SalesLens

An AI coaching assistant that ingests sales calls (upload or Zoom), transcribes them, and surfaces objections, competitor mentions and coaching moments, each with the exact quote and timestamp, in a manager review queue.

GREENFIELDStage: BLUEPRINT COMPLETEb2b-ai-saasRaftly 0.2.0

Rendered 2026-10-24T16:53:59Z from .raftly/. This page is a view, not a source of truth: edit Raftly state and re-render.

Overview

Where the product stands, derived from state.yaml, build-graph.yaml and gate.yaml.

Blueprint

6/6

sections resolved · COMPLETE

Build

complete · 0% verified · 14 nodes

Production readiness

INSUFFICIENT EVIDENCE

evidence covers 0% of applicable checks — no score without evidence

Scope

active requirements · 10 features · 12 decisions

Blueprint sections
Section	Status
Product	COMPLETE
Design	COMPLETE
Architecture	COMPLETE
Data	COMPLETE
Security	COMPLETE
Build	COMPLETE

14 capabilities in 9 dependency phases. Phase 0 platform; Phase 1 identity + eval harness (in parallel); Phase 2 isolation; Phase 3 ingestion, billing; Phase 4 transcription, governance; Phase 5 extraction; Phase 6 queue, trends; then rep view, notifications, launch readiness. No calendar commitments; the pilot (EXP-001) gates the paid launch.

Open founder decisions

Pricing model: per-seat with an included audio-hour allowance (Raftly recommendation) or usage-based per audio hour

Product

From PRODUCT.md and requirements.yaml.

Problem

Sales managers are expected to coach, but reviewing calls is slow: a manager with eight reps doing 15 calls a week cannot listen to 120 hours of audio. Coaching becomes anecdotal, objections go unnoticed until deals are lost, and competitive shifts surface late. Enterprise conversation-intelligence tools exist but are heavy and priced for large organizations (not verified: competitor positioning and pricing need dated research; see RESEARCH.md #6).

ICP

ICP (A-006): B2B sales teams of 10–100 reps without an enterprise conversation-intelligence tool, recording calls on Zoom.
Buyer: VP or Head of Sales. Admin: RevOps or a sales manager. Primary user: frontline sales managers. Secondary user: reps.

Positioning

For sales managers at growing B2B teams who need to coach without listening to every call, SalesLens is an AI coaching assistant that surfaces objections, competitor mentions and coaching moments with the exact quote and timestamp. Unlike enterprise conversation-intelligence suites, it is coaching-first, set up in under a day, and priced for mid-market teams.

Differentiation

Coaching workflow first (a queue, not a dashboard), evidence on every insight (verbatim quote + timestamp), time-to-value under one day, privacy controls customers can see (retention, consent attestation, deletion).

Active requirements
ID	Requirement	Priority	Features
REQ-001	Customer organizations are isolated tenants; users belong to an organization with Admin, Manager or Rep roles	MUST	F001
REQ-002	Users sign in with email magic link or Google/Microsoft OIDC and join via invitation	MUST	F001
REQ-003	Users upload call recordings (mp3, m4a, wav, mp4; up to 3 hours) or import Zoom cloud recordings	MUST	F002
REQ-004	Calls are transcribed with speaker separation that distinguishes the rep from prospect speakers	MUST	F003
REQ-005	The system detects objections, competitor mentions and coaching opportunities, each with a timestamped evidence quote and confidence	MUST	F004
REQ-006	Managers review insights in a queue: accept, dismiss or edit, add a coaching note, and share with the rep	MUST	F005
REQ-007	Reps see only their own calls and coaching unless an Admin grants team visibility	MUST	F001, F006
REQ-008	Managers see objection and competitor trends over time by team and rep	MUST	F007
REQ-009	Paid plans with a 14-day trial, seat management and an audio-hours allowance enforced per organization	MUST	F008
REQ-010	Uploaders attest that recording consent was obtained; organizations can configure a consent policy notice	MUST	F002
REQ-011	Organizations control retention (default: audio 12 months, transcripts and insights until deletion), export their data and delete calls or the whole organization	MUST	F009
REQ-012	Before launch, objection detection meets precision ≥ 0.85 and recall ≥ 0.80 on the versioned evaluation set	MUST	F004
REQ-013	Managers receive a weekly coaching digest email; reps are notified when coaching is shared	SHOULD	F010
REQ-014	Admin and data-access actions are recorded in an audit log visible to Admins	SHOULD	F009
REQ-015	Link calls to CRM deals (Salesforce, HubSpot) for context	COULD	—
REQ-016	V1 excludes real-time call assist, CRM write-back and training models on customer data	WONT	—

Build graph

Capabilities in dependency order (not a calendar). Phases are derived from dependencies.

