How it’s built, where the data goes, and what it never touches.

The checks run in order. Each one passes the run on or holds it, and a held run writes nothing. Open a check to read what it does and when it holds. Open all 14

1. 01Intake verifier+

   Checks the webhook signature and a five-minute timestamp window before anything is read. Sources: Aircall transcription.created, Dialpad call_transcription, Fathom new-meeting-content-ready, or a paste or upload.

   holds whenA bad or stale signature is refused. Nothing is read.

   timestamp within 300 s and signature valid → read · else refuse
2. 02Consent gate+

   Your team member confirms the recording disclosure was stated and the person on the call agreed. On the made-up call the disclosure is at 00:11 and consent at 00:19.

   holds whenNo confirmation, the run waits.

   disclosure_at and consent_at → continue · else hold
3. 03Normalizer+

   Numbers each line L1 to Ln with its time and speaker. The vendor's raw JSON is dropped here, not kept.

   holds whenNothing holds. The raw payload is discarded.

   L{n} · mm:ss · speaker → keep · raw_json → drop
4. 04Input gate+

   Stops very short or very long input, and calls that carry speaker labels but no caller lines. Ceilings: 60,000 characters of transcript, 25 MB of audio.

   holds whenUnder 150 or over 9,000 words, or no caller lines when labels exist. No model call.

   150 ≤ words ≤ 9000 · caller_lines > 0 when labels exist
5. 05Redaction+

   Replaces SSN, date of birth, card, bank, email, phone and home address before the model call. Logs a count per token type, never the value.

   holds whenNothing holds. The model call runs on the redacted text.

   [SSN] [DOB] [CARD] [BANK] [EMAIL] [PHONE] [ADDRESS] · counts only
6. 06Identity check+

   Reads the client record and the open matter from your CRM, ATS or practice tool. A phone match on another record stops the run and asks your team member.

   holds whenPOSSIBLE_DUPLICATE. The run stops and asks your team member.

   phone_match(other_record) → ask "Same person?"
7. 07Schema and evidence check+

   Checks afterclerk.extraction.v1 for types, enums, required keys and no extra keys. Then each quote must sit inside its cited line, case-folded and whitespace-normalized, at 25 words or fewer.

   holds whenOne retry with the error text, then hold.

   required and enums and no extra keys · quote ⊆ line(evidence_id) · ≤ 25 words
8. 08Length caps+

   Summary at most five bullets, about 120 words. Follow-up at most 180 words. Follow-up document at most 350 words.

   holds whenA draft over its cap fails the draft check.

   bullets ≤ 5 · follow_up.words ≤ 180 · document.words ≤ 350
9. 09Forbidden-term validator+

   Whole words, case-insensitive, with * for a stem. Covers evaluative, protected and injected phrasing. Runs on every model draft and every human edit.

   holds whenA match in a model draft holds it. A match in a human edit is a warning only.

   shortlist · pregnan* · ignore previous → hold (model) · warn (edit)
10. 10Name check+

    Every name in a draft must appear in the transcript, the system-of-record entry, the matter context or the approver's form.

    holds whenA name that cannot be traced fails the draft check.

    name ∈ transcript ∪ record ∪ matter ∪ form
11. 11Typed-name attribution+

    The approver types their name. Each decision is attributed to that name, and an edit is diffed against version 1 and checked again.

    holds whenEach decision is recorded under a typed name.

    approved_by = typed_name · diff(v1, edit) → re-check
12. 12Writer+

    Writes the note to your system of record, the agreed fields and one task. Saves the follow-up email and the follow-up document as mailbox drafts, unsent. Never a stage, a status or a pipeline.

    holds whenNo write without a decision row for that output.

    write ⊆ {note, agreed_fields, task} · mail = draft · decision.approved
13. 13Error workflow+

    Keeps the workflow name, node name, execution id, HTTP status and error class. Drops messages and bodies, so no client text reaches the error log.

    holds whenThe run stops and writes nothing. The error log keeps IDs only.

    keep: workflow, node, execution_id, http_status, error_class · drop: message, body
14. 14Staging and retention sweep+

    Holds the drafts and the transcript in staging until the decision. Deletes transcript and audio within 24 hours of it, a logged manual step until automated. Purges logs at 30 days and reports the counts.

    holds whenNothing reaches a system before approval. The sweep alerts if it deletes nothing for three days while open calls exist.

    ttl = 24 h from decision · logs ttl = 30 d · alert if deleted = 0 for 3 d and open_calls > 0

Five places a call's data can sit. Pick one to see what it holds, for how long, and who can revoke it. Move through the run to see what each place still holds. Never: a client or anyone else receives anything without a named person's approval.

One switch per key you hold. Flip one and the pipeline stops at once. These switches change this page only; nothing is sent to any system.