Puccha v1 — PRD (Rev 2, post-market-research)

Date: 2026-04-16
Owner: tech@certogo.co.th
Status: Proposed — for review
Supersedes: Rev 1 (pre-research)
Change summary (Rev 2): Repositioned from “KM+AI SaaS” to “Compliance Knowledge Worker for Thai regulated industries.” Repriced Business 4× (market-aligned). ICP reordered around Insurance/FSI/Healthcare. GTM switched from PLG to hybrid (PLG top-of-funnel + inside-sales + channel). Compliance roadmap accelerated to month 1. See product/positioning.md and product/go-to-market.md for the full rationale.

1. Problem

Thai enterprises in regulated industries — insurance (OIC), financial services (BOT/SEC), and private hospitals (HA + PDPA) — operate under intensifying regulatory scrutiny:

PDPC crossed into enforcement mode in 2024–2025 (THB 21.5M cumulative fines by Aug 2025, first THB 7M administrative penalty). Processors, not just controllers, are liable.
OIC’s 2025 IT-risk framework mandates 72-hour cyber-incident reporting and board-level IT oversight for all insurers.
BOT FPG 19/2599 imposes ISO 27001-aligned controls on outsourced IT for banks; SEC Chapter 2 adds data + application security + IAM requirements for capital-markets firms.
Cross-border transfer regulations (Sections 28/29 PDPA, in force since 24 Mar 2024) require Section 29 Appropriate Safeguards — SCCs with a Thai overlay including 72h breach notification — for every data flow to US-based AI processors.

Staff can’t answer their own compliance questions quickly. Auditors can’t verify coverage. Generic AI assistants (ChatGPT, Gemini, Claude.ai) hallucinate on company-specific policy and provide no regulatory safeguards a Thai compliance officer can cite in an audit.

Global incumbents (Kapa.ai, Inkeep, Mintlify AI, Glean, Credal, Dust) are US/EU-centric, lack Thai SCC templates, lack Thai UI/support, and cannot deliver compliance artifacts a PDPA/BOT/SEC/OIC audit requires. Thai horizontal AI platforms (Amity Solutions) are chatbot/CX-led, not compliance-KM. Open-source alternatives (Onyx, ex-Danswer) are excellent tech but require in-house ML/infra capacity + a parallel compliance workstream most Thai mid-market enterprises do not have.

This is Puccha’s wedge.

2. Positioning (see `product/positioning.md`)

Puccha is the compliance knowledge worker for PDPA/BOT/SEC/OIC-regulated Thai enterprises — Thai-first, audit-ready, delivered by Thai SI channel.

Four messaging pillars:

Audit-ready by design — every feature maps to a named regulatory control.
Thai-first, not Thai-translated — UI, retrieval, contracts, support.
Delivered via Thai SI channel — not shipped over a website.
Compliance deliverables, not just software — DPA+SCC+SoA+DPO-consult bundled.

3. What Puccha is

A multi-tenant SaaS where each customer org gets:

Private KM corpus — MD / MDX / PDF / DOCX upload, paste, git-sync, future Notion/Drive connectors. 1-click seeding from a Regulatory Template Library (PDPA, ISO 27001 Annex A, BOT FPG 19, SEC Chapter 2, OIC IT-risk, HA accreditation).
Role-gated access (Owner / Admin / Editor / Viewer / API-key Guest).
Per-document ACLs (public / org / role:<name> / user:<id>); retrieval-time filtering with zero-leak guarantee (see adr/0003-rbac-and-acl.md).
Answer-first AI assistant — Claude Haiku 4.5 via CF AI Gateway, grounded in customer corpus with citation validation and “I don’t know” gating. Bilingual Thai/English throughout.
Command Palette UX (⌘K) — inline search + answer card + chat drawer.
Embeddable widget (Svelte-compiled ~15 KB gz) for customer-facing sites.
REST + streaming API for programmatic access.
Audit export — one-click bundle of access logs, ACL snapshots, DPA references, incident history for regulator/auditor.
Gap-analysis dashboard — high-volume queries with low confidence surface content gaps.
Sovereignty toggle (v1.1) — route generation via Anthropic EU or AWS Bedrock ap-southeast-1 Claude.

