Phase 1 — running in production on EU infrastructure

The contact center
designed for AI, not bolted to it.

Voxogo Flow is the deterministic, auditable, multi-tenant CCaaS for European mid-market — built so AI is a guarded tool inside a versioned flow, never an unsupervised decision-maker.

See it work live Live system status

AI-native

LLMs invoked as tools inside a deterministic flow. Tokens metered per tenant.

Deterministic

Every routing decision traces back to a Flow DSL node. Explain any call.

Auditable

Append-only event ledger with database-enforced tenant isolation (Postgres RLS).

GDPR-strong

EU hosting (Frankfurt). Sovereign AI adapter pattern for data-residency customers.

Live · polled every 5 seconds

This page is the platform.

Every number on this page is a real HTTP call to the running backend. Reload, watch the timestamps tick.

Backend health

… 
loading…
GET /health

Telemetry · ten_demo

…
—
SLA
—
avg wait
—
conversations
—
available agents
GET /v1/telemetry

Quota · conversation_count

…
— of — / month
GET /v1/admin/tenants/ten_demo/quota/conversation_count + plan lookup
Try it · costs nothing, real database writes

Start a conversation. Watch the events land.

Click the button. The backend opens a Postgres transaction, writes a conversation + interaction, appends an event, emits two billable ledger rows, returns within ~50 ms.

Controls

Click "Start" to begin.

Event ledger (live)

0 events
No events yet for this conversation.
GET /v1/conversations/{id}/events

AI Summary

mock
Start an interaction, then summarize. Tokens billed to the GlobalUsageLedger.
POST /v1/conversations/{id}/summary · provider per tenant
SuperAdmin · platform-level controls

Suspend a tenant. The runtime refuses new work, immediately.

Voxogo's commercial backbone. Plans, quotas, audit, suspension — enforced in the database via a SECURITY DEFINER function, not in application code.

Admin token required

Paste your VOXOGO_ADMIN_TOKEN to unlock controls.

Stored in your browser's sessionStorage (cleared on close). This is the Phase-1 placeholder; OAuth lands in Track E.

How the gate actually works

  1. 1 SuperAdmin call updates tenants.status='suspended'.
  2. 2 Runtime creating an interaction calls quota_remaining(tenant, resource), a SECURITY DEFINER function.
  3. 3 Function reads tenants.status; if not 'active', returns 0. Otherwise plan limit minus current-period sum from global_usage_ledger.
  4. 4 Runtime sees 0, throws QuotaExceededError, route returns HTTP 402.
  5. 5 Runtime role has only INSERT on the ledger — cannot read billing data even if compromised.
Under the hood

The whole stack, current state.

All open source, all documented, all in this one repo. No vendor lock-in beyond DigitalOcean (which is itself replaceable).

Backend
TypeScript + Fastify
  • Modular monolith, pg with explicit SQL
  • 15 REST endpoints across /v1/* + /v1/admin/*
  • 34 automated tests, gated Postgres integration
Data plane
PostgreSQL 16 managed
  • Shared tables + Row Level Security per tenant
  • FORCE RLS on all 15 tenant tables
  • Append-only event ledger (grants, not convention)
Auth model
Least-privileged roles
  • doadmin — migrations only
  • voxogo_app — runtime, no BYPASSRLS
  • voxogo_superadmin — billing/audit (planned)
Voice (planned)
LiveKit Cloud (EU)
  • Carrier Adapter Pattern, DIDWW first
  • Opus default, G.711 fallback
  • Jambonz as documented self-host fallback
AI (planned)
Provider Adapter Pattern
  • STT: Deepgram (default) · Whisper sovereign
  • LLM: Claude/GPT (default) · Mistral/Llama sovereign
  • TTS: ElevenLabs (default) · Coqui sovereign
Hosting
DigitalOcean · Frankfurt
  • 1 Droplet + 1 managed Postgres, private VPC
  • DB firewall: droplet-only + dev IP
  • ~€780–1600/mo at pilot scale (3 customers, 30 agents)

Built by AI agents, in the open

This entire platform is built collaboratively by Claude, Codex, and Gemini under human review. Track ownership and handoff protocol live in docs/agent-coordination.md. See progress and decisions in progress-log.md and ADRs.