COMPLETEIN PROGRESSIMPLEMENTED · UNVERIFIEDBLOCKEDPLANNED

Nodes by phase
Phase	ID	Capability	Type	Depends on	Status
0	N001	Platform foundation	ops	—	PLANNED
1	N002	Identity and organizations	foundation	N001	PLANNED
1	N006	AI eval harness and golden dataset	quality	N001	PLANNED
2	N003	RBAC and tenant isolation	security	N002	PLANNED
3	N004	Call ingestion and storage	feature	N003	PLANNED
3	N011	Billing and usage metering	feature	N003	PLANNED
4	N005	Transcription pipeline	feature	N004	PLANNED
4	N012	Data governance	security	N004	PLANNED
5	N007	Insight extraction	feature	N005, N006	PLANNED
6	N008	Manager review queue	feature	N007	PLANNED
6	N010	Team trends	feature	N007	PLANNED
7	N009	Rep coaching view	feature	N008	PLANNED
7	N013	Notifications	feature	N008	PLANNED
8	N014	Launch readiness	launch	N009, N010, N011, N012, N013	PLANNED

Features

Status requires evidence: VERIFIED and COMPLETE are only shown when verification passed.

Organizations, authentication and rolesPLANNED

F001 · MUST · node N002 · evidence NONE

Requirements: REQ-001, REQ-002, REQ-007

Call ingestion and Zoom importPLANNED

F002 · MUST · node N004 · evidence NONE

Requirements: REQ-003, REQ-010

Transcription pipelinePLANNED

F003 · MUST · node N005 · evidence NONE

Requirements: REQ-004

Insight extractionPLANNED

F004 · MUST · node N007 · evidence NONE

Requirements: REQ-005, REQ-012

Manager review queuePLANNED

F005 · MUST · node N008 · evidence NONE

Requirements: REQ-006

Rep coaching viewPLANNED

F006 · MUST · node N009 · evidence NONE

Requirements: REQ-007

Team trendsPLANNED

F007 · MUST · node N010 · evidence NONE

Requirements: REQ-008

Billing and usage meteringPLANNED

F008 · MUST · node N011 · evidence NONE

Requirements: REQ-009

Data governance and audit logPLANNED

F009 · MUST · node N012 · evidence NONE

Requirements: REQ-011, REQ-014

NotificationsPLANNED

F010 · SHOULD · node N013 · evidence NONE

Requirements: REQ-013

Design

From DESIGN.md.

Chosen direction

A as the manager home, B as the call detail view, C as the Trends tab (ADR-009, confidence 70). Validated by EXP-001.

Design direction options

Option A — Coaching queue (recommended)

An inbox-style queue of insights grouped by rep, with filters (type, team) and keyboard triage; detail panel on the right.

| Queue ▾ team: West  type: all        | [quote + 30s audio]          |
| ● Dana  · objection: pricing  0.92   | "Honestly the price is..."   |
| ● Dana  · competitor: Acme    0.97   | context transcript ...        |
| ● Lee   · coaching: no next step     | [accept] [edit] [dismiss]     |
|                                      | note: ______  [share with rep]|

Strengths: maps to the core job; generates quality signals (accept/dismiss). Weaknesses: less overview on landing.

Option B — Call-centric library

A call list → call page with transcript, timeline markers and an insights panel. Strengths: familiar from recording tools. Weaknesses: managers still pick calls to review, which is the work we're removing.

Option C — Team dashboard first

KPIs and trends on landing; drill into calls. Strengths: leader-friendly. Weaknesses: indirect path to action; risks becoming shelfware.

Information architecture

Entities: Organization › Teams › Reps › Calls › Transcript › Insights › Coaching notes. Top-level navigation: Queue (managers' home) · Calls · Trends · Settings (Admins). Reps: My coaching · My calls.

