 1. Cloud Provider Selection

**Constraint Questions** (already asked in Step 1 #6):
- Budget, team DevOps capability, compliance requirements, existing Microsoft/cloud accounts

**Decision Logic**:

**Output Format**:
```markdown
## Cloud Provider Recommendation

**Recommended**: [Service name]

**Business reasoning**:
- [Point about cost, hiring, risk, or time]
- [Point about cost, hiring, risk, or time]
- [Point about cost, hiring, risk, or time]

**Cost**: [Monthly range with context]

**Alternative**: [When to consider something else]

**Don't use**: [What to avoid and why]

IF team < 5 backend engineers OR MVP stage:
  → RECOMMEND: Monolith (single deployable unit)
  → BUSINESS REASONING:
    - 3-5x faster to build than microservices
    - Single deployment = simpler debugging
    - No network overhead between services
    - Easier for small teams to maintain
    - Can always split later when you have 10+ engineers
  → COST: Simpler infrastructure = 50-70% lower hosting costs
  → ALTERNATIVE: "Modular monolith if you have 3+ clear business domains (user management, payments, content)"
  → DON'T USE: Microservices at this stage (adds 30-40% complexity overhead)

ELSE IF team = 5-10 engineers AND 3+ clear bounded contexts:
  → RECOMMEND: Modular Monolith
  → BUSINESS REASONING:
    - Organized into modules (like microservices) but deployed as one
    - Teams can work independently on modules
    - Single deployment keeps operations simple
    - Easy path to split into microservices later if needed
  → EXAMPLE: "User module, Order module, Payment module — all in one codebase"
  → COST: Same infrastructure cost as monolith, better code organization
  → ALTERNATIVE: "Microservices if different modules need different scaling (e.g., payment processing scales differently than user profiles)"

ELSE IF team > 10 engineers AND services have different scaling needs:
  → RECOMMEND: Microservices (but start with 3-5 services, not 30)
  → BUSINESS REASONING:
    - Teams can deploy independently
    - Scale services individually (CPU-heavy vs memory-heavy)
    - Different tech stacks per service if needed
    - BUT: adds complexity (service mesh, API gateway, distributed tracing)
  → COST: 2-3x higher infrastructure costs (load balancers, service mesh, monitoring)
  → CAVEAT: "Need dedicated DevOps engineer(s). If you don't have DevOps, stick with modular monolith."
  → DON'T START WITH: 20+ microservices (start with 3-5, split more as you grow)

ELSE IF compliance requires service isolation (e.g., PCI DSS, HIPAA):
  → RECOMMEND: Hybrid (monolith + isolated microservice for sensitive data)
  → BUSINESS REASONING:
    - Isolate payment/PHI processing in separate service
    - Main app stays monolith for speed
    - Reduces compliance scope (only one service needs PCI/HIPAA audit)
  → EXAMPLE: "Main app (monolith) + Payment service (microservice with PCI compliance)"
  → COST: Higher than pure monolith, lower than full microservices

ELSE IF different services written in different languages (e.g., Python ML, Node API):
  → RECOMMEND: Polyglot microservices (but only 2-3 services)
  → BUSINESS REASONING:
    - ML models need Python (scikit-learn, TensorFlow)
    - API might be better in Node.js or Go
    - Allows using best tool for each job
  → COST: Higher ops complexity, need language-specific expertise
  → CAVEAT: "Only do this if you have strong technical reasons, not just preference"

ELSE (default for most startups):
  → RECOMMEND: Monolith
  → BUSINESS REASONING:
    - Ship faster, iterate faster
    - Refactor easily (everything in one codebase)
    - Debug easily (single log stream)
    - You can always split into microservices when revenue justifies complexity
  → COST: Lowest infrastructure and operational costs

## Architecture Pattern Recommendation

**Recommended**: [Monolith / Modular Monolith / Microservices / Hybrid]

**Business reasoning**:
- [Speed to market or team velocity impact]
- [Operational complexity or cost impact]
- [Scaling or organizational impact]

**Cost**: [Infrastructure cost comparison]

**Alternative**: [When to consider different pattern]

**Migration path**: [How to evolve this architecture as you grow]

## Architecture Pattern Recommendation

**Recommended**: Monolith

**Business reasoning**:
- 3-5x faster to build than microservices — ship MVP in weeks not months
- Single deployment means no distributed systems complexity
- 50-70% lower hosting costs (one server vs 5+ services + load balancers)
- Easier to hire for — most developers know monoliths, fewer know microservices well

**Cost**: $20-100/month infrastructure (vs $200-500/month for microservices)

**Alternative**: If you grow beyond 10 backend engineers or have services with very different scaling needs (e.g., CPU-heavy image processing vs memory-heavy caching), migrate to microservices then. Netflix, Amazon, and Uber all started as monoliths.

**Migration path**: Start monolith → Modular monolith (organize code into modules) → Extract high-value services first (e.g., payment processing) → Full microservices if team > 15 engineers

**Don't use**: Microservices at MVP stage. You'll spend 30-40% of dev time on infrastructure (service mesh, API gateway, distributed tracing) instead of features. The "we might need to scale" argument is premature — you can migrate to microservices in 2-3 months when you actually need it.

