GTM — Go-to-market plan

Date: 2026-04-16
Status: Proposed (post-research revision)
Depends on: product/positioning.md, PRD

Why this document exists

Pre-research PRD assumed PLG. Research showed that Thai mid-market regulated-industry buyers do not self-serve ≥ ฿50k/mo SaaS contracts — they run 4–9 month consultative cycles with 5–8 stakeholder committees, require invoice + 30–60 day terms + 3% WHT deduction, and rely on SI/advisory channel relationships for trust. The GTM must match that reality.

Sales motion

Hybrid: PLG top of funnel → Inside-sales-assisted mid-funnel → Channel-delivered paid conversion.

 puccha.hxlab.io marketing  →  Free tier self-serve signup  →  Inside-sales qualification  →
 POC (2–4 weeks)  →  Security review / DPA redline  →  Channel-delivered onboarding  →
 Quarterly business review  →  Renewal/expansion

Self-serve: Free tier only. Purpose = champion discovery + corpus sampling. Not a revenue channel.
Inside sales: one Thai-speaking AE + one solutions consultant in month 1. Target: 30–50 named accounts by month 6.
Channel-delivered: G-Able (tier 1, signed by month 6), Big-4 partnership (tier 2, month 9–12), depa-listed provider (tier 3, month 2 — paperwork, not a negotiation).

Ideal Customer Profile (ranked, post-research)

Tier-1 ICP — Insurance (OIC-regulated)

Why: OIC’s 2025 IT-risk framework landed with 72h incident reporting + board-level IT oversight + ISO 27001-aligned controls. Pain is fresh, budget is allocated, regulator is active.
Pool size: ~80 licensed insurers in Thailand (life + non-life).
Named account starter list: AIA Thailand, Muang Thai Life, Krungthai-AXA, Thaivivat, Dhipaya, Allianz Ayudhya, Bangkok Life, Thai Life, FWD, Generali (non-exhaustive).
Buyer: Compliance/DPO champions; CIO gates; Legal redlines DPA; CFO signs.
Puccha pitch: “Your 72h OIC incident-reporting runbook lives inside your Puccha KB and is audit-exportable.”

Tier-2 ICP — Financial services (BOT / SEC regulated)

Why: BOT FPG 19/2599 on outsourced IT + SEC Chapter 2 on data/app security/IAM. ISO 27001 is table stakes.
Pool size: ~70 banks + ~200 NBFIs + ~1,400 SEC-listed companies (subset with IT-risk programs ≈ 300).
Named accounts: KBank, SCB, Bangkok Bank, Krungsri, TTB, Krungthai, Kiatnakin Phatra, TISCO, CIMB Thai; capital markets: Bualuang Securities, KGI, KS; asset managers: BBL Asset, SCBAM, KAsset.
Sale cycle: 6–9 months. Must clear InfoSec review (ISO 27001 + SOC 2 evidence).

Tier-3 ICP — Private hospitals (HA-accredited, PDPA-exposed)

Why: Aug 2025 hospital fine woke up the sector. HA accreditation requires documented policies + access controls. Patient-data-aware ACL is a direct fit.
Pool size: ~60 HA-accredited hospital groups.
Named accounts: BDMS (Bangkok Dusit), Bumrungrad, Samitivej, Phyathai, Vejthani, Chularat, Thonburi Hospital Group.

Tier-4 (opportunistic) — Large listed enterprises with active DPO function

SET100 listed companies with internal DPO teams — Siam Cement, PTT group, CP Group, True, Indorama. Higher-ticket, longer sale; pursue when tier-1/2/3 pipeline is full.

Explicitly deprioritized

Telco (already has in-house platforms)
Logistics (less regulatory document pain per ฿ of revenue)
Manufacturing (low urgency without a regulator driver)
Tech/SaaS SMBs (tier-of-pain mismatch; pick these up as self-serve Free-tier only)

Named account program (months 0–12)

Month 0–3: build a named-account list of 50 (20 insurance + 20 FSI + 10 hospital).
Month 1: Thai-speaking AE hired. Cold-email + warm-intro through Certogo existing consulting book.
Month 1–6: 30-min discovery → 60-min demo → 2-week POC with real customer corpus.
Month 4–8: DPA redline + security review. Default position: Thai SCC overlay (72h breach), Anthropic DPA referenced, Section 29 appropriate safeguards.
Month 6–12: close 4–8 design-partner contracts at discounted ฿120k/yr with a public testimonial clause.
Month 12–18: list-price contracts from channel-generated leads.

Gate to move a named account: compliance champion + IT gatekeeper identified AND budget authority confirmed.

Channel partners

G-Able (tier-1 target)

Fit: 30+ year Thai SI, 3,500+ employees, strong manufacturing + FSI footprint, existing compliance/cybersecurity practice.
Proposed structure: 20–30% channel margin on paid ARR, Puccha provides product + Thai-language Level-3 support, G-Able owns implementation + Level-1/2 support + customer success.
Entry path: Certogo’s existing relationships + warm intro via ISACA Bangkok or TBA.
Milestone: LOI month 4, signed partner agreement month 6, first co-sold deal month 9.

Big-4 advisory (tier-2 target)

Target firms: Deloitte SEA risk advisory (strongest SEA analytics + risk team), PwC Thailand GRC, KPMG Thailand (existing PDPA DPO-as-a-service practice), EY Thailand.
Fit: Big-4 already sell DPO-as-a-service and PDPA advisory. Puccha becomes the productized knowledge artifact they deliver with their engagements.
Structure: Referral fee (10% of year-1 ARR) on standard referrals; reseller with 25–30% margin on white-label bundles.
Milestone: first referral agreement month 6, first co-delivered engagement month 9–12.

depa (Digital Economy Promotion Agency)

Program: depa “Digital Transformation Voucher” (THB 100k mini / midi / maxi vouchers), “OTOD AI Transformation” (2026 — THB 200k per SME).
Fit: Puccha’s mid-market ICP maps directly to depa’s target. A depa voucher puts ~฿100–200k of customer-funded budget into every mid-market prospect’s hand at near-zero CAC.
Action (month 1–2): Certogo already has the legal entity and consulting credibility to register as a depa-approved Digital Service Provider. Submit application, get listed, include depa-voucher redemption as a paid motion.

