New startup ideas · B2B, security and compliance · B2B SaaS
startup idea
Ruleplane
Regulated-data infrastructure as an API: storage, retention and audit that pass inspection by default.
Ruleplane builds compliance-certified infrastructure primitives - storage, messaging, retention, deletion and audit-log APIs that come pre-audited for HIPAA, GDPR and financial record-keeping rules.
- Infrastructure and APIs
- Enterprise
- $100B+ market
- Creates a new category
- Global from day one
3/5
venture judge
10
similar startups, last 2 years (38 all-time)
96%
of 3 nearest real companies still alive
yes
8 matching federal grants and programs
Direction supported by government programs and grants
Test it before you build it
$800 · 4 weeks · 20 prospects
For $800 and 4 weeks, prove that digital health engineering leaders will pay $2,000 up front today for compliant-by-default storage and audit primitives, years before any formal certification exists.
Riskiest assumption · A digital health engineering leader will pay real money today to build a regulated workflow on a startup's storage and audit substrate - before formal certifications exist - rather than continue assembling HIPAA controls themselves on AWS, whose BAA they already have.
1Focus group: who and where
CTO or founding engineer at a seed-to-Series B US digital health company (5-50 engineers) that is mid-HIPAA-build or staring at its first enterprise security questionnaire, currently burning engineer-months assembling encryption, access logging, retention and audit evidence by hand on AWS.
where to find 20 · The Health Tech Nerds Slack community where these exact engineers ask HIPAA questions weekly, the YC startup directory filtered to healthcare plus Rock Health's funded digital health company lists as an outreach list, and HLTH 2026 (October, Las Vegas) attendee and exhibitor startups as a second list; a Show HN post for the docs serves as the self-serve channel.
2Sell first, build later
A design-partner pilot: your team moves one regulated workflow onto our storage and audit-log API in a sandbox, we sign a BAA, and you receive a pre-built evidence pack mapped to the HIPAA Security Rule for your next customer security review, starting the week of October 12, 2026 and running 60 days.
the ask · $4,000 per design-partner pilot, $2,000 invoiced up front and $2,000 at the 30-day mark; production pricing quoted at $1,500 per month thereafter.
a real yes · A real yes is a signed one-page agreement plus the $2,000 up-front payment cleared; a real self-serve signal is a work-email sandbox request that converts to a scheduled onboarding call - Slack praise, 'ping us when you have HITRUST', and free-sandbox-only interest do not count.
3Small experiments
The first one attacks the riskiest assumption; each ends with a number that says whether to run the next.
1. Paid design-partner pitches
$250 · 14 days
Write a one-page spec of the storage-plus-audit-log API with a signed BAA and a pre-built security-review evidence pack, and book 15 calls with digital health CTOs sourced from Health Tech Nerds and the YC and Rock Health lists. Every call ends with the same ask: one of five $4,000 design-partner slots, half up front, October start, one workflow moved onto the API.
keep going if · 5 of 15 CTOs verbally accept the $4,000 pilot and scope a workflow on the call
2. Up-front deposit invoices
$100 · 12 days
Within 48 hours of each yes, send a one-page design-partner agreement and a $2,000 ACH invoice for the first half of the pilot fee, tied to a named October start week. Count who signs and pays, not who stays enthusiastic.
keep going if · 3 of the 5 accepting CTOs sign and pay $2,000 within 12 days
3. Docs-first self-serve test
$450 · 14 days
Publish a real documentation site for the two APIs with a pricing page and a 'request sandbox access' form requiring a work email, since the card's wedge claims adoption from documentation without sales. Post it to Health Tech Nerds, as a Show HN, and in one paid classified in a developer-focused health tech newsletter, and measure signups against visitors.
keep going if · 25 work-email sandbox requests from roughly 500 visitors, with 8 converting to a booked onboarding call
4Collect a deposit up front
Tesla took $1,000 refundable reservations for the Model 3 and $100 for the Cybertruck before building either: the deposit is the measurement, not the revenue.