Key screens

SCR-queue — Coaching queue (manager home)

Purpose: triage new insights. Primary action: accept/share. Secondary: dismiss, edit category, open the call.
Data: rep, insight type/category, confidence, call date, quote preview; the detail panel shows quote, audio snippet, context.
States: default · empty ("You're all caught up") · loading (skeleton rows) · error (retry; cached list kept) · success (toast "Shared with Dana").
Permissions: Manager (own teams), Admin (all).
Desktop: two-pane. Tablet: list → detail push. Mobile: list → full-screen detail.
Keyboard: j/k move, Enter open, a accept, d dismiss, e edit, s share, ? help.
Accessibility: listbox semantics with an active descendant; audio player with labelled controls; confidence as text.
Analytics: insight_actioned{action} (no content).

SCR-call-detail — Call

Purpose: full context. Data: metadata, audio player, transcript with speaker labels, timeline markers, insights list.
States: processing (step + estimate) · failed (reason + retry) · ready · insights unavailable (retry).
Permissions: per visibility rules. Responsive: transcript below the player on mobile.
Accessibility: transcript as a list of labelled segments; click-to-seek via buttons.

SCR-upload — Upload

Drag-and-drop + file picker, consent attestation (org policy text), resumable progress, limits explained. Errors explain the format/duration limits.

SCR-rep-feed — My coaching

Shared notes as cards (manager, quote, audio, note, reply). Empty: "No coaching yet…". Read status.

SCR-trends — Trends

Period/team filters, objection categories over time (line), competitor share (bar), per-rep table; every chart has a table alternative and a summary sentence; small-sample warnings.

SCR-org-settings / SCR-audit-log / SCR-integrations / SCR-billing / SCR-signin / SCR-notification-settings

Standard settings patterns; destructive actions require typed confirmation; every list has empty/loading/error states.

Accessibility

WCAG 2.2 AA target; keyboard-first triage; colour never the only signal (confidence and status in text); captions/transcript for all audio.

Architecture

From ARCHITECTURE.md and dependencies.yaml.

System overview

A TypeScript modular monolith (ADR-001): the web process (Next.js UI + API routes) and the worker process (pg-boss consumers) share domain modules. PostgreSQL holds all relational data with row-level-security tenancy (ADR-002) and the job queue (ADR-005). Audio lives in S3-compatible storage under per-tenant prefixes (ADR-004). AI calls go through provider interfaces (ADR-006, ADR-007) gated by an eval harness (ADR-008).

 Browser ──HTTPS──► web (Next.js UI + API) ──► domain modules ──► PostgreSQL (RLS, pg-boss queue)
    │                      │   ▲                                      ▲
    │ presigned upload     │   └── Stripe/Zoom webhooks (verified, idempotent)
    ▼                      │ enqueue
 Object storage ◄──────────┼──────────── worker (pg-boss consumers)
 (org/{id}/...)            │               ├─ ingest/import (Zoom API)
                           │               ├─ transcribe ─► TranscriptionProvider ─► STT API
                           │               ├─ extract ────► ExtractionProvider ─► LLM API
                           │               ├─ meter usage ─► Stripe
                           │               └─ retention / export / digests
                           └─ OpenTelemetry traces + metrics, error tracking (PII-scrubbed)

Stack

Concern	Choice	ADR	Notes
Web + API	Next.js (TypeScript)	ADR-001	one deployable + worker
Background jobs	pg-boss on Postgres	ADR-005	retries, DLQ, idempotency keys
Database	PostgreSQL + RLS, Drizzle ORM	ADR-002	Type-1
Auth	Auth.js (magic link, Google/Microsoft OIDC)	ADR-003	SAML on revisit trigger
Object storage	S3-compatible, per-tenant prefixes	ADR-004	lifecycle + retention job
Transcription	Provider interface; provider via spike	ADR-006	PROPOSED dependency
AI extraction	Anthropic API behind `ExtractionProvider`	ADR-007	model chosen by eval
AI quality	Eval harness + golden dataset	ADR-008	launch blocker
Billing	Stripe Billing + internal usage ledger	ADR-010	pricing model: founder decision open
Integrations	Zoom only	ADR-011	CRM deferred
Observability	OpenTelemetry + error tracking	ADR-001	PII scrubbing
Email	Transactional provider (chosen in N013)	—	SPF/DKIM/DMARC

Boundaries

Modules: orgs (identity, memberships, roles), calls (ingestion, storage, consent), transcripts, insights (extraction, reviews, notes), trends (read models), billing, governance (retention, export, deletion, audit), notifications. Rules: modules call each other through exported service functions only; only repositories touch the database; every repository requires an org context; provider SDKs live only in adapters/.

Failure behavior

Critical path	Failure	User sees	System does	Detected by
Upload	interrupted	resume prompt	multipart resume	upload failure metric
Zoom import	token revoked	integration needs reconnect	stop polling; notify Admin	import error alert
Transcription	provider down/timeout	"Transcribing… delayed"	retry w/ backoff, DLQ after 3	queue age alert
Extraction	invalid output	items omitted, "insights unavailable" if none	discard + retry; fallback model	schema-failure rate alert
Extraction	cost limit hit	"Analysis paused, contact admin"	pause org processing	cost alert
Billing webhook	duplicate/out of order	nothing	idempotent processing	webhook failure alert
Tenancy	missing org context	403	deny by default (RLS)	authz denial spike alert

Dependencies (dependencies.yaml)
Name	Purpose	License	Status	Lock-in
next	Web app and API routes (TypeScript, one deployable)	MIT	ADOPTED	LOW
postgresql	Primary relational database with row-level security	PostgreSQL	ADOPTED	LOW
drizzle-orm	Typed SQL and migrations	Apache-2.0	ADOPTED	LOW
next-auth	Authentication (magic link, Google and Microsoft OIDC)	ISC	ADOPTED	LOW
pg-boss	Postgres-backed job queue for ingestion, transcription and analysis jobs	MIT	ADOPTED	LOW
S3-compatible object storage	Encrypted audio storage with lifecycle rules	proprietary service	ADOPTED	LOW
Speech-to-text provider	Transcription with diarization (provider chosen by N005 spike)	UNVERIFIED	PROPOSED	MEDIUM
Anthropic API	LLM extraction of objections, competitors and coaching moments	proprietary service	ADOPTED	MEDIUM
stripe	Subscriptions, trials, seats and metered audio hours	proprietary service	ADOPTED	MEDIUM
Transactional email provider	Magic links, invitations, digests (provider chosen in N013)	UNVERIFIED	PROPOSED	LOW
opentelemetry	Traces and metrics instrumentation	Apache-2.0	ADOPTED	LOW

Diagrams

Five product diagrams from DIAGRAMS.md. They render as pictures on GitHub and in Markdown viewers that support Mermaid.

System architecture

A TypeScript modular monolith (ADR-001): a web process and a worker process share the domain modules. PostgreSQL with row-level security holds all relational data and the job queue (ADR-002, ADR-005). Audio lives in object storage under per-tenant prefixes (ADR-004).

Mermaid source (flowchart)

flowchart LR
  browser(["Browser: admins, managers, reps"])
  web["web: Next.js UI + API routes"]
  worker["worker: pg-boss consumers"]
  db[("PostgreSQL: RLS tenancy + job queue")]
  obj[("Object storage: org/{id}/...")]
  zoom["Zoom API + webhooks"]:::ext
  stripe["Stripe Billing"]:::ext
  stt["Speech-to-text: provider undecided"]:::ext
  llm["LLM API: Anthropic"]:::ext
  mail["Email: provider undecided"]:::ext
  browser -->|HTTPS| web
  browser -->|presigned upload| obj
  web -->|"reads, writes, enqueues"| db
  db -->|jobs| worker
  worker -->|reads audio| obj
  worker -->|import recordings| zoom
  worker -->|TranscriptionProvider| stt
  worker -->|ExtractionProvider| llm
  worker -->|report usage| stripe
  worker -->|digests| mail
  zoom -. verified webhooks .-> web
  stripe -. verified webhooks .-> web
  classDef ext stroke-dasharray: 5 5

User flow

The manager triage flow from DESIGN.md, from a call arriving to a rep reading shared coaching, including the processing-failure branch.

Mermaid source (flowchart)

flowchart TD
  start([Call arrives]) --> src{"Source"}
  src -->|upload| consent["Attest recording consent"]
  src -->|Zoom import| consent
  consent --> process["Transcribe, then extract insights"]
  process -->|ready| queue["Manager's coaching queue"]
  process -->|failed| failed["Call shows reason + retry"]
  failed --> process
  queue --> review{"Review insight with quote + audio"}
  review -->|dismiss with reason| queue
  review -->|accept or edit| note["Add coaching note"]
  note --> share["Share with the rep"]
  share --> rep["Rep sees it in My coaching"]
  rep --> reply([Rep replies or marks read])

Screen map and navigation

Direction A, coaching queue first (ADR-009). Managers land on the queue; reps land on My coaching; settings screens are admin-only.

Mermaid source (flowchart)

flowchart LR
  signin["Sign in"] --> role{"Role"}
  role -->|manager| queue["Coaching queue (home)"]
  role -->|rep| feed["My coaching"]
  role -->|admin| queue
  queue --> callDetail["Call detail: audio, transcript, insights"]
  calls["Calls list"] --> callDetail
  queue --> calls
  calls --> upload["Upload + consent"]
  queue --> trends["Trends"]
  trends -->|drill into evidence| callDetail
  feed --> mycalls["My calls"] --> callDetail
  queue --> settings["Settings (admin)"]
  settings --> integrations["Integrations: Zoom"]
  settings --> billing["Billing"]
  settings --> audit["Audit log"]
  settings --> org["Org settings: retention, consent"]

Data model

Shared schema with org_id on every tenant table and RLS policies (ADR-002, DATA_MODEL.md). Billing and governance tables are summarised.

Mermaid source (erDiagram)

erDiagram
  ORGS ||--o{ MEMBERSHIPS : has
  ORGS ||--o{ TEAMS : has
  TEAMS ||--o{ TEAM_MEMBERS : has
  ORGS ||--o{ CALLS : owns
  CALLS ||--o| TRANSCRIPTS : has
  TRANSCRIPTS ||--o{ TRANSCRIPT_SEGMENTS : has
  CALLS ||--o{ INSIGHTS : yields
  INSIGHTS ||--o{ INSIGHT_REVIEWS : reviewed_by
  INSIGHTS ||--o{ COACHING_NOTES : shared_as
  CALLS }o--|| CONSENT_ATTESTATIONS : requires
  ORGS ||--o{ USAGE_EVENTS : meters
  ORGS ||--o{ AUDIT_EVENTS : logs
  ORGS {
    uuid id PK
    text name
    int retention_audio_days
    enum status
  }
  CALLS {
    uuid id PK
    uuid org_id FK
    uuid rep_user_id FK
    enum source
    text storage_key
    text content_hash
    enum status
    uuid consent_attestation_id FK
  }
  INSIGHTS {
    uuid id PK
    uuid org_id FK
    uuid call_id FK
    text type
    text quote
    float confidence
    text prompt_version
  }
  COACHING_NOTES {
    uuid id PK
    uuid org_id FK
    uuid insight_id FK
    uuid author_id FK
    timestamp shared_at
    timestamp read_at
  }

Critical path sequence

Upload to insights: the path every customer depends on. Retries with backoff and a dead-letter queue for the speech provider; invalid AI output is discarded, not shown (ARCHITECTURE.md failure behaviour).

Mermaid source (sequenceDiagram)

sequenceDiagram
  actor M as Manager
  participant W as web
  participant S as Object storage
  participant DB as PostgreSQL
  participant K as worker
  participant T as Speech-to-text
  participant L as LLM
  M->>W: start upload + attest consent
  W->>DB: save call, attestation (org_id, RLS)
  W-->>M: presigned upload URL
  M->>S: upload audio (resumable)
  W->>DB: enqueue transcribe job
  K->>DB: claim job
  K->>T: transcribe(audio)
  alt provider down or timeout
    T-->>K: error
    K->>DB: retry with backoff, dead-letter after 3
    W-->>M: Transcribing... delayed
  else transcript ready
    T-->>K: segments
    K->>L: extract insights (structured output)
    alt invalid output
      L-->>K: fails schema
      K->>K: discard, retry, then fallback model
    else valid
      L-->>K: insights with quotes + timestamps
      K->>DB: save insights, usage event
      W-->>M: queue updated, ready notification
    end
  end

Decisions

Chronological Decision Book. Overrides and superseded decisions stay visible.