ISACA Bangkok, TBA, Thai CISO Club, TCMA

Speaking slots, PDPA roundtables, certification program partnerships.
3–5 speaking engagements / year minimum, with Certogo co-branding.

Pricing (post-research)

All prices in THB, invoiced monthly/annually, 3% WHT deducted at source, VAT 7% added.

Tier	Price	Seats included	Extra seat	Docs	Queries/mo	Notes
Free	฿0	3	—	20	100	“Powered by Puccha” footer; self-serve only
Team	฿3,900/mo (฿39k/yr)	5	฿600/seat	500	2,000	Self-serve OR inside-sales; Thai UI, DPA included
Business	฿19,900/mo (฿199k/yr)	20	฿900/seat	5,000	10,000	Inside-sales only; SSO, custom domain, audit-export, Thai SCC DPA, DPO consult call
Enterprise	From ฿500k/yr (typical ฿800k–฿1.5M)	custom	—	unlimited	custom	Channel-delivered; ISO 27001 SoA, SOC 2 report (once achieved), dedicated AM, sovereignty toggle, SLA, customer-managed keys

Overage: ฿3/query above quota (≈ 3× COGS). Communicated transparently in-product.

Rationale (from research): Research anchored median market seat at $15–20 PPP-adjusted for Thailand. Business at ฿19,900/20 seats = ฿995/seat ≈ $28 gross / ~$18 after 35% deal-level discount — in-band with Dust €29, Notion $20 equivalent, below Perplexity $40, well below Glean $45+15. Team at ฿3,900/5 seats = ฿780/seat ≈ $22 is the “champion + small team” sweet spot.

WHT / invoicing reality: Thai legal-entity payers deduct 3% WHT from service fees ≥ ฿1,000 and issue a WHT certificate. Puccha operates under Certogo’s Thai entity → we issue THB invoices, collect 97% of gross, claim WHT against corporate tax. Stripe auto-charge is for Free and Team only; Business and Enterprise are invoiced.

Compliance-first onboarding (paid tiers)

Every paid onboarding (Business+) follows a fixed 2-week program:

Day 0: Kickoff + DPA/SCC review. Thai SCC overlay signed. Anthropic DPA referenced. Sovereignty toggle configured if required.
Day 3: Corpus ingestion. Certogo consultants assist with normalization of PDPA/BOT/SEC/OIC-relevant policies.
Day 7: Role mapping workshop. Puccha team + customer compliance officer agree on role/ACL matrix.
Day 10: First internal beta with 3–5 named askers per customer side.
Day 14: Go-live + audit artifact delivery (SoA reference, DPA, DPO appointment confirmation if via Certogo).

This motion is part of the product, not “professional services.” Business tier includes it; Enterprise adds dedicated success and quarterly audit-readiness reviews.

Revenue model (conservative 24-month)

Month	Free tenants	Paid tenants	ARR (฿)	Drivers
3	30	2 (design partners)	240k	Certogo consulting book
6	80	6	1.2M	Named accounts, 1 SI partner
9	150	12	2.8M	G-Able co-sold deals start
12	250	20	5.0M	Big-4 referral begins
18	400	38	10.8M	depa voucher inbound
24	600	60	17.5M	Enterprise + expansion

Month-24 ARR ≈ ฿17.5M (~$500k) on ~60 paid tenants, mostly Business. Break-even around month 9 at current cost envelope.

Team hiring plan (Puccha-scoped)

Month 0: Lead engineer (existing), shared design/PM from Certogo.
Month 1: Thai-speaking AE (inside sales), Thai customer-success lead (fractional, from Certogo consulting staff).
Month 3: Full-time engineer #2 (backend/infra).
Month 6: Channel partnerships lead (owns G-Able + Big-4 relationship).
Month 9: Security engineer (owns ISO 27001 + SOC 2 evidence track).
Month 12: Solutions engineer (POC + pre-sales).

Total Puccha headcount at month 12: 5 FTE + shared Certogo resources.

GTM risks

Risk	Mitigation
Self-serve conversion too low to justify Free tier cost	Narrow Free (100 q, 20 docs) already does this. Monitor monthly.
Channel partner doesn’t prioritize us	Co-invest in 2 beachhead deals with each partner; publish joint case studies; quarterly business review with partner PM.
Long DPA redlines kill velocity	Publish Thai SCC template preemptively; pre-approve Anthropic DPA. Reduces median redline from ~6 weeks to ~2 weeks.
Hyperscaler bundle (ChatGPT, Agentspace) becomes default RFP line item	Compete on compliance deliverables (Onyx argument); enable sovereignty toggle; bundle DPO service.
Amity or similar raises and enters compliance-KM directly	Move fast; publish thought leadership; sign exclusives with 2 channel partners.
depa voucher program paperwork delays	Submit application month 1; parallel with other GTM; don’t block pipeline on it.

What success looks like by month 12

20 paid tenants; ฿5M ARR.
1 SI partner live (G-Able); 1 Big-4 referral agreement.
ISO 27001 Stage 2 passed; SOC 2 Type I draft.
Named in 2 PDPA / TBA / ISACA events as the Thai compliance-KM category leader.
NPS ≥ 30; CSAT ≥ 8.5; renewal rate on first-cohort tenants ≥ 85%.