4. Who it’s for (ICP — post-research)

Tier-1: Thai insurers (OIC-regulated) — ~80 companies; freshest regulation; 72h incident reporting just landed; board-mandated IT risk documentation.

Tier-2: Thai financial services (BOT/SEC) — ~70 banks + 200 NBFIs + ~300 SEC-listed with active IT-risk programs.

Tier-3: Thai private hospitals (HA-accredited, PDPA-exposed) — ~60 groups; Aug 2025 hospital PDPA fine was a sector wake-up call.

Tier-4 (opportunistic): SET100 listed enterprises with internal DPO function.

Explicitly deprioritized: telco, logistics, manufacturing, tech/SaaS SMBs.

Tenant zero: Certogo itself. Dogfood corpus seeded from Certogo’s compliance consulting playbooks. Widget embedded on certogo.co.th. Becomes our first reference customer on the insurance / FSI case-study deck.

5. Why now

Regulatory pressure peaked — PDPC, BOT, SEC, OIC enforcement all active in 2025–2026.
Hyperscaler bundles (ChatGPT Business Company Knowledge, Google Agentspace, Notion AI) ship the 80% tech but cannot deliver Thai SCCs, Thai UI, Thai support, or 72h PDPC breach runbook. Thai compliance officers cannot cite them in audits.
Onyx and OSS alternatives raise the tech floor — so the moat is compliance + localization, not retrieval quality.
Claude Haiku 4.5 + prompt caching + Workers AI reranker make unit economics work at Thai price points (~฿0.5/answer).
depa Digital Transformation Voucher and OTOD AI Transformation programs put THB 100k–200k of customer-funded budget per mid-market buyer into play in 2026.
No direct Thai-built competitor in compliance-KM-over-docs (Amity is horizontal chatbot). Window is ~18 months.

6. Non-goals (v1)

❌ Real-time collaborative editing — editors bring finished MD/MDX.
❌ On-premise / self-hosted — cloud-only v1. Sovereignty toggle in v1.1; dedicated region in Enterprise v2.
❌ Agentic workflows / tool calling beyond RAG — retrieval + answer only.
❌ Vertical SaaS integrations (Jira, Salesforce, HubSpot) beyond Slack in v1.1.
❌ Fine-tuned models per tenant — base Haiku + good retrieval is sufficient.
❌ A WYSIWYG doc editor — TipTap MD editor only, no Notion clone.
❌ Generic “AI for marketing / code / writing” use cases — narrow focus on regulated-industry KM.

7. Success metrics (v1 launch + 180 days)

Metric	Target
Paying tenants	12 (incl. 4–6 design-partner conversions)
ARR	฿2.8M (~$80k)
≥70% of paid tenants in Insurance / FSI / Healthcare	validates ICP
Weekly active askers per tenant	≥ 20
Median query → answer latency (p50)	≤ 1.5s
Answer faithfulness (Promptfoo LLM-as-judge)	≥ 0.85
Citation-recall	≥ 0.80
“I don’t know” rate on in-corpus questions	≤ 15%
Win rate vs. Onyx in contested deals	≥ 60%
NPS (in-product survey)	≥ 30
Infra gross margin	≥ 80% (lower than Rev 1 — channel margin squeezes)
ISO 27001 Stage 2	Passed by month 9
SOC 2 Type I draft	By month 12

8. Pricing (post-research — see `product/go-to-market.md` §Pricing)

All prices in THB, invoiced monthly/annually. Thai legal-entity payers deduct 3% WHT at source and receive WHT certificate.

Tier	Price (฿/mo)	Seats incl.	Extra seat	Docs	Queries/mo	Motion
Free	0	3	—	20	100	Self-serve
Team	3,900	5	600/seat	500	2,000	Self-serve or inside-sales
Business	19,900	20	900/seat	5,000	10,000	Inside-sales only
Enterprise	from ~40,000/mo (฿500k–1.5M/yr typical)	custom	—	unlimited	custom	Channel-delivered

Business includes SSO, custom domain, audit export, Thai SCC DPA, DPO consult call. Enterprise adds sovereignty toggle, dedicated AM, ISO 27001 SoA + SOC 2 report (once achieved), SLA, customer-managed keys.

Overage: ฿3/query above quota (~3× COGS).

