Business plan,
held up to a harsh light

Hard disclaimers

• This is not investment advice. It is a working hypothesis with cartoons.
• “Market size” reports bundle e-sign, workflows, vaults, and national ID schemes. Most of that spend never touches “developers piping PDFs through an API.” Cherry-picking a big number flatters the narrative.
• A seal.club certificate is not your customer’s trust anchor. If we mint signatures under infrastructure we operate, buyers must understand what is being proven (continuity, issuance policy, audit posture) — not magical proof that Acme Corp authored the PDF because Acme wanted it to be true.
• Reseller economics depend on supplier terms. Our working model is SSL.com ($10k prepay → $10k credits, ~$209/year org certs, monthly upstream billing, prorated credits on cancel) — but every clause lives in a contract, not in this memo.

What we sell

Free tier: a PDF document certification API (and adjacent integration paths) using seal.club-operated issuance tied to a high-assurance chain. Where practical we attach evidence the subscriber controls — email or a domain they demonstrate — while remaining explicit that the certificate is ours, not a BYO private CA fantasy.

Paid motion: we resell SSL.com organization document-signing certificates with packaging that fits modern finance ops: monthly plans for customers even though upstream certs are annual seats; self-serve where regulations allow; concierge where they do not. The wedge is known COGS (~$209/year per org cert at reseller; RFC 3161 timestamps ride the free rfc3161.ai.moda router, so the per-seal stamp is $0 until that assumption breaks) and developer-grade ergonomics — not hoping list-price fairy tales save the margin.

Go-to-market story: engineers ship PDFs that are mostly unsigned today. Through sharp docs and a deliberate media campaign, we teach a cultural reflex: if it matters and it’s allegedly from you, readers should expect a cert; absence is a yellow flag. That story collides with UX reality (readers ignore signature panels) and procurement reality (security teams buy suites). Skepticism is warranted.

Delivery economics: cryptographically, sealing a PDF is basically constant time — the hot path does not scale like “bigger PDF → exponentially more CPU.” The bill that moves with volume is moving the file: ingress from the client, egress back out, and whatever hops object storage or signing vendors add. Stack that on serverless-first Vercel and idle metal disappears; what’s left to model is mostly bytes × distance, plus modest function duration and vendor meters — not rack-rate servers pretending they’re the bottleneck. Each customer uploads a unique PDF and receives a unique sealed artifact back; we’re not running a library where the same file is fetched thousands of times, so edge caches don’t amortize seal traffic. Bytes land in short-lived staging only — retain what regulations demand, then lifecycle-delete the rest on a schedule so storage GB-months track pipeline depth, not “keep every PDF forever.”

Outside numbers (handle with tongs)

Why the business might be invalid

1. Behavioral: recipients rarely validate signatures; the marketing story might not change habits on mobile clients or inside browsers.
2. Product bundling: Adobe, DocuSign, Box, Google Workspace, and friends own procurement budgets; “best API” loses to “already licensed.”
3. Trust semantics: a seal.club certificate proves our issuance pipeline said “yes” — translating that to brand authenticity requires education and liability clarity.
4. Compliance drag: organization validation, key storage (token/HSM), and regional rules cap how “self-serve” this can be globally.
5. Supplier concentration: SSL.com as fulcrum means roadmap, credit policy, and validation quirks ultimately sit upstream.
6. TSA freeloading risk: timestamps currently ride the free rfc3161.ai.moda router — one person’s goodwill project, no SLA, no contract. If it rate-limits us, shuts down, or we outgrow polite usage, we buy commercial TSA capacity and the fee is per job, not per year — at thousands of seals daily it can exceed cert COGS.
7. Prepaid credit cliff: the $10k→$10k wallet is finite at hypergrowth — ~47 org-year certs of headroom at $209 each before another tranche — model replenishment, not magic float.
8. Free tier cannibalization: if the free cert satisfies the moral craving (“we signed something”), paid upgrades stall unless hard limits bite exactly right.
9. Bandwidth cliffs: the seal itself is cheap; the freight isn’t. Fat PDFs and chatty retries mean the invoice is often ingress and egress per unique job, not CPU — edge CDNs don’t rescue a workload where almost every response is a one-off sealed blob.

The contrarian investment case anyway

If PDF signing is “merge hygiene” for regulated outputs (invoices, audit packs, HR notices, generated statements), then latency-to-first-signature and honest verification UX matter more than maximalist feature breadth. A developer-native reseller that respects monthly cash cycles and publishes viciously clear trust docs could punch above its weight — even inside a noisy market — provided unit economics survive supplier SLAs and mostly-self-serve support (docs, status, automation — not a payroll floor).

Translation for investors: small SAM, plausible ASPs, miserable defaults — but if the surface stays boring and automation handles the hot path, there’s room for a lean margin story without assumed payroll: revenue minus certificates and freight, not “hire your way to credibility.”

Infra posture: sealing work is near–constant time; in models, stress moving PDFs in and out (transfer in/out of our boundary first). Serverless on Vercel matches that story — compute duration is usually noise next to file freight unless we pipe giant blobs through functions the dumb way. We’re not modeling salary drag here: success is supposed to look like automation plus vendor APIs, not headcount for its own sake.