Control before automation.

Architecture

Browser audio goes to the configured voice provider, then through an immutable FieldRelay policy. Authenticated webhooks can attach the call ID, transcript, policy decision, and provisional dispatcher receipt to a short-lived D1 demo session.

Immutable boundaries

• No diagnosis or repair instruction.
• No firm estimate, service promise, or confirmed appointment.
• Danger language stops routine intake.
• The public demo cannot perform a real human handoff.
• Prompt-injection attempts do not replace the system policy.

Data and retention

Public demo sessions expire after two hours; pitch sessions after 24 hours. Cleanup removes expired sessions after a one-day grace period. Rate limiting stores a salted IP hash, never the raw IP. Application logs must not contain transcripts, names, emails, or prospect profiles.

Audio and recording

Microphone access requires an explicit click. Public pitch recording is disabled in the voice assistant configuration. Call participants must still follow applicable notice and consent laws before any production recording is enabled.

Provider and failure limits

Voice availability depends on the configured provider and credits. If it fails, the public experience labels its audible scripted sample as an illustrative fallback. Missing webhook storage does not create a false success state.

Production readiness

Production launch remains blocked until the previously exposed provider private key is rotated, secrets are configured through hosting, the audit webhook works, legal copy is approved, and founder/company details are supplied.