ADR-001Modular monolith in TypeScript: Next.js web/API plus a background workerACCEPTEDType-1

2026-10-24 · architect · RECOMMEND · confidence 82 · reversibility medium

The simplicity ladder, rung 4 (monolith + worker), satisfies every V1 requirement. Long jobs live in the worker (ADR-005). Boundaries keep a later extraction possible.
ADR-002PostgreSQL with shared-schema tenancy enforced by row-level securityACCEPTEDType-1

2026-10-24 · data · RECOMMEND · confidence 85 · reversibility low

Defence in depth: application scoping plus database-enforced policies, so one missed WHERE clause cannot leak data.
ADR-003Auth.js with magic links and Google/Microsoft OIDC; organizations and roles in our databaseACCEPTEDType-1

2026-10-24 · security · RECOMMEND · confidence 75 · reversibility medium

Keeps identity, tenancy and authorization in one model with no recurring cost while the product is validated. Option B stays the documented path when SAML/SCIM demand appears.
ADR-004S3-compatible object storage with per-tenant prefixes, encryption and lifecycle retentionACCEPTED

2026-10-24 · platform · RECOMMEND · confidence 85 · reversibility high

Standard and portable (low lock-in thanks to the de-facto S3 API). Presigned direct uploads keep large files off the web server.
ADR-005Postgres-backed job queue (pg-boss) instead of Redis or a cloud queueACCEPTED

2026-10-24 · backend · RECOMMEND · confidence 80 · reversibility high

One fewer system to run (Constitution 5); enqueueing happens in the same transaction as the call record.
ADR-006Speech-to-text through a provider interface; provider selected by a diarization and WER spikeACCEPTEDType-1

2026-10-24 · ai-ml · RECOMMEND · confidence 65 · reversibility medium

Speed to a reliable pipeline matters more than owning a model in V1. The spike turns an unverified choice into evidence.
ADR-007LLM extraction with structured outputs, evidence quotes and versioned prompts behind a provider abstractionACCEPTEDType-1

2026-10-24 · ai-ml · RECOMMEND · confidence 75 · reversibility medium

Best quality-to-effort for V1. Evidence quotes make insights verifiable (R-003). Abstraction plus eval gating (ADR-008) make the provider replaceable.
ADR-008Evaluation gating: versioned golden dataset and thresholds block prompt or model changesACCEPTEDType-1

2026-10-24 · ai-ml · RECOMMEND · confidence 85 · reversibility high

Turns AI quality into an evidence-gated, regression-tested property, like any other test (Constitution 15).
ADR-009Design direction A: coaching queue as the landing view, call detail as drill-inACCEPTED

2026-10-24 · design-director · RECOMMEND · confidence 70 · reversibility high

The primary job is "act on coaching moments without listening to every call". A puts that action first, which also generates the accept/dismiss signal for quality monitoring.
ADR-010Stripe for subscriptions, trials, seats and metered audio hoursACCEPTED

2026-10-24 · gtm · RECOMMEND · confidence 78 · reversibility medium

Supports both candidate pricing models without re-architecture; widely documented. Keeping our own usage ledger limits lock-in.
ADR-011Zoom is the only V1 integration; CRM linking deferredACCEPTED

2026-10-24 · product-director · RECOMMEND · confidence 72 · reversibility high

Prove the core job with the smallest integration surface. The pilot tells us which integration comes second.
ADR-012Retention defaults and recording-consent attestationACCEPTED

2026-10-24 · privacy · RECOMMEND · confidence 70 · reversibility medium

Minimisation and controller support without blocking the core flow. Legal review confirms or adjusts the defaults before launch.

Risks & assumptions

Assumptions are not facts: low-confidence items stay labelled until validated.