IF team has framework experience (React/Next, Vue/Nuxt, Svelte):
  → RECOMMEND: Their existing framework
  → BUSINESS REASONING:
    - Productivity on day 1
    - Learning new framework = 1-2 months slower
    - Team knowledge > framework features
  → CAVEAT: "Unless outdated (Angular.js, Backbone) — then recommend migration"

ELSE IF AI integration needed AND (team = none or small):
  → RECOMMEND: Next.js (React) + Python backend (FastAPI)
  → BUSINESS REASONING:
    - Next.js has best AI SDK support (Vercel AI SDK)
    - Python has all AI libraries (OpenAI, LangChain, transformers)
    - Largest AI hiring pool
  → COST: Free frameworks, hosting $20-200/month
  → ALTERNATIVE: "SvelteKit if performance critical, but smaller AI ecosystem"

ELSE IF SEO critical (content site, marketplace):
  → RECOMMEND: Next.js or Nuxt (meta framework with SSR)
  → BUSINESS REASONING:
    - Server-side rendering = better SEO
    - Meta frameworks handle routing, data fetching, optimization
    - Better Core Web Vitals out of the box
  → ALTERNATIVE: "SvelteKit also supports SSR and is faster, but smaller ecosystem"

ELSE IF real-time features needed:
  → RECOMMEND: Next.js or SvelteKit
  → BUSINESS REASONING:
    - Need SSR + real-time
    - Good WebSocket/SSE support
    - Built-in API routes simplify architecture

ELSE IF team = none (will hire):
  → RECOMMEND: Next.js (React) + TypeScript
  → BUSINESS REASONING:
    - Largest hiring pool (React most popular)
    - TypeScript catches bugs pre-production
    - Most third-party components available
  → COST: Free, hosting $20-200/month
  → ALTERNATIVE: "SvelteKit if you value performance over ecosystem (10x fewer developers)"

ELSE (default):
  → RECOMMEND: Next.js (React) + TypeScript
  → BUSINESS REASONING: Safe default, largest ecosystem, easiest hiring

IF team has database experience:
  → RECOMMEND: Their existing database
  → BUSINESS REASONING: Database choice rarely matters at MVP. Speed > features.
  → CAVEAT: "Unless outdated (MySQL 5.x, MongoDB < 4.0)"

ELSE IF highly relational data (e-commerce, SaaS, multi-tenant):
  → RECOMMEND: PostgreSQL (Supabase, Neon, or AWS RDS)
  → BUSINESS REASONING:
    - Handles complex queries and relationships
    - JSONB for flexibility when needed
    - Best free tiers (Supabase 500MB, Neon 0.5GB)
    - Largest ecosystem and hiring pool
  → COST: $0-25/month (free tier) → $25-100/month (production)
  → ALTERNATIVE: "MySQL if better write performance needed, but PostgreSQL more feature-rich"

ELSE IF search critical (content, marketplace, docs):
  → RECOMMEND: PostgreSQL + dedicated search (Typesense, Meilisearch, Algolia)
  → BUSINESS REASONING:
    - PostgreSQL for main data
    - Dedicated search engine for speed/relevance
    - Don't make one database do both jobs
  → COST: PostgreSQL $0-25/month + Search $0-50/month
  → ALTERNATIVE: "Algolia easiest but expensive at scale ($1/1K searches)"

ELSE IF unstructured data OR rapid prototyping:
  → RECOMMEND: PostgreSQL with JSONB (not MongoDB)
  → BUSINESS REASONING:
    - JSONB gives flexibility + relational power
    - Better long-term than starting with MongoDB
    - Easier to add structure as product evolves
  → COST: $0-25/month (free tier)
  → WHY NOT MONGODB: "PostgreSQL JSONB gives 80% of flexibility + full SQL"

ELSE IF scale > 100K users year 1:
  → RECOMMEND: PostgreSQL (AWS RDS or Supabase)
  → BUSINESS REASONING:
    - Proven at scale
    - Read replicas and connection pooling
    - Mature monitoring tools
  → COST: $50-200/month with connection pooling

ELSE (default):
  → RECOMMEND: PostgreSQL (Supabase or Neon)
  → BUSINESS REASONING:
    - Best free tier
    - Supabase includes auth + storage + realtime
    - Easiest to hire for
  → COST: $0/month (free) → $25/month (pro)

IF budget = free tier only AND scale < 10K users:
  → RECOMMEND: Supabase Auth (if using Supabase) or Clerk
  → BUSINESS REASONING:
    - Supabase: included free with database
    - Clerk: best free tier (10K MAU), best DX
  → COST: $0/month
  → CAVEAT: "Free tiers enough for MVP, upgrade when you hit limits"

ELSE IF compliance required (SOC 2, HIPAA, enterprise):
  → RECOMMEND: Auth0
  → BUSINESS REASONING:
    - Best compliance certifications
    - Enterprise SSO support
    - Mature audit logs
    - Trusted by banks/healthcare
  → COST: Free (7K MAU) → $240/month (Essentials) → Custom (Enterprise)
  → ALTERNATIVE: "AWS Cognito if all-in on AWS, but worse DX"

ELSE IF need advanced features (passwordless, magic links, beautiful UI):
