Every licensed workforce sells hours it cannot prove.
The proof is split across four systems that never talk: the state registry, the training provider, the time clock, and payroll. No vendor in this category joins all four. GuardStack makes the provable hour a computable object — and the proof, coupled to the fix, is the product.
Not a plan. A running system.
Every number below was produced by a test against live data in the last few hours, not estimated.
Four things everyone believed that are false.
28 research reports, 2.09M characters, ~1,100 primary sources. These corrections change what gets built.
$3,500 per employee → $500, capped at $2,500
The fine everyone quotes does not exist in California law. It appears zero times in the Private Security Services Act. Real exposure is $500 per violation for training records, $250 for the missed annual refresher, with a hard cap of $2,500 on any single citation.
The deadline clock runs from guard card issuance — not hire date
Her tracker computes =C+30 and =C+180 from date of hire, and has no issuance-date column at all. Every Level 2 and Level 3 deadline in that file is anchored to the wrong event. We now pull issuance from the state registry for all 85 guards.
Harassment training is two years, not one
The one-year field is stricter internal policy, not law — which is why five people read as expired who are not legally overdue. The engine now runs both clocks separately: a statutory floor and a policy interval, breached differently.
"Defensify.com" was the wrong company entirely
That domain redirects to a Swedish cybersecurity consultancy. The real vendor is Defencify, running on Firmwater LMS — and Lead Star already has a live branded tenant with a documented REST API. Training data is reachable, not scrape-only.
A record that costs more to buy every month it runs.
Every determination is written into a tamper-evident chain under the customer's own name, dated. This is the one asset that compounds from customer one with no dependency on anyone else's behaviour.
A customer cannot retroactively prove in 2029 what it knew in 2026 on a system adopted in 2029.
Playing the incumbent, the red team named this as the single thing it cannot answer — it cannot retrofit immutability onto three unconsolidated databases, and even a flawless 2028 build gives its customers a 2028 chain against our 2026 chain. Then it said the part that matters most:
That asset gets more expensive to buy every month it runs — which is also why the rational incumbent play is to acquire early, and that is our best news.Red team, playing Trackforce
An audit trail without a fix is a plaintiff's exhibit.
So it is enforced in the database, not in application politeness. A finding cannot be committed without a remediation carrying a named owner and a due date. Tested both ways today:
| Test | Expected | Result |
|---|---|---|
| Finding with no remediation | Rejected at commit | REJECTED ✓ |
| Finding + remediation, one transaction | Commits cleanly | COMMITTED ✓ |
| Evidence chain integrity | Zero broken links | 0 BROKEN ✓ |
| Daily head seal | Chain tip pinned | SEALED ✓ |
The guard vertical alone cannot produce a unicorn.
This is the finding the room was most reluctant to produce, and the most valuable one in it.
$20.8M at 100% share
3,922 buyable US guard establishments of 20–249 employees. At $8 per active guard per month, total market capture is $20.8M. At a realistic 30% with modules attached: roughly $10–11M.
$26.17 per guard per month
That is the buyer's entire operating income per guard. Every price above ~$15 asks him to work for free. You cannot price your way to a bigger number.
6.2M workers · $265B wages
The four adjacent licensed-hourly verticals. $100M requires proving one buyer title, one sales motion and one CAC reach a second vertical. That is the only arithmetically live path.
Twelve routes. Twelve times no.
A second war room ran twelve independent business routes — self-serve at volume, percentage of wages, factoring, statutory training, labour marketplace, AI-delivered services, buy-and-build, embedded infrastructure, data sold to capital, insurance MGA, remote monitoring, and a wildcard told to invent something nobody has tried. Every one was asked: can a solo founder with exceptional AI reach $100M ARR in 1–2 years? All twelve returned no. Not one dissent.
The kill shot
Take the most generous assumptions that exist. Every guard employer in the United States — 17,262 establishments — buying at $4,188 a year, the highest price anyone has ever charged self-serve in adjacent credential software. A literal national monopoly.
| Scenario | Arithmetic | Result |
|---|---|---|
| Monopoly, highest self-serve price ever | 17,262 × $4,188 × 100% | $72.3M — 28% SHORT |
| Monopoly, realistic price | 17,262 × $708 × 100% | $12.2M |
| Every recurring guard-training dollar in America | all vendors combined | $27–58M |
| ACV needed at 100% of buyable firms | $100M ÷ 3,922 | $25,497 |
| A 50-guard firm's entire annual operating income | $26.17 × 50 × 12 | $15,702 |
Why the fast-$100M precedents don't transfer
Every company that reached $100M quickly with a small team sold a horizontal product to a denominator of millions. Here is how many paying customers each needed at its real price:
| Company | Price | Paying customers needed | Team |
|---|---|---|---|
| Lovable | $556/yr | 180,000 | 146 FTE |
| Midjourney | $143/yr | 699,000 | 40–45 FTE |
| Gamma | $170/yr | 588,000 | 52 FTE |
| Bolt | $300/yr | 333,333 | — |
Where the two surviving judges landed
Judged on raw ARR ceiling, and separately on profit per unit of founder attention, both picked the same side of the market — and it is not the one we have been building toward.
Sell to the worker, not the employer
There are 17,262 guard employers in America. There are 359,807 licensed guards in California alone. The employer side has no denominator; the worker side does. Statutory continuing education plus a portable credential wallet is the only shape in this space with millions of potential buyers and no sales calls.
But be honest about that ceiling too
California guard CE is a $10.8M/year market across all vendors. Nationally, $27–58M. Texas expressly exempts non-commissioned officers from continuing education, so it does not scale proportionally. Widening to nursing, home health and allied health reaches $202M gross at 100% share — meaning $100M requires half of every CE dollar in four professions, against Colibri, Relias and HealthStream. Not with five people.
What this changes, and what it doesn't
The compliance product remains the right first build: it is real, it is running, it produces evidence nobody else has, and it makes the incumbent's acquisition math worse every month it runs. What changes is the story told about it. A $3M-at-24-months business with 85% margins and no sales team is an excellent outcome for one person. It is not a unicorn, and the room could not find a route in this space that is — which is worth far more than a number invented to sound better.