Risk register
ID	Category	Risk	Severity	Mitigation	Status
R-001	legal	Recordings contain third-party personal data and recording-consent laws differ by jurisdiction	high	Consent attestation and policy notice (REQ-010), retention controls, DPA, legal review before launch	OPEN
R-002	security	Cross-tenant data exposure through a query, job, search or storage path	high	Postgres row-level security + tenant-scoped repository, per-tenant storage prefixes, isolation tests on every data path (ADR-002)	OPEN
R-003	product	Hallucinated or wrong insights erode manager trust	high	Evidence quotes with timestamps, confidence thresholds, human review queue, eval gating (ADR-007, ADR-008)	OPEN
R-004	cost	Transcription and LLM costs per audio hour erode margin	high	Per-org audio allowance, metering, cost alerts, model selection by eval and cost	OPEN
R-007	business	Crowded conversation-intelligence market with well-funded incumbents	high	Mid-market focus, time-to-value under one day, coaching-first workflow; validate in EXP-001	OPEN
R-005	vendor	Speech or LLM provider changes pricing, terms or model behaviour	medium	Provider abstraction, eval harness re-run on any model change, second provider evaluated	OPEN
R-008	compliance	EU customers bring GDPR obligations (DPA, subprocessors, transfers) and may require EU data residency	medium	DPA template, subprocessor list, region choice recorded as a founder decision when the first EU customer appears	OPEN
R-006	security	Prompt injection through transcript content manipulates extraction output	low	Transcripts treated as data, no tool access, schema-validated outputs, evidence must match transcript text	OPEN

Assumption registry
ID	Assumption	Confidence	How we validate	State
A-001	Sales managers at 10–100 rep teams will act on a weekly coaching queue	60	EXP-001 design-partner pilot	UNTESTED
A-002	Managed speech-to-text diarization is accurate enough to attribute objections to prospects	55	N005 spike: diarization error on 30 labelled calls	UNTESTED
A-003	LLM extraction can reach objection precision ≥ 0.85 and recall ≥ 0.80	60	N006 eval harness on the golden dataset	UNTESTED
A-004	Customers are willing to upload recordings or connect Zoom given consent attestation	65	EXP-001 activation: ≥ 20 calls per team in week 1	UNTESTED
A-005	Transcription plus AI processing cost stays under 15% of per-seat revenue at expected usage	50	COST.md model with freshly researched prices + pilot metering data	UNTESTED
A-006	Mid-market sales teams (10–100 reps) without an enterprise conversation-intelligence tool are the ICP	65	Pilot recruitment rate and discovery interviews	UNTESTED

Security & production readiness

Evidence-gated. Raftly never marks a product “secure” or “compliant”.

SalesLens processes confidential sales conversations containing personal data of customers' employees and prospects. The security posture focuses on tenant isolation, server-side authorization, protection of recordings and integration credentials, webhook integrity, and AI-specific risks. This document records readiness, not certification. Evidence is collected per node and in N014.