Repricing rationale: pre-research pricing had Business at ฿6,000/50 seats = ~$3.60/seat, ~80% below PPP-adjusted market. Revised pricing at ฿995/seat ≈ $28 gross aligns with Dust €29, Notion $20 equivalent, below Perplexity $40 and Glean $45+15.

9. Sales motion (PLG + inside-sales + channel)

See product/go-to-market.md for full detail.

Free tier: champion discovery + corpus sampling (not a revenue channel).
Team tier: self-serve or inside-sales.
Business / Enterprise: Thai-speaking inside-sales AE qualifies → 2–4 week POC → DPA redline → channel-delivered onboarding.
Channel partners: G-Able (tier-1), Big-4 advisory (tier-2), depa-listed provider (tier-3).
Compliance-first onboarding (2 weeks, fixed program, included in Business+).

10. Compliance roadmap (see `compliance/roadmap.md`)

Month 1: ISO 27001 readiness assessment by Certogo; SOC 2 Type II track starts; Thai SCC template published; Anthropic DPA signed; depa provider registration submitted.
Month 3: Privacy policy + DPA template + ISO 27001 SoA draft live.
Month 6: ISO 27001 Stage 1 audit.
Month 9: ISO 27001 Stage 2 audit + certificate.
Month 12: SOC 2 Type I report (observation window starts month 6).
Month 18: SOC 2 Type II report; bug bounty launched.

11. Competitive posture (see `product/positioning.md`)

Real competition is 5 players: Glean (enterprise, too expensive), Credal (US, no Thai), Dust (EU, no Thai), Onyx (OSS self-host), and hyperscaler bundles (ChatGPT Business Company Knowledge, Google Agentspace, Notion AI).

Puccha wins on compliance deliverables + Thai localization + Thai SI channel. Does not compete on “generic RAG quality.”

12. Risks (refreshed post-research)

Risk	Mitigation
Hyperscalers bundle feature parity faster	Compete on compliance deliverables + Thai posture + sovereignty toggle
Onyx / OSS wins technical buyers	Bundle DPO service + ISO 27001 evidence pack + Thai SI support contract
PDPC issues AI-specific DPA template that makes our SCCs obsolete	Monitor ETDA / MDES / PDPC publications; update within 30 days
Amity pivots into compliance-KM	Sign exclusive or first-look with 2 channel partners; move faster
Long Thai DPA redlines	Publish preemptive Thai SCC template; pre-approve Anthropic DPA
ICP mis-target (Tier-1 insurance converts too slowly)	Fallback to tier-2 FSI and tier-3 hospitals; monthly pipeline review
Channel partners deprioritize us	Co-invest in 2 beachhead deals per partner; quarterly business review
Hallucination incident with regulated customer	Faithfulness threshold ≥ 0.85 gate-to-GA; IDK-bias prompt; citation validator
Anthropic cost spike	AI Gateway cost cap; Workers AI fallback path wired

13. Team (see `product/go-to-market.md` §Team hiring plan)

Month 12 target: 5 Puccha FTE + shared Certogo resources.

Month 1: Lead eng (existing) + Thai-speaking AE + fractional CS lead (Certogo).
Month 3: Engineer #2 (backend/infra).
Month 6: Channel partnerships lead.
Month 9: Security engineer (ISO/SOC 2 evidence).
Month 12: Solutions engineer.

14. Open decisions to resolve before ADR-0001 finalization

Confirm repositioning from “KM + AI” to “Compliance Knowledge Worker for regulated Thai enterprises” — this reshapes marketing, pricing, ICP.
Confirm new pricing (Team ฿3,900 / Business ฿19,900 / Enterprise ฿500k+/yr).
Confirm ICP order: Insurance → FSI → Healthcare → SET100 opportunistic.
Confirm tenancy URL model: subdomain all paid tiers (proposed), or subdomain Business+ only.
Framework: SvelteKit 5 for the app, Astro for marketing (confirmed).
Repo: new puccha repo with pnpm workspaces, or monorepo under c2g-labs.
Who signs Anthropic DPA: Certogo Co., Ltd. (the Thai legal entity that will also issue THB invoices and handle WHT).
Certogo → Puccha relationship: explicitly, Puccha is a C2G Labs product, Certogo is the parent + first tenant + consulting channel. Brand is separate.