TendForm · Jun–Sep 2026
A HIPAA-capable SaaS, shipped solo, priced against its own cost stack
A form builder with multi-form packets, a markdown DSL, a 27-tool MCP server, and a HIPAA tier, built in 11 weeks with an agent co-authoring 85% of commits. The cost decisions mattered as much as the code.
Headline
85%
of 176 commits co-authored by an agent
$19.99
Pro plan per month
$49
HIPAA plan per month
27
MCP tools behind OAuth 2.1
11 wks
first commit to today
The shape of the system
Public forms are pre-rendered and cached at Cloudflare’s edge, so the hot path for respondents rarely touches the backend. A single FastAPI image runs as the API, the async worker, and the migration job on a small DigitalOcean Kubernetes cluster, with managed Postgres and in-cluster Redis. Email goes through Cloudflare’s Email Sending API; AI features go through OpenRouter.
Cost decisions that shaped the product
- Cheap model first. Every AI generation runs a classifier on Gemini 2.5 Flash-Lite (listed at $0.10 input / $0.40 output per million tokens) before spending tokens on the form itself, and it doubles as an abuse gate. Signed-in users get the stronger Gemini 2.5 Flash for the generation.
- The edge does the serving. Caching rendered forms at the edge keeps respondent traffic, which scales with customers’ audiences rather than with revenue, off the paid compute.
- HIPAA without a second platform. DigitalOcean’s managed databases aren’t on its BAA’s covered-products list, so the HIPAA tier runs its own Postgres in the cluster as an encrypted enclave, with cold audit data in object storage at roughly $0.02 per GB-month. Reading the covered-products list, not just “do they sign a BAA,” was the decision that mattered.
- The free tier was meant to be ad-supported. Twelve days in, AdSense flagged the only ad surface, a form’s thank-you screen, as thin content, and the ads came down. A revenue line in a README is not a revenue line.
What broke, and why it’s instructive
Letting agents and MCP clients edit forms exposed a stale edge-cache bug: edits were saved but never went live, and no human had hit that path yet. Splitting the product across three domains created a recurring class of bugs (dropped analytics, wrong invite links, redirect loops). HIPAA edge cases surfaced weeks after launch, including HIPAA customers seeing ads because of an exact plan-name check.
None of these show up in a cost model, and all of them cost time. The through-line: every new kind of user, including an AI one, walks a path you haven’t tested.