How PipeGuide protects your conversations, isolates your organisation's data, and governs AI — written for CIOs, CTOs and IT reviewers.
Download the PDF overviewFrontend
React (SPA)
Rep live-call screen, manager analytics, admin console
Backend
FastAPI (async Python)
Stateless REST API, horizontally scalable
Database
MongoDB
Multi-tenant document store — orgs, users, transcripts, billing
Hosting
Managed Kubernetes
TLS-terminated ingress, isolated pods, custom domain
| Service | Purpose | Data exposure |
|---|---|---|
| Recall.ai | Meeting bot (Zoom / Teams / Meet / Webex), live transcription, optional read-only calendar sync | Meeting URL, call audio, transcript; calendar events if connected. No AI training on customer data; calendar events auto-purged after 60 days |
| Deepgram | Live speech-to-text for in-person / phone mode | Microphone audio stream only |
| OpenAI (GPT-5.2) | Live qualification scoring, suggested questions, post-call summaries | Transcript text only — API tier, not used for model training |
| Paystack | Subscription billing & usage packs (ZAR) | