There is a version of this story that is a stack list for Hacker News, and a version that is a lecture about GxP. Both miss the actual job. I build software that sits next to pharmaceutical work — patient advocacy intelligence, unmet-need research, regulatory monitoring, promotional reference packs — and I do it without a team. This is how, and what I would not do again.
The products live on powellmatt.com. The infrastructure is mine. That is a feature I used to undersell.
Why solo is a constraint and a claim
Constraint: there is no platform squad, no on-call rota, no designer on retainer. If the box dies at 2am, I am the rota.
Claim: the person who sat in pharma commercial roles is the same person who ships the product. Briefs do not go through four teams and come out as a different problem. For a brand or regulatory buyer used to enterprise vendors, “one person, live products” is easier to diligence than a pitch deck with a hiring plan.
I would not solo a system that has to be validated as a medical device, or a platform that stores identifiable patient data at scale. I pick problems where the software is an intelligence or workflow tool, not the clinical system of record.
The shape of the estate
I run production across VPS nodes. Coolify is how apps get from git to a URL. Tailscale is how I reach admin planes without opening the world’s ports. Front ends that can be static — this site included — are Astro, built once, served as files. Heavier products get their own app and database, not a shared monolith.
That split is deliberate:
- Marketing sites should be boring. Static files, a reverse proxy, a domain. This homepage is that.
- Products get isolated deploys. A bad migration on RegulatoryAlerts should not take PatientGroups with it.
- Private tooling (scrapers, admin, internal search) stays on the tailnet. Subdomains of
powellmatt.comhave been useful here. They are not the public brand.
Coolify is not Heroku, and that is the point. I want SSH-level ownership and predictable cost while I am still the entire company. The trade-off is that I am also ops. Backups, certificates, disk, and “why is this node unhappy” are product work, whether I calendar them or not.
What I actually spend time on
Not the framework. The unglamorous loop:
- Source integrity. If the product is a map of patient groups or a feed of agency alerts, garbage in is the whole company. Scrapers, parsers, and “what did the site do this week” eat more hours than UI.
- Tenancy and secrets. Even a small SaaS has keys, customer data, and the temptation to debug in production. I keep customer environments and my laptop habits further apart than is convenient.
- Restore drills. A backup you have never restored is a story. I would rather a crude snapshot I have practised than an elegant policy I have not.
- Copy and claims. These products sit next to regulated work. The website cannot promise things the software does not do. That is a product constraint, not a legal afterthought.
Astro, Postgres, a queue, a container — those are interchangeable. The loop above is not.
Trade-offs I accept
No SOC 2 theatre on day one. Buyers will ask. I answer with architecture, isolation, and what I will not store — not with a logo I bought. When a deal requires a heavier audit, that is a company event, not a weekend.
No multi-region fantasy. One region, known backups, a documented restore. Latency is not the failure mode. Silence after a disk fills is.
Less real-time than the demo wants. Regulatory monitoring and advocacy maps need to be current enough. They do not need a WebSocket. Batch jobs that finish and can be inspected beat clever streaming I cannot debug alone.
Fewer features. A solo founder who says yes to every adjacent module ships nothing. Each product on this site is a sharp job: score groups, extract needs, watch agencies, build a reference pack. Adjacent jobs get a different URL or a no.
Trade-offs I do not accept
Mixing patient-facing and pharma-facing data models. PatientGroups.ai and PatientGroups.co are sibling products on purpose. Different users, different duty of care.
Putting identifiable health data in a tool that does not need it. Public conversation and public organisation data are a different risk class from anything that looks like a medical record.
A single database for every idea. Convenience on Tuesday is an incident on Thursday.
Marketing that outruns the product. If I cannot show the trail — quote, source, claim — I do not write the sentence. That is the same instinct as PromoPack, applied to my own sites.
What this is for
I wrote this because people ask how a pharma-shaped SaaS exists without a 40-person org, and because the honest answer is useful to the next person who will try. It is also a filter. If you need a vendor with a floor of account managers, I am the wrong call. If you need someone who can go from a market problem to a running system, that is the work.
The products are listed on the homepage. The human version is Elliogen advisory. If you want to argue about the stack, email is fine.