Three weeks in. 5 signups. One framing that works
Five signups in three weeks. Small — and more useful than a viral spike that doesn't convert.
The framing that works isn't "GDPR-compliant tool." It's the jurisdiction question. Bluesky and Mastodon respond to the Schrems II angle; LinkedIn needs a compliance-aware audience before it lands at all. Developers engage with the architectural decisions — multi-tenant isolation, hashed emails, deletion verification across multiple databases. Agency owners need a different entry point, one that hasn't clicked yet.
A Dev.to article went out this week — making the jurisdiction argument concrete, with the decisions that followed from it. One comment here on IH, one follow on X.
June 30 is Show HN. Whether the HN audience overlaps with the people who actually need this is the thing I'm most curious about.
The architectural angle landing with developers makes sense, deletion verification across multiple databases is exactly the kind of problem that sounds simple until you're actually doing it. Proving a record is gone everywhere, including backups and replicas, is genuinely hard. On the agency segment you're stuck on: agencies don't feel GDPR as their own risk, they feel it as client liability. The entry point that tends to work is framing it as something they can sell to clients or put in a contract, not another tool they operate. Reframe it as protecting their client relationship and it becomes revenue for them instead of overhead. What have you tried with them so far?
Agency owners experience GDPR as a client concern, not their own liability. That gap — between who feels the risk and who actually carries it — is probably why compliance positioning doesn't close. We've been leading with the architecture. It lands with developers. The person signing contracts needs a different answer: something that goes into a proposal and becomes revenue, not overhead. Going to test that framing next.
Exactly. Once it's in a proposal, the agency isn't paying for compliance, they're charging for it. That flips it from cost to margin. Curious how the test goes.
"Charging for it" is the better version of what I was trying to say — that's the actual shift. Not "we're compliant" but "your clients pay extra for this."
Test is still early. Sent it to three prospects last week in a cold sequence. One opened, no reply yet. I'll post an update either way — the honest version, not the cleaned-up one.
Respect for posting the honest version. One open from three in a week isn't signal yet, it's noise. Cold email needs volume before you can read anything from it, twenty or thirty prospects minimum before the framing gets a real test. Worth pushing more through before you judge it.
Brilliant lesson in positioning. Selling "features" rarely works; selling the "outcome" is what converts.
I experienced the exact same thing building ClockingPulse. When I pitched it as "uptime and cloud billing monitoring," nobody cared. When I reframed it as "never getting caught off-guard by a downed API or a surprise $1,000 AWS bill," it finally clicked.
Good luck on the Show HN launch! Leaning into architectural transparency like multi-tenant isolation will play really well there.
The jurisdiction framing is smart it immediately filters for the people who actually care. The agency owner angle is worth cracking though, that’s probably your highest-value segment. They have budget, they have clients with GDPR exposure, and they need someone to explain the risk for them. Curious what you’ve tried with that audience so far?
5 signups in 3 weeks from indie launch is the most common PMF signal—sustainable, repeatable, not viral. The "framing that works" point is underrated. Most founders sell features; the ones who win sell the outcome the user pictures in their head 5 minutes before buying. Question: did you find that framing, or did users tell you? In our experience the best positioning comes from reading 20+ user interviews and pulling the exact words they use to describe success. Then you paste those words into your hero copy verbatim. The 5 you got are probably 5 of those exact-phrase readers.
The framing came from a conversation, not a positioning document. One early discussion about Schrems II made it obvious that "GDPR compliant" and "actually protected" don't mean the same thing — a US company's EU servers are still subject to CLOUD Act. The 5 who signed up already understood that distinction. They found the language before we had it properly written down. The challenge now is finding the ones who feel that gap but haven't named it yet.
I think the biggest lesson here is that you didn't change the product—you changed the question you led with. "GDPR compliance" describes what it is. "Who has jurisdiction over your data?" creates a reason to care. That's a much stronger starting point because different audiences don't buy the same product; they buy different answers to their own concerns.