  → RECOMMEND: Clerk
  → BUSINESS REASONING:
    - Best pre-built UI components
    - Fastest implementation
    - Modern, polished experience
  → COST: $0 (10K MAU) → $25/month (Pro)
  → ALTERNATIVE: "Auth0 if need more compliance features"

ELSE IF scale > 50K users:
  → RECOMMEND: Auth0 or build on Supabase
  → COST COMPARISON at 50K MAU:
    - Auth0: ~$1,200/month
    - Clerk: ~$800/month
    - Supabase: ~$25-100/month (included with database)
  → DECISION: "Budget-constrained → Supabase. Enterprise features → Auth0"

ELSE (default: small-medium, standard features):
  → RECOMMEND: Clerk (standalone) or Supabase Auth (if using Supabase DB)
  → BUSINESS REASONING:
    - Clerk: best DX, great free tier
    - Supabase: included with database, no extra service
  → COST: $0-25/month

IF no DevOps AND budget < $500:
  → RECOMMEND: Vercel (frontend + serverless API) or Railway (traditional server)
  → BUSINESS REASONING:
    - Zero DevOps work
    - Git push = deploy
    - Auto-scaling
    - Preview deployments
    - Monitoring included
  → COST: Vercel $0-20/month, Railway $5-50/month
  → WHEN TO USE WHICH:
    - Vercel: Next.js/React, API is serverless functions
    - Railway: Persistent servers (WebSockets, background jobs)

ELSE IF backend = WebSocket OR real-time:
  → RECOMMEND: Railway or Render
  → BUSINESS REASONING:
    - Vercel functions timeout at 60s
    - Real-time needs persistent connections
    - Railway/Render support this
  → COST: Railway $5-100/month, Render free (sleeps) → $7-100/month

ELSE IF backend = Background jobs (video, email, AI):
  → RECOMMEND: Railway (persistent workers) or AWS Lambda (event-driven)
  → BUSINESS REASONING:
    - Jobs run longer than serverless limits
    - Railway = simple
    - Lambda = cheaper at scale but complex
  → COST: Railway $20-200/month, Lambda pay-per-use ($0.20 per million requests)

ELSE IF scale > 100K requests/day:
  → RECOMMEND: AWS (ECS Fargate or Lambda) or Railway Pro
  → BUSINESS REASONING:
    - Managed platforms get expensive at scale
    - AWS gives more control + lower per-request cost
  → COST: AWS $100-500/month, Railway $100-500/month

ELSE (default: standard web app, small-medium scale):
  → RECOMMEND: Vercel (if Next.js) or Render (other frameworks)
  → BUSINESS REASONING:
    - Easiest deployment
    - Best DX
    - Free tier generous for MVP
    - Upgrade path when needed
  → COST: $0-20/month

IF user uploads (images/video) AND volume < 100 GB:
  → RECOMMEND: Uploadthing (if Next.js) or Cloudflare R2
  → BUSINESS REASONING:
    - Uploadthing: easiest integration, free tier (2GB)
    - R2: no egress fees (huge savings at scale)
    - Both CDN-backed
  → COST: Uploadthing $0-20/month, R2 ~$1.50/100GB/month (no egress!)
  → ALTERNATIVE: "S3 if AWS-heavy, but watch egress costs ($90/TB)"

ELSE IF public CDN delivery (images/videos on website):
  → RECOMMEND: Cloudflare R2
  → BUSINESS REASONING:
    - Zero egress fees (S3 charges $90/TB)
    - S3-compatible API
    - Built-in CDN
  → COST COMPARISON at 1TB storage + 5TB egress/month:
    - R2: $15/month
    - S3: $473/month ($23 storage + $450 egress)
  → SAVINGS: 97% cheaper for high-egress workloads

ELSE IF private access (authenticated, time-limited URLs):
  → RECOMMEND: S3 (if AWS) or R2 with presigned URLs
  → BUSINESS REASONING:
    - Both support presigned URLs for security
    - R2 cheaper
  → COST: R2 $0.015/GB/month, S3 $0.023/GB/month + egress

ELSE IF volume > 1 TB:
  → RECOMMEND: Cloudflare R2 or Wasabi
  → COST COMPARISON at 5TB storage + 10TB egress:
    - R2: $75/month (storage only, no egress)
    - Wasabi: $30/month (flat pricing)
    - S3: $1,015/month ($115 storage + $900 egress)

ELSE IF backups:
  → RECOMMEND: Cloudflare R2 or Backblaze B2
  → BUSINESS REASONING:
    - Cheapest storage
    - Backups accessed rarely
  → COST: Backblaze $5/TB/month, R2 $15/TB/month

ELSE (default: small scale, user uploads):
  → RECOMMEND: Uploadthing (if Next.js) or Supabase Storage (if using Supabase)
  → BUSINESS REASONING: Simplest setup, generous free tiers
  → COST: $0-10/month

IF volume < 3K/month AND transactional:
  → RECOMMEND: Resend
  → BUSINESS REASONING:
    - Best developer experience
    - 3K emails/month free
    - Built for developers, not marketers
  → COST: $0 (3K emails) → $20/month (50K emails)
  → ALTERNATIVE: "Postmark if you value deliverability over DX (100/month free)"

ELSE IF volume < 100/day AND transactional:
  → RECOMMEND: SendGrid
  → BUSINESS REASONING:
    - 100 emails/day free forever
