LEGION AI: The War Room

The Challenge

Dr. Todd Snyder had spent 32 years building a distinct philosophy: a contrarian, identity-first approach to dentistry and life: the lean one-chair model, "take ownership of your life," and one core tenet above all.

Liberation, not anger.

His voice, frameworks, and strategic instincts were his most valuable asset, but they lived only in his head and his talks. The goal was to bottle Todd's brain: build a product that lets any dentist tap his strategic thinking on demand (a thinking partner that reasons the way Todd does) and pair it with a content engine that turns that thinking into social media. Then wrap it in a real business: paid subscriptions, airtight security, and a self-service funnel that runs without Todd touching it.

Three hard requirements defined the build:

1. It must sound like Todd, not a generic chatbot wearing his name.
2. It must be a real, secure SaaS, with client data protected to a "Fort Knox" standard.
3. The money must be clean, handled entirely through Todd's existing Kajabi, with the app as the only gated destination.

The Solution

A private, war-themed web application (The War Room) that combines four products in one.

The Funnel

Todd's requirement was absolute: no account can exist without going through Kajabi. We engineered a clean, inverted funnel and enforced it at the deepest possible level.

No account can exist without going through Kajabi.

A stranger clicks "Sign up" in the War Room (or Todd's shared link) and both route to a Kajabi checkout. They pay, land on the Thank-You page, and are dropped onto /activate with their email pre-filled to set a password. A branded verification email confirms the address, and they're in.

How it's locked down:

• A Kajabi webhook verifies every purchase (token- and offer-token-authenticated, idempotent, race-safe) and parks a paid entitlement, so a buyer is recognized the instant they arrive, even before they have an account.
• Account creation is payment-gated server-side. No purchase on file, no account.
• The guarantee is enforced in the database itself: a Postgres trigger on the user table rejects any account creation without a paid entitlement, closing every path, including the raw API and admin tools.
• Verified both directions in production: an unpaid email is hard-rejected, and a real (simulated) Kajabi purchase flows cleanly through webhook, entitlement, and activation.

The result is a hands-off funnel where a stranger can go from a Kajabi sales link to a fully provisioned, verified War Room account, with Todd never lifting a finger.

Security

Security was treated as a first-class product, not an afterthought. A four-pillar hardening pass (plus a full vulnerability audit that identified and closed 17 findings) delivered:

• Perimeter, strict Content-Security-Policy, HSTS, clickjacking protection (X-Frame-Options DENY), and the full modern security-header suite
• Identity, real auth with hashed passwords, optional two-factor (TOTP), bulletproof sign-out across every call site, and constant-time secret comparison
• Data protection, Row-Level Security on every table (users physically isolated at the database layer), signed direct-to-storage uploads, and an append-only, tamper-resistant audit log
• Abuse resistance, atomic per-user and per-IP rate limiting, CSRF origin verification on every state-changing route, and enumeration-safe auth forms
• Least privilege, API keys never touch the chat transcript. They live only in the environment, and every operational script reads them from there

Data & Privacy

Built for a healthcare-adjacent audience, with honest guardrails:

• SOC 2 Type II infrastructure (Supabase on AWS), encrypted at rest (AES-256) and in transit (TLS).
• Payments never touch our servers. Kajabi and Stripe handle all card data.
• AI conversations are not used for model training (Anthropic API).
• Full user control, with self-service data deletion and cascading cleanup.
• Clear positioning as a strategy and marketing tool, not a place for patient health information.

Architecture

• Framework, Next.js 16 App Router (Turbopack), React, strict TypeScript
• Design system, a custom, war-themed component library (blood-red, gold, and gunmetal tokens) on Tailwind. Every screen refactored onto shared primitives for one consistent, fully responsive, theme-aware language
• Backend, Supabase (Postgres with RLS, Auth, Storage, MFA) with server-side clients, middleware session refresh, and race-safe Postgres functions for all critical mutations
• AI, Anthropic Claude with prompt caching and server-side injection of Todd's brain
• Integrations, Kajabi (payments & webhooks), Ayrshare (multi-platform social publishing), Resend (branded transactional email)
• Delivery, Vercel with a custom domain, provisioned SSL, and branded DNS-authenticated email (SPF & DKIM)

Outcome

A complete, production-grade SaaS, designed, built, secured, and shipped end-to-end:

• A living AI product that thinks and speaks in Todd's voice.
• A four-in-one platform: strategic chat, content engine, social publishing, and admin analytics.
• A fully automated, database-locked payment funnel: no account without a purchase, verified in production.
• Bank-grade security and privacy posture, audited and hardened.
• A branded, custom-domain experience Todd can put his name (and his customers) behind.

The War Room is live at legionwarroom.com. Todd's brain is now a product his audience can enlist in, 24/7, at scale, without him in the room.