Production gate — INSUFFICIENT_EVIDENCE
Category	Check	Severity	Status	Evidence / reason
accessibility	Accessibility checks (WCAG 2.2 AA target) on key flows G-A11Y	major	UNVERIFIED
ai	Inference cost budget, per-tenant limits and cost alerts G-AI-COST	major	UNVERIFIED
ai	AI eval suite meets agreed thresholds on a versioned dataset G-AI-EVALS	blocker	UNVERIFIED
ai	Fallback/degradation defined for model errors, timeouts and low confidence G-AI-FALLBACK	major	UNVERIFIED
alerts	Alerts on SLO/critical failures routed to an owner G-ALERTS	major	UNVERIFIED
analytics	Analytics events verified; consent where required; internal traffic filtered G-ANALYTICS	minor	UNVERIFIED
auth	Authentication implemented with secure session handling G-AUTH	blocker	UNVERIFIED
authorization	Authorization enforced server-side on every protected operation G-AUTHZ-SERVER	blocker	UNVERIFIED
backups	Automated backups configured for all persistent stores G-BACKUPS	blocker	UNVERIFIED
billing	Billing lifecycle verified incl. failed payments, refunds, cancellation G-BILLING	blocker	UNVERIFIED
compliance	Compliance readiness checklist complete and reviewed by a qualified professional G-COMPLIANCE-READINESS	blocker	UNVERIFIED
data-migrations	Schema migrations versioned, tested, with rollback or compensation plan G-DATA-MIGRATIONS	major	UNVERIFIED
distribution	App store listing, privacy labels and review requirements satisfied G-STORE	major	N/A	profile does not match: surface:ios or surface:android or surface:mobile
email	Sending domain authenticated (SPF, DKIM, DMARC) G-EMAIL-DOMAIN	major	UNVERIFIED
environments	Staging environment with configuration parity G-ENV-PARITY	minor	UNVERIFIED
incident-response	Incident response path: owner, contact, runbook G-INCIDENT	major	UNVERIFIED
legal	Privacy policy / terms published (requires professional review) G-LEGAL-DOCS	major	UNVERIFIED
logs	Structured logs with correlation ids; no secrets in logs G-LOGS	major	UNVERIFIED
monitoring	Client crash/error visibility decided (tooling or explicit privacy-preserving opt-out) G-CLIENT-ERRORS	minor	N/A	profile does not match: ui and not backend
monitoring	Health checks and readiness probes G-HEALTH	major	UNVERIFIED
monitoring	Error tracking and service monitoring in production G-MONITORING	major	UNVERIFIED
performance	Performance budget defined and met G-PERF	major	UNVERIFIED
privacy	User data export and deletion paths work G-DATA-EXPORT-DELETE	major	UNVERIFIED
privacy	Personal-data inventory, purpose and retention documented G-PRIV-INVENTORY	major	UNVERIFIED
privacy	Sensitive/personal data excluded or redacted from logs and analytics G-PRIV-LOGGING	major	UNVERIFIED
privacy	Sensitive data classes have access control, encryption and audit trail G-PRIV-SENSITIVE	blocker	UNVERIFIED
product	Core user flows verified end-to-end G-PRODUCT-FLOWS	blocker	UNVERIFIED
product	All MUST requirements are implemented and verified G-PRODUCT-SCOPE	blocker	UNVERIFIED
rate-limits	Rate limiting on authentication and expensive endpoints G-SEC-RATE	major	UNVERIFIED
restore	Restore from backup verified at least once G-RESTORE	major	UNVERIFIED
rollback	Rollback path defined and rehearsed (previous build / deploy revert / store release) G-ROLLBACK	blocker	UNVERIFIED
security	Prompt-injection, data-leakage and output-handling controls in place G-SEC-AI	major	UNVERIFIED
security	Dependency audit shows no known critical/high vulnerabilities without mitigation G-SEC-DEPS	major	UNVERIFIED
security	Security headers and CSP configured for the web surface G-SEC-HEADERS	major	UNVERIFIED
security	Input validated at every trust boundary; injection risks addressed G-SEC-INPUT	blocker	UNVERIFIED
security	No secrets in source control; secrets managed per environment G-SEC-SECRETS	blocker	UNVERIFIED
security	Threat model reviewed against the implemented system G-SEC-THREAT-MODEL	major	UNVERIFIED
security	File uploads restricted (type, size, scanning, storage isolation) G-SEC-UPLOADS	blocker	UNVERIFIED
security	Inbound webhooks verified (signature) and processed idempotently G-SEC-WEBHOOKS	blocker	UNVERIFIED
seo	Public site metadata, sitemap, robots and performance G-SEO	minor	UNVERIFIED
support	Support/contact path visible to users G-SUPPORT	minor	UNVERIFIED
tenant-isolation	Tenant isolation verified by tests (cross-tenant access denied) G-TENANT-ISOLATION	blocker	UNVERIFIED
testing	Automated test suite passes in CI G-TEST-AUTOMATED	blocker	UNVERIFIED
testing	Platform/device matrix verified G-TEST-PLATFORMS	major	N/A	profile does not match: surface:ios or surface:android or surface:mobile or surface:desktop
testing	Regression coverage on critical paths G-TEST-REGRESSION	major	UNVERIFIED

Forgotten 20% audit: NOT_APPLICABLE 1, UNVERIFIED 28. No evidence means no PASS; N/A is a valid outcome for checks that do not apply to this product.

Launch

From LAUNCH.md.

Launch plan

Design-partner pilot (EXP-001): 5 teams, 4 weeks, free, with signed pilot terms and DPA.
Decide on EXP-001 (proceed / reposition).
Paid launch to the waitlist; public launch after 4 weeks of stable SLOs.

Rollback

Application: redeploy the previous web/worker release (one CI action); feature flags for extraction prompt versions. Database: expand/contract migrations; restore from PITR only for data-corruption incidents (drill recorded in N014).

Remaining risks

R-001 (legal review pending), R-004 (cost unknown until spikes), R-007 (market).