    - Good for early MVP testing
  → COST: $0 (100/day) → $20/month (40K emails)

ELSE IF marketing (newsletters, campaigns):
  → RECOMMEND: ConvertKit or Mailchimp
  → BUSINESS REASONING:
    - Purpose-built for marketing
    - Segmentation, campaigns, automation
    - Resend/SendGrid are transactional only
  → COST: ConvertKit $0 (1K subscribers) → $29/month (3K subscribers)

ELSE IF volume > 100K/month:
  → RECOMMEND: AWS SES or SendGrid
  → COST COMPARISON at 500K emails/month:
    - SES: ~$50/month (cheapest, complex setup)
    - SendGrid: ~$90/month
    - Resend: ~$150/month

ELSE (default: transactional, < 50K/month):
  → RECOMMEND: Resend
  → BUSINESS REASONING:
    - Best DX
    - React email templates
    - API-first
  → COST: $0-20/month

IF budget = free tier only:
  → RECOMMEND: Sentry (errors) + Vercel Analytics (if Vercel) or PostHog (product analytics)
  → BUSINESS REASONING:
    - Sentry free: 5K errors/month
    - Vercel Analytics: free with Vercel
    - PostHog free: 1M events/month
  → COST: $0/month
  → CAVEAT: "Free tiers enough for MVP, upgrade at limits"

ELSE IF priority = catching errors (crashes, exceptions):
  → RECOMMEND: Sentry
  → BUSINESS REASONING:
    - Best error tracking
    - Source maps and stack traces
    - Integrates everywhere
    - Industry standard
  → COST: $0 (5K errors/month) → $29/month (50K errors)

ELSE IF priority = user behavior (analytics, funnels, retention):
  → RECOMMEND: PostHog
  → BUSINESS REASONING:
    - Product analytics + session replay + feature flags
    - All-in-one platform
    - Open source
    - Generous free tier
  → COST: $0 (1M events/month) → Pay as you go
  → ALTERNATIVE: "Mixpanel or Amplitude for enterprise, but expensive"

ELSE IF priority = performance (slow pages, API latency):
  → RECOMMEND: Vercel Analytics (if Vercel) or Datadog (complex infrastructure)
  → BUSINESS REASONING:
    - Vercel: built-in, zero config
    - Datadog: full observability but expensive
  → COST: Vercel $0-25/month, Datadog $0 (5 hosts) → $180+/month

ELSE IF team > 5 developers:
  → RECOMMEND: Sentry + PostHog + Datadog (or New Relic)
  → BUSINESS REASONING:
    - Need full observability: errors + analytics + performance
    - Worth cost with bigger team
  → COST: ~$100-500/month total

ELSE (default: small team, MVP):
  → RECOMMEND: Sentry (errors) + PostHog (analytics)
  → BUSINESS REASONING: Covers 80% of needs, generous free tiers
  → COST: $0-50/month

IF subscription business AND international sales AND < 5 products:
  → RECOMMEND: Stripe
  → BUSINESS REASONING:
    - Industry standard for subscriptions
    - Best API and developer experience
    - Handles PCI compliance automatically
    - Supports 135+ currencies
    - Extensive ecosystem (payment links, invoices, tax calculation)
  → COST: 2.9% + $0.30 per transaction (US), slightly higher international
  → ALTERNATIVE: "Paddle if you want merchant of record (they handle tax/VAT)"

ELSE IF need merchant of record (you don't want to handle tax/VAT):
  → RECOMMEND: Paddle or LemonSqueezy
  → BUSINESS REASONING:
    - They become merchant of record (handle all tax compliance)
    - You get net revenue, they handle VAT/sales tax globally
    - Simpler compliance (no Stripe Tax subscription needed)
    - Better for small teams without finance/legal resources
  → COST: 5% + $0.50 per transaction (includes tax handling)
  → COST COMPARISON at $10K MRR:
    - Stripe: $290 + $99/mo Stripe Tax = ~$389/month
    - Paddle/LemonSqueezy: ~$500/month (but includes full tax compliance)
  → DECISION: "Worth the extra cost if you're < 5 people and don't have finance team"

ELSE IF digital products (SaaS, e-books, courses) AND small team:
  → RECOMMEND: LemonSqueezy
  → BUSINESS REASONING:
    - Merchant of record (they handle tax)
    - Built for digital products
    - Simpler than Stripe for solo founders
    - No need for separate tax solution
  → COST: 5% + $0.50 per transaction
  → ALTERNATIVE: "Stripe if you need more customization or plan to scale beyond $1M ARR"

ELSE IF physical products OR marketplaces:
  → RECOMMEND: Stripe
  → BUSINESS REASONING:
    - Connect API for marketplaces (split payments)
    - Better fraud detection for physical goods
    - More payment methods (Apple Pay, Google Pay, etc.)
  → COST: 2.9% + $0.30 base + 0.25% for Connect

ELSE IF usage-based pricing (metered billing):
  → RECOMMEND: Stripe
  → BUSINESS REASONING:
    - Best metered billing support
    - Real-time usage reporting
    - Flexible pricing models (tiered, volume, etc.)
  → ALTERNATIVE: "Chargebee if you need very complex billing logic"

ELSE IF enterprise customers (invoicing, POs, annual contracts):
  → RECOMMEND: Stripe (with Invoicing) or Chargebee
  → BUSINESS REASONING:
    - Stripe Invoicing supports NET 30/60 terms
    - Can handle POs and manual payments
    - ACH/wire transfer support
  → COST: Stripe 0.4% for invoices (capped at $2), Chargebee starts at $249/month

ELSE (default: most startups):
  → RECOMMEND: Stripe
  → BUSINESS REASONING:
    - Industry standard
    - Best documentation and community
    - Easiest to hire developers who know it
    - Most third-party integrations
  → COST: 2.9% + $0.30 per transaction

IF collaborative editing (Google Docs-style) OR gaming:
  → RECOMMEND: WebSocket with Operational Transform or CRDT library
  → BUSINESS REASONING:
    - Need bidirectional, low-latency communication (< 100ms)
    - Server needs to push updates to all clients instantly
    - Complex conflict resolution requires stateful connections
  → IMPLEMENTATION: Socket.io or native WebSocket + Yjs (CRDT library)
  → COST: Server must handle persistent connections (use Railway/Render, not Vercel serverless)
  → ALTERNATIVE: "Pusher Channels if you don't want to manage WebSocket infrastructure"

ELSE IF chat application OR live updates with user presence:
  → RECOMMEND: WebSocket (self-hosted) or Pusher/Ably (managed)
  → BUSINESS REASONING:
    - WebSocket: Full control, cheaper at scale (> 10K users), but you manage infrastructure
    - Pusher/Ably: Managed service, faster to implement, expensive at scale
  → COST COMPARISON at 10K concurrent users:
    - Self-hosted WebSocket (Railway): ~$50-100/month
    - Pusher: ~$500/month
    - Ably: ~$300/month
  → DECISION: "Start with Pusher/Ably for MVP, migrate to self-hosted at 5K+ concurrent users"

ELSE IF live dashboards OR stock tickers (server → client only, no client → server):
  → RECOMMEND: Server-Sent Events (SSE)
  → BUSINESS REASONING:
    - Simpler than WebSocket (HTTP-based, no special protocol)
    - Auto-reconnect built in
    - Only need server → client (not bidirectional)
    - Works with serverless (Vercel supports SSE)
  → COST: Same as regular HTTP requests
  → ALTERNATIVE: "WebSocket if you later need bidirectional communication"

ELSE IF notifications OR non-critical updates (5-10 second delay acceptable):
  → RECOMMEND: Polling with exponential backoff OR SSE
  → BUSINESS REASONING:
    - Polling: Simplest to implement, works everywhere
    - SSE: Better than polling (no wasted requests), still simple
  → COST: Polling can be expensive (1 request/sec = 2.6M requests/month per user)
  → IMPLEMENTATION: Poll every 30s when active, 5min when idle
  → ALTERNATIVE: "SSE is almost always better than polling — use SSE unless browser support is an issue"

ELSE IF building for scale (> 100K concurrent users):
  → RECOMMEND: Managed service (Ably or AWS AppSync) or self-hosted with message broker
  → BUSINESS REASONING:
    - Ably: Scales to millions, handles edge cases (reconnection, message ordering)
    - AWS AppSync: GraphQL subscriptions, integrates with AWS ecosystem
    - Self-hosted: Redis Pub/Sub + Socket.io cluster mode (complex but cheapest at scale)
  → COST COMPARISON at 100K concurrent users:
    - Ably: ~$2,000/month
    - AWS AppSync: ~$500-1,500/month (usage-based)
    - Self-hosted: ~$500-1,000/month (infrastructure + Redis)

ELSE IF mobile app with background notifications:
  → RECOMMEND: Firebase Cloud Messaging (FCM) or APNs + SSE for in-app
  → BUSINESS REASONING:
    - Push notifications need native platform services (FCM for Android, APNs for iOS)
    - SSE or WebSocket for in-app real-time updates
  → COST: FCM/APNs free, SSE/WebSocket as above

ELSE (default: simple real-time features, MVP):
  → RECOMMEND: Supabase Realtime (if using Supabase) or Server-Sent Events
  → BUSINESS REASONING:
    - Supabase Realtime: Free, built-in, database subscriptions out of the box
    - SSE: Simplest to implement, no special infrastructure
  → COST: Supabase Realtime included with database, SSE same as HTTP

IF jobs < 1 minute AND serverless-friendly (stateless):
  → RECOMMEND: AWS Lambda (event-driven) or Vercel/Railway cron jobs
  → BUSINESS REASONING:
    - Lambda: Pay per execution ($0.20 per million requests), scales to zero
    - Vercel Cron: Simple, built-in, good for scheduled jobs
    - Railway Cron: Similar to Vercel but for non-Next.js apps
  → COST: Lambda ~$1-5/month for typical usage, Vercel/Railway cron included
  → USE FOR: Email sending, webhook processing, data syncing, scheduled reports
  → ALTERNATIVE: "BullMQ if jobs become too complex for Lambda's 15-min limit"

ELSE IF jobs > 5 minutes (video encoding, large file processing, AI inference):
  → RECOMMEND: Railway workers + BullMQ + Redis OR AWS Batch
  → BUSINESS REASONING:
    - Railway workers: Persistent processes, can run indefinitely
    - BullMQ: Robust job queue (retries, priority, scheduled jobs)
    - Redis: Queue storage (Upstash has good free tier)
    - AWS Batch: For very long jobs (hours), but complex setup
  → COST: Railway $20-100/month (workers) + Upstash Redis $0-10/month
  → ALTERNATIVE: "AWS Batch if jobs run > 1 hour and you're AWS-heavy"

ELSE IF using Python (data science, ML, AI):
  → RECOMMEND: Celery + Redis OR Temporal
  → BUSINESS REASONING:
    - Celery: Standard Python task queue, huge ecosystem
    - Temporal: More robust (durable workflows), better for complex orchestration
    - Both work well with Python ML libraries (Pandas, TensorFlow, etc.)
  → COST: Self-hosted (Railway) $20-50/month + Redis $0-10/month
  → ALTERNATIVE: "AWS Step Functions if all-in on AWS and need visual workflow designer"

ELSE IF complex workflows (multi-step, conditional, human-in-the-loop):
  → RECOMMEND: Temporal OR Inngest
  → BUSINESS REASONING:
    - Temporal: Durable workflows, handles failures gracefully, complex state machines
    - Inngest: Simpler than Temporal, better DX, good TypeScript support
    - Both handle retries, compensation logic, long-running workflows
  → COST: Temporal self-hosted (complex) or Cloud ($200+/month), Inngest $0-100/month
  → USE FOR: Order processing, onboarding flows, payment reconciliation

ELSE IF high throughput (> 100K jobs/day):
  → RECOMMEND: AWS SQS + Lambda OR RabbitMQ + workers
  → BUSINESS REASONING:
    - SQS: Fully managed, scales infinitely, $0.40 per million requests
    - RabbitMQ: More control, cheaper at very high scale, but you manage it
  → COST COMPARISON at 1M jobs/month:
    - SQS + Lambda: ~$20-30/month
    - BullMQ + Redis + Railway: ~$50-100/month
    - RabbitMQ self-hosted: ~$30-50/month (infrastructure)
  → DECISION: "SQS if AWS-heavy and > 500K jobs/month, BullMQ otherwise"

ELSE IF need scheduled jobs (cron-like):
  → RECOMMEND: Vercel Cron (if Next.js) OR Railway Cron OR BullMQ repeat
  → BUSINESS REASONING:
    - Vercel/Railway Cron: Simplest for daily/hourly tasks
    - BullMQ repeat: More flexible (every 5 min, complex schedules)
  → COST: Included with platform (Vercel/Railway) or part of BullMQ

ELSE (default: Node.js app, moderate job volume):
  → RECOMMEND: BullMQ + Redis (Upstash)
  → BUSINESS REASONING:
    - Best Node.js job queue library
    - Robust retry logic and dead letter queue
    - Redis as queue (Upstash free tier is generous)
    - Good monitoring dashboard (Bull Board)
  → COST: $0-20/month (Upstash Redis free tier + Railway workers)
  → ALTERNATIVE: "Inngest if you want managed service instead of self-hosted"

IF single web app (no mobile, no third-party API) AND using TypeScript:
  → RECOMMEND: tRPC
  → BUSINESS REASONING:
    - End-to-end type safety (no codegen needed)
    - Fastest development (autocomplete, refactoring works across frontend/backend)
    - No API docs needed (types are the docs)
    - Only works for TypeScript monorepos (frontend + backend in one repo)
  → COST: Free (library), same hosting as regular API
  → CAVEAT: "Only for internal APIs — third-party integrations need REST or GraphQL"
  → ALTERNATIVE: "REST if you might add mobile app or third-party API later"

ELSE IF complex data fetching (nested resources, variable fields per page):
  → RECOMMEND: GraphQL
  → BUSINESS REASONING:
    - Clients fetch exactly what they need (no over-fetching)
    - Single endpoint for all data
    - Great for mobile apps (reduces data transfer)
    - Built-in introspection (self-documenting)
  → COST: Same as REST, but more server complexity
  → CAVEAT: "Learning curve. Need 10+ API consumers to justify complexity."
  → ALTERNATIVE: "REST with field selection (`?fields=name,email`) if GraphQL feels heavy"

ELSE IF mobile app + web app (multiple API consumers):
  → RECOMMEND: REST with OpenAPI spec
  → BUSINESS REASONING:
    - Universal standard (every language has REST clients)
    - Easy to document (OpenAPI/Swagger)
    - Easy to version (v1, v2 endpoints)
    - Caching works great (HTTP caching)
  → COST: Same as any API
  → ALTERNATIVE: "GraphQL if mobile app needs very different data than web app"

ELSE IF third-party integrations (webhooks, partners, public API):
  → RECOMMEND: REST with OpenAPI spec
  → BUSINESS REASONING:
    - Industry standard for public APIs
    - Easy for partners to integrate (every language supports REST)
    - OpenAPI spec generates client SDKs automatically
    - Versioning well-understood (URL versioning: /v1/, /v2/)
  → TOOLS: Generate OpenAPI from code (Hono, FastAPI, NestJS auto-generate)

ELSE IF microservices (internal service-to-service communication):
  → RECOMMEND: gRPC OR REST
  → BUSINESS REASONING:
    - gRPC: Faster (binary protocol), type-safe (Protobuf), better for high-throughput
    - REST: Simpler, easier debugging (JSON), better for small teams
  → DECISION: "gRPC if > 10 microservices and performance critical. REST otherwise."
