Security, Architecture & Trust

PropelRoot AI is engineered from the ground up with a defense-in-depth security model to protect high-ticket contractors, enterprise trade secrets, and consumer telecommunications data. Every layer of our cloud infrastructure—from Voice AI pipelines and carrier SMS rails to our database storage—enforces cryptographic isolation and strict regulatory compliance.

1. Cryptographic Security Standards

1.1. Data in Transit: All HTTP traffic to `propelroot.pro` and `app.propelroot.tech` is encrypted via TLS 1.3 with automated HSTS preloading. Unencrypted HTTP requests are permanently redirected to HTTPS.

1.2. Voice Audio Streams: Real-time telephony audio between carrier trunks (Vonage) and our Pipecat Voice AI engine flows through secure, authenticated WebSockets (WSS) and SRTP channels.

1.3. Cryptographic Secret Vault: Tenant-specific integration credentials are stored in a dedicated database vault encrypted with AES-256-GCM authenticated data. Any cross-tenant decryption attempt automatically fails closed with zero plaintext exposure.

2. Multi-Tenant Isolation and Workspace Siloing

PropelRoot AI enforces a multi-tenant isolation model at the software, database, and carrier layers:

• Database Layer: All PostgreSQL tables enforce tenant user keys (`user_key` / `workspace_id`). Multi-tenant isolation is deterministically validated by automated CI test suites (`test_two_tenant_isolation.py`).
• Carrier Layer: Each contractor operates on isolated carrier subprojects or dedicated number pools. If one contractor exhausts their wallet balance or encounters campaign review, neighboring client accounts remain 100% unaffected.
• Storage Layer: Dual audio recordings and CRM files are stored in tenant-scoped directories with signed, short-lived URLs.

3. Identity, Authentication & Access Controls

Authentication is powered by WorkOS AuthKit in production mode:

• Role-Based Access Control (RBAC): Differentiates between Owner/Admin (billing, API keys, number purchasing), Managers (lead review, calendar management), and Members (read-only call log viewing).
• Multi-Factor Authentication (MFA) & Passkeys: Supported natively across all accounts.
• Session Protection: Server-side encrypted session tokens with automatic TTL expiration and secure cookie attributes (`HttpOnly`, `Secure`, `SameSite=Lax`).

4. Zero-AI SMS Compliance & Carrier Reputation Defense

PropelRoot AI rejects probabilistic AI models for carrier compliance. Carrier anti-spam and opt-out enforcement is 100% deterministic:

• FlashText Keyword Trie: Normalized inbound scanning catches CTIA single/double keywords (STOP, CANCEL, QUIT, UNSUBSCRIBE) and 120+ hostile consumer phrases in under 0.1 milliseconds.
• Physical Outbound Shield: Once an opt-out occurs, `assert_recipient_not_opted_out()` enforces an immediate code-level rejection (`HTTP 409 Conflict`), physically preventing SMS dispatch across all automated workflows.
• Tripwire Defense: Automated campaign monitors track opt-out velocity. If a campaign approaches carrier tolerance thresholds, outbound messaging is automatically paused to protect the contractor's 10DLC brand.

5. Conversational Voice AI Privacy

PropelRoot AI upholds strict customer voice privacy:

• Zero Training Policy: Voice call audio and proprietary transcripts are strictly confidential. We enforce zero-data-retention and zero-model-training agreements with foundation model providers.
• Customer-Safe Transcripts: All internal system prompts and raw telephony instructions are stripped from customer-facing transcripts. The contractor sees only clean dialogue labeled “AI” and “Lead”.
• Voicemail & Human Detection: Proprietary audio analysis detects answering machine beeps and automated prompts within milliseconds, cleanly disconnecting or dropping pre-recorded messages without wasting paid minutes.

6. Cloud Infrastructure & High Availability

6.1. Hosting Infrastructure: PropelRoot AI is hosted on Google Cloud Platform (GCP) Northern Virginia (`us-east4-c`) on dedicated high-performance cloud compute instances.

6.2. Sub-Millisecond Database Ping: Our Supabase PostgreSQL 17.6 database is located in AWS Northern Virginia (`us-east-1`), ensuring sub-millisecond network round-trips for real-time Voice AI tool execution.

6.3. DDoS Defense & Global Edge: Protected behind Cloudflare Enterprise-grade proxies with automated Web Application Firewall (WAF) rate limiting and volumetric DDoS mitigation.

6.4. Backup and Disaster Recovery: Automated point-in-time recovery (PITR) and daily encrypted database snapshots.

7. Vulnerability Management & Incident Reporting

PropelRoot AI welcomes responsible security disclosures from verified security researchers. If you discover a potential vulnerability, please email our security team immediately at [email protected]. We investigate all valid reports within twenty-four (24) hours.

8. Security Inquiries

To request a completed Vendor Security Questionnaire (VSQ) or arrange a technical security review, contact:

Enterprise Security Team
PropelRoot AI
Email: [email protected] / [email protected]
Headquarters: 8 The Green, Ste B, Dover, DE 19901, United States