Smart Data Solutions/ sdata.us/ Rebuild Plan

A security-first rebuild of sdata.us

Response security headers and a working Content-Security-Policy are baseline requirements, not premium features. This plan puts them in version control where they belong: three build options graded on security posture, an honest account of the editor experience we trade away, and a phased migration with measured scope.

Prepared by PreHealth 2026-09-09 For April, Chrissy, Patrick, Allison, Jay All figures measured or vendor-listed

Recommended: Hardened build on Astro + Sanity + Vercel + Cloudflare

A code-based stack owned outright by SmartData. Every security control — CSP, headers, WAF rules, redirects, certificate policy — becomes a reviewed file in a repository rather than a setting behind a support ticket. Software subscriptions run $2,172/year. Delivery is 10–12 weeks across seven phases.

Nonce CSP, no unsafe-inline · $2,172/yr software · 10–12 weeks · SmartData owns the repo

The plan in one page

01 Security target The exact header set the rebuild ships, why a build step is what makes a nonce CSP reachable, and this document served under that policy as proof. 02 Build options Standard, Hardened and Compliance-grade compared on security capability first. Hardened is $120/yr above Standard and buys the three controls reviewers ask about. 03 What we lose, what we gain The Webflow visual editing we give up against the development freedom we get back, task by task, plus the CMS recommendation. 04 Subscriptions Line-by-line software cost at vendor-listed annual pricing. Every line self-serve, no sales cycle. $2,172/yr for the Hardened build. 05 Scope 280 URLs measured from sitemap.xml, resolving to roughly 14 templates over 268 CMS records — plus the assets already portable. 06 Migration plan Seven sequential phases across 10–12 weeks, with the sequencing traps that break this kind of cutover. 07 Trust documentation Vendor attestations and where to request the reports, for Allison's due diligence. 08 Questions & next steps Six open questions with owners. One of them — the BAA requirement — selects the build tier.

The one decision that gates the rest

Does the security review require a signed BAA for the marketing site? sdata.us handles no PHI, so it should not — but SmartData is a claims processor and reviewers default to demanding one. A yes moves the build to Compliance-grade and replaces two self-serve subscriptions with sales-led contracts. Everything else in this plan holds either way.

Delivery cost is quoted separately

This document covers security posture, software subscriptions, scope and schedule. The build itself is a separate line and is not priced here — phase durations on the migration plan page describe the level of effort, not the cost.