  → COST: Same hosting, gRPC slightly more CPU-efficient

ELSE IF need real-time subscriptions (live updates):
  → RECOMMEND: GraphQL subscriptions OR REST + SSE
  → BUSINESS REASONING:
    - GraphQL subscriptions: Built-in, part of GraphQL spec
    - REST + SSE: Simpler if you don't need full GraphQL
  → ALTERNATIVE: "WebSocket with custom protocol if GraphQL too heavy"

ELSE (default: simple CRUD app, single client):
  → RECOMMEND: REST
  → BUSINESS REASONING:
    - Simplest, most widely understood
    - Great tooling (Postman, OpenAPI, HTTP clients)
    - Easy to cache (CDN, browser cache)
    - Easy to debug (curl, browser network tab)
  → COST: Free (HTTP is built into everything)

## API Design Pattern Recommendation

**Recommended**: [REST / GraphQL / tRPC / gRPC]

**Business reasoning**:
- [Development speed impact]
- [API consumer needs]
- [Type safety or documentation needs]

**Cost**: [Usually same across patterns, mention if different]

**Alternative**: [When to consider different pattern]

**Migration path**: [How to evolve if needs change]

IF customers in EU OR processing EU citizens' data:
  → REQUIREMENT: GDPR compliance (mandatory, not optional)
  → TECHNICAL REQUIREMENTS:
    - Data must be stored in EU region OR adequate data transfer mechanisms (SCCs)
    - Right to deletion (data purging within 30 days)
    - Right to data portability (export user data)
    - Consent management (cookie banners, opt-in tracking)
  → RECOMMENDED SETUP:
    - Cloud: AWS eu-west-1 (Ireland) or eu-central-1 (Frankfurt)
    - Database: Supabase EU region or AWS RDS eu-west-1
    - Analytics: PostHog (EU cloud) or Plausible (privacy-first, no cookies)
    - Email: Resend (EU region support) or Postmark (GDPR-compliant)
  → COST: Similar to US, sometimes 5-10% higher
  → DON'T USE: Google Analytics (GDPR issues), US-only services without EU presence
  → LEGAL: Need privacy policy, cookie consent, DPA with processors

ELSE IF healthcare data (US):
  → REQUIREMENT: HIPAA compliance
  → TECHNICAL REQUIREMENTS:
    - Business Associate Agreement (BAA) with ALL vendors touching PHI
    - Encrypted at rest and in transit (AES-256, TLS 1.2+)
    - Access logs and audit trails
    - Isolated infrastructure for PHI (separate from non-PHI)
  → RECOMMENDED SETUP:
    - Cloud: AWS with BAA (not all AWS services are HIPAA-eligible)
    - Database: AWS RDS with encryption, NOT free tiers (no BAA on free tier)
    - Storage: AWS S3 with encryption, signed URLs for access
    - Auth: Auth0 (offers BAA) or AWS Cognito (with BAA)
  → SERVICES WITH BAA:
    - AWS (most services, must request BAA)
    - Google Cloud (with BAA)
    - Auth0 (Healthcare plan)
    - Mailgun (with BAA)
  → COST: 2-3x higher than non-compliant (no free tiers, need dedicated infra)
  → DON'T USE: Supabase free tier, Vercel (no BAA), most free tiers (no compliance guarantees)
  → LEGAL: Need HIPAA privacy officer, risk assessment, policies

ELSE IF selling to enterprises (B2B SaaS):
  → REQUIREMENT: SOC 2 Type II (buyers will ask for it)
  → TECHNICAL REQUIREMENTS:
    - Vendor management (track all subprocessors)
    - Access controls (MFA, role-based access)
    - Encryption in transit and at rest
    - Monitoring and alerting (security events)
    - Incident response plan
  → RECOMMENDED SETUP:
    - Use vendors with SOC 2: AWS, Stripe, Auth0, Datadog
    - Document all vendors in compliance tracker
    - Implement SSO (Auth0, Okta)
    - Centralized logging (Datadog, Splunk)
  → COST: $15K-50K for initial SOC 2 audit + ongoing compliance
  → TIMELINE: 6-12 months to get first SOC 2 report
  → ALTERNATIVE: Start with security questionnaire (before SOC 2), complete SOC 2 when deals require it
  → DON'T START WITH: SOC 2 on day 1 — wait until enterprise customers ask for it

ELSE IF payment data (credit cards):
  → REQUIREMENT: PCI DSS compliance
  → RECOMMENDED: Don't handle card data directly — use Stripe/Paddle
  → BUSINESS REASONING:
    - Stripe/Paddle are PCI Level 1 compliant
    - They handle card data (you never see it)
    - Reduces your compliance scope to SAQ-A (simplest questionnaire)
    - Building PCI-compliant infrastructure costs $100K+/year
  → COST: Payment processor fees (2.9% + $0.30) vs building compliance ($100K+/year)
  → DON'T: Store credit card numbers yourself — use tokenization

ELSE IF financial services (US):
  → REQUIREMENTS: Varies by product (banking, investments, lending)
  → COMMON REGULATIONS:
    - Banking: GLBA, state licensing
    - Investments: SEC, FINRA
    - Lending: TILA, state usury laws
  → RECOMMENDED: Work with compliance lawyer FIRST
  → TECHNICAL:
    - SOC 2 Type II (expected by partners)
    - Data encryption (at rest and in transit)
    - Multi-region backup (disaster recovery)
  → COST: Legal + compliance = $50K-200K/year
  → DON'T: Attempt fintech compliance without expert legal counsel

ELSE IF government customers (US):
  → REQUIREMENT: FedRAMP (federal) or StateRAMP (state)
  → TECHNICAL REQUIREMENTS:
    - 300+ security controls (NIST 800-53)
    - US-based data centers
    - US-based personnel (background checks)
    - Extensive documentation
  → RECOMMENDED: Use FedRAMP-authorized services (AWS GovCloud, Azure Government)
  → COST: $250K-2M for FedRAMP authorization
  → TIMELINE: 12-24 months
  → ALTERNATIVE: Start with non-government customers, pursue FedRAMP when revenue justifies it
  → DON'T: Pursue government contracts at MVP stage — FedRAMP is extremely expensive

ELSE IF children's data (US):
  → REQUIREMENT: COPPA compliance (children under 13)
  → TECHNICAL REQUIREMENTS:
    - Parental consent mechanism (verifiable)
    - No behavioral advertising to children
    - Data minimization (collect only what's necessary)
    - Parental access to child's data
  → RECOMMENDED SETUP:
    - Age verification at signup
    - Separate data handling for under-13 users
    - Parental consent flow (email verification, ID check, etc.)