$2,000
per prospect, refundable
how · A paid design-partner pilot invoiced up front: the CTO signs a one-page agreement and pays a $2,000 ACH invoice, half the pilot fee, which is credible for a funded startup buyer and squarely in the $1,000-5,000 paid-pilot band; no marketplace checkout needed for five named accounts. set up: Stripe Invoicing ↗
what it reserves · One of five October design-partner slots, direct access to the founding engineers during the pilot, the $1,500 per month production price locked for year one, and their workflow's requirements shaping the audit-log schema.
refund · Refunded in full if the sandbox, signed BAA and evidence pack are not delivered by their named start week, or on request any time before kickoff.
target · 3 paid $2,000 deposits from 15 pitched CTOs within 30 days
before taking money · Until counsel has reviewed the BAA language and the controls behind it, the team must not accept real PHI into any sandbox or claim certifications it does not hold - all pilots run on synthetic data.
Go: build it if
3 of 5 offered slots pay $2,000 up front within 30 days, and the docs site converts at 5%+ of visitors to work-email sandbox requests - money now plus evidence the self-serve wedge is real.
Kill: stop if
0 of 15 pitched engineering leaders pays anything, or fewer than 10 sandbox requests from 500 doc visitors, or a majority of interested CTOs condition any payment on SOC 2 or HITRUST already being in hand - which means the three-year pre-revenue gap is unfundable by customers.
5 Scripts to run itoutreach message, landing copy, deposit terms · click to open
outreach message
You are probably rebuilding the same HIPAA plumbing right now - encrypted storage, access logs, retention rules, and the evidence spreadsheet for your next enterprise security review. We are taking five design partners for a storage and audit-log API that ships with a signed BAA and a pre-built evidence pack mapped to the Security Rule, so one workflow passes review without costing you a quarter of an engineer. The pilot is $4,000, half up front, October start. Open to a 20-minute walkthrough of the API docs this week?
landing page
Storage and audit-log APIs that pass HIPAA security review by default. $4,000 design-partner pilot: sandbox access, signed BAA, and a Security Rule evidence pack, with $2,000 due at signing and production at $1,500 per month locked for year one. Request sandbox access with your work email - 5 October slots.
deposit terms
Your $2,000 payment is the first half of the $4,000 design-partner pilot and reserves one of five October slots, with the remaining $2,000 due at the 30-day mark. It locks your $1,500 per month production price for year one. If your sandbox, signed BAA and evidence pack are not delivered by your named start week, or you cancel before kickoff, we refund the full amount.
Would you run this test?
One tap. The yes-share feeds the Demand pillar of this idea's score; nobody sees who answered.
Budgets are out-of-pocket estimates for a team of one to three, US market. Size the deposit to the deal, and check the terms before taking money in a regulated line.
Scorecard
One score that balances how trendy the idea is, the demand for it and its potential for 100x, with competition measured relative to every other idea in the catalog. Recent startup trends first, government priorities second.
49
Idea Score, 0-100 · raw 30.5 x 1.61
Active
competition: more crowded than 69% of ideas · headwind x0.65
+3.6
government priorities, secondary (34 matching grants)
Trend
39
Is the wave forming now? 2025-26 entrants vs 2023-24, rounds since 2025, the sector's live-batch direction, the 2026 trend analyst.
- Entrants 2025-26 vs 2023-24 (similar companies)46
- Rounds announced 2025+ in the sector61
- Sector direction (live batch)0
- 2026 trend analyst50
Demand
33
Does anyone want it? YC's current RFS, companies already paid for something similar, the operator judge, founders' yes-rate in decks, readers who would run the test.
- YC asks for it (current RFS: idea / sector)0
- Someone already pays (similar companies, recent / all-time)100
- Operator judge: real pain0
100x potential
53
Can it return a fund? The venture judge (double weight), market-size and moat axes, neighbours still alive, the technologist judge.
- Venture judge50
- Market size axis100
- Moat axis20
- Neighbours still alive75
- Technologist judge25
Score = 100 x cbrt(Trend x Demand x 100x) x (1 - 0.5 x crowding) + government bonus (max 5), calibrated so the 95th-percentile idea scores 90 (order never changes). A geometric mean: a weak pillar cannot be papered over. Percentiles are among the 272 ideas in the catalog; the terms matched were regulated-data, infrastructure, storage, retention, audit, pass, inspection, builds.
The idea in full
- What
- Ruleplane builds compliance-certified infrastructure primitives - storage, messaging, retention, deletion and audit-log APIs that come pre-audited for HIPAA, GDPR and financial record-keeping rules. Enterprise developers self-serve the way they do with a cloud provider, and every regulated workflow built on Ruleplane inherits its certifications instead of undergoing its own audit. The first three years go into engineering and passing the audits; revenue follows once the primitives are certified.
- Why now
- Floracene (YC S26) sells vibecoded HIPAA-compliant internal tools and Complir (YC X26) pitches itself as Vanta for physical products - both are symptoms that compliance is still bolted on per-application; nobody sells it as the substrate underneath.
- Wedge: first customer and entry point
- Digital health engineering teams who today spend months per app on HIPAA controls; a certified storage-plus-audit-log API they can adopt from documentation, without talking to sales.
- Path to 100x
- Enterprises spend well over $100B a year on compliance, governance and the engineering work of keeping regulated data lawful, almost all of it rebuilt per company. If certified primitives become a category the way managed databases did, the standard-setter takes cloud-platform economics; there is no moat at the start, which is exactly why the prize goes to whoever accumulates certifications and becomes the default first.
- Ceiling
- Most plausibly it never escapes being a HIPAA-storage niche vendor, because each new regulation requires a new multi-year audit cycle and the hyperscalers own the customer relationship.
- Closest real companies, as the generator saw them
- Floracene generates compliant apps one at a time and Complir checks compliance after the fact; Ruleplane moves compliance below the application layer so any app built on it is compliant by construction. None of the tracked companies sell certified primitives as infrastructure.
- Main risk
- AWS or Azure ships certified-by-default regulated primitives before Ruleplane finishes its audit cycle, and the category is absorbed into the hyperscalers.
Five judges
Each judge scores every idea in the catalog with a named rubric; the venture judge decides whether a card is shown at all (4-5 is venture-grade).
Venture investor
3/5
Certified primitives could earn cloud-platform economics, but three years of audits before revenue against AWS shipping the same thing is a coin flip.
Bootstrapper
1/5
Three years of multi-year audit cycles before a dollar of revenue, with AWS able to ship certified primitives first.
Operator
1/5
Three years of audits before revenue, and buyers must rebuild regulated apps on a substrate AWS could certify first - nobody is paying for this today.
Technologist
2/5
The moat is audit certificates rather than engineering, and the card names its own killer: AWS shipping certified regulated primitives first.
Risk
3/5
Accumulated HIPAA and GDPR certifications are exactly the regulatory footing this lens rewards, but three pre-revenue audit years against AWS shipping first is a real race.
trends
3/5
Lands on the F26 AI-Native Compliance Infrastructure RFS, but its bolted-on-compliance premise was equally true in 2023 and revenue waits three years.
Similar startups in the directory
Companies whose pitch matches most of the idea's terms (regulated-data, infrastructure, storage, retention, audit, pass, inspection, builds): 38 all-time, 10 from the last two years. Same matching as Idea Check.
The easiest way to use AWS for agents and humans
SDK for adding an agent and human governance layer to your product
Identity infrastructure for connected travel
Hypercubic is building the best-in-class agentic AI platform for maintaining and modernizing legacy mainframe systems running COBOL.
Monitoring and learning layer for long-running agents
Autonomous Drones for Earth Observation
Automated infrastructure for modern commercial lenders.
Payment infrastructure for AI agents
API for unlimited, durable, real-time streams
Production infrastructure on autopilot
Human-Context Data Infrastructure for High-Stakes Decisions
Turn scattered data into one platform for decision-making
The generator's reference companies
Real companies the model named as closest when it wrote the card, with their fate. A check mark is a company the radar could verify in its directory.
Public money in this direction
US federal grants, SBIR/STTR awards and open opportunities from the radar's public-money feed, matched to the idea's terms; the sector totals give the context.
8
grants and programs matching the idea
16
startup-relevant grants in B2B SaaS
$3M
awarded in the sector, tracked
1
opportunities open now in the sector
- Data Collection and Analysis for Long-Term, Wireless Human Biosignal Sensing via Wearable Biosynthetic Sleeveawardhigh relevance
NIH / NHLBI · SBIR phase I · $314K · posted 2026-09-20
- Optimization of an at-home continuous multi-domain monitoring and assessment system to improve Alzheimer's and related disorders clinicaltrialsawardhigh relevance
NIH / NIA · SBIR phase II · $964K · posted 2026-09-07
- Collaborative Research: VINES: Track 2: FALCON: Flexible Aerial Links for Control, Observation, and Navigationawardhigh relevance
National Science Foundation · TIP-CHIPS KTA-6 Communications · $5M · posted 2026-08-24
- I-Corps: Translation Potential of Safer, Longer-Life Lithium-Ion Energy Storage for Critical Infrastructureawardhigh relevance
National Science Foundation · I-Corps · $50K · posted 2026-08-19
- I-Corps: Translation Potential of a Longitudinal Diagnostic Method for Residential Branch Circuits Serving Sustained High Impact Electrical Loadsawardhigh relevance
National Science Foundation · I-Corps · $50K · posted 2026-08-19
- SBIR Phase I: Purification of Electrochemical Graphite for Use as a Critical Material for U.S. Power Infrastructureawardhigh relevance
National Science Foundation · SBIR Phase I · $304K · posted 2026-08-11
- SBIR Phase II: Advanced Manufacturing for Aerogels for Battery Safety Applicationsawardhigh relevance
National Science Foundation · SBIR Phase II · $1M · posted 2026-08-04
- I-Corps: Translation Potential of a Battery Monitoring and Degradation Detection Tool Using Non-Contact Methodsawardhigh relevance
National Science Foundation · I-Corps · $50K · posted 2026-07-29
Market signal
What the radar sees in B2B SaaS: new companies by cohort year, the forming YC batch, and outcomes since the February snapshot.
B2B SaaS · 189 → 205 → 206 → 116 → 92 new companies 2022 → 2026 · 90% aliveYC F26 live: 5 in this cluster, 4% of the batch (was 4% in S26)Since February, of 756 YC companies here: 10 acquired, 15 shut down, 80 rewrote their pitch
Design attributes
The card is one cell of a designed set: every axis below was chosen before the text was written, and the text had to realize it.
- Buyer
- Enterprise
- Business model
- Infrastructure and APIs
- Path to 100x
- Creates a new category
- Market size
- $100B+ market
- Capital intensity
- Capital-medium (ops, field teams)
- Speed to revenue
- R&D first, revenue after 3 years
- Technical depth
- Real engineering
- Go-to-market
- Self-serve
- Moat
- No moat yet
- Geography
- Global from day one
- Regulation
- Heavily regulated
- Vibe
- Boring business
Listed under
An idea sits in its own sector and in any sector its text clearly touches.
More ideas like this
B2B, security and compliance · B2B SaaS
Baseplate
The record network linking contractors, engineers, and state DOTs on federal-aid projects.
A network of record for federal-aid construction: contractors submit materials certifications, test results, submittals and inspection records once, and Baseplate routes them in each agency's required format to state DOTs and engineers of record, with AI pre-review trained on previously approved submittals.
B2B, security and compliance · B2B SaaS
Carepuck
A $99 puck that watches a parent's home, with an app store for care.
Carepuck is a plug-in device with millimeter-wave motion sensing and on-device audio that adult children buy online and mail to a parent living alone; it learns the household routine and texts the family when something breaks the pattern, with no cameras and no medical claims.
B2B, security and compliance · B2B SaaS
Bordera
AI clearance agents that file, bond, and finance customs entries across every major trade lane.
Bordera runs AI agents that classify goods, file customs entries, and advance duties for enterprise importers, executing through Bordera's own licensed brokerage subsidiaries and bonded entities in each jurisdiction.
B2B, security and compliance · B2B SaaS
Stocklight
A demand forecasting model any small merchant can self-serve, any app can embed.
Stocklight is a subscription forecasting layer for small merchants who make, move or sell physical goods: connect a store, a POS or a wholesale ledger and get SKU-level demand, reorder points and stockout risk that account for promotions, seasonality and local events.
B2B, security and compliance · B2B SaaS
Wayline
Registry and API that make enterprise catalogs, prices and policies readable by AI agents.
Wayline is an infrastructure layer where large brands, retailers and travel operators publish machine-readable manifests of their inventory, prices, eligibility rules and fulfillment terms, and AI agents query one API instead of scraping websites.
B2B, security and compliance · B2B SaaS
Tradewire
The ordering and payment network connecting independent distributors with the retailers they supply.
Tradewire is an API network that lets small US wholesale distributors and their retail customers exchange orders, invoices, and payment terms in one standard format, replacing faxed POs and legacy EDI.
Fictional company written 2026-08-26 from MarkosWeb data; the companies, grants and numbers around it are real and tracked. Treat the idea as a research prompt, not a plan.