  → LEGAL: Privacy policy specific to children
  → DON'T: Allow under-13 users without COPPA compliance

ELSE IF data sovereignty (country-specific):
  → EXAMPLES: Russia (data localization), China (Great Firewall), India (RBI data localization)
  → REQUIREMENT: Data must be stored in-country
  → RECOMMENDED:
    - Use cloud regions in target country (AWS ap-south-1 for India, etc.)
    - Replicate data to local region
    - Use CDN with local edge nodes (CloudFlare has global presence)
  → COST: Multi-region adds 20-50% infrastructure cost
  → ALTERNATIVE: Exclude those markets if compliance too expensive for revenue potential

ELSE IF California customers (US):
  → REQUIREMENT: CCPA (California Consumer Privacy Act)
  → TECHNICAL REQUIREMENTS:
    - Right to know what data you collect
    - Right to deletion
    - Right to opt-out of data selling
    - "Do Not Sell My Personal Information" link
  → RECOMMENDED:
    - Privacy policy with CCPA disclosures
    - User data export feature
    - Data deletion pipeline
    - Opt-out mechanism (if selling data)
  → COST: Legal + implementation = $5K-20K one-time
  → NOTE: If GDPR-compliant, CCPA is mostly covered (GDPR is stricter)

ELSE (default: US B2C, no special regulations):
  → REQUIREMENT: Basic privacy policy
  → RECOMMENDED:
    - Privacy policy (use template from Termly, iubenda)
    - Cookie consent (if using tracking)
    - Unsubscribe links in emails (CAN-SPAM)
    - User data deletion on request (good practice)
  → COST: $0-500 (privacy policy generator)
  → TOOLS: Termly, iubenda, Privacy Policies (free generators)

## Data Residency & Privacy Compliance Recommendation

**Compliance requirements**: [GDPR / HIPAA / SOC 2 / PCI DSS / etc.]

**Business reasoning**:
- [Legal risk or market access impact]
- [Cost of compliance vs cost of non-compliance]
- [Customer trust or enterprise sales impact]

**Technical implementation**:
- [Cloud region requirements]
- [Vendor requirements (BAA, SOC 2, etc.)]
- [Data handling requirements (encryption, deletion, export)]

**Cost**: [One-time + ongoing compliance costs]

**Timeline**: [How long to achieve compliance]

**Alternative**: [When to delay compliance or choose different approach]

## Data Residency & Privacy Compliance Recommendation

**Compliance requirements**: GDPR (mandatory — you have EU customers)

**Business reasoning**:
- Non-compliance fines up to €20M or 4% of revenue (whichever is higher)
- 70% of EU buyers won't use services without GDPR compliance
- Demonstrates privacy commitment (builds trust, differentiates from competitors)

**Technical implementation**:
- **Cloud region**: AWS eu-west-1 (Ireland) — all data stored in EU
- **Database**: Supabase EU region (Frankfurt) — $0-25/month
- **Analytics**: PostHog EU cloud — cookieless, GDPR-compliant by default
- **Email**: Resend with EU sending — supports EU data residency
- **Cookie consent**: Use Cookiebot or Osano ($0-100/month)
- **Data rights**: Implement user data export (JSON download) and deletion (30-day purge)

**Cost**:
- Infrastructure: Same as US (~$20-100/month)
- Cookie consent tool: $0-100/month
- Privacy policy + GDPR legal review: $500-2,000 one-time
- **Total first year**: ~$1,000-3,000

**Timeline**: 2-4 weeks to implement technical requirements

**Alternative**: If no EU customers yet, start with US-only, add GDPR compliance when you get first EU customer (blocks EU sales until compliant)

**Don't use**:
- Google Analytics (violates GDPR in many EU countries after Schrems II)
- US-only services without EU data residency (Airtable, some Zapier apps)
- Services that don't offer Data Processing Agreements (DPAs)

## [Technology Category] Recommendation

**Recommended**: [Specific service/technology]

**Business reasoning**:
- [Cost impact or hiring impact]
- [Risk reduction or time-to-market impact]
- [Specific business outcome]

**Cost**: [Monthly range with context, e.g., "$0-50/month for first 10K users"]

**Alternative**: [When to consider something else, with clear trigger]

**Don't use**: [What to avoid and why, with business impact]

## Database Recommendation

**Recommended**: PostgreSQL (Supabase)

**Business reasoning**:
- Includes auth, storage, and realtime for free — replaces 3 services with one
- $0/month until 500MB, then $25/month — predictable costs
- Largest hiring pool for SQL databases — easier to find help
- JSONB gives you flexibility when schema changes (happens often in early stage)

**Cost**: $0/month (free tier handles first 1,000 users) → $25/month (Pro tier)

**Alternative**: Neon if you need database branching for dev/staging environments (same PostgreSQL, different features)

**Don't use**: MongoDB unless you truly have unpredictable schemas. PostgreSQL JSONB gives 80% of MongoDB's flexibility plus full SQL power. Starting with Mongo locks you into NoSQL patterns that are hard to undo.

───────────────────────────────────────────────
This blueprint was generated by Architect AI (Cowork plugin).

For the full experience — validated schema, export zip, version tracking,
rendered diagrams, and .env templates — visit architectai.app
───────────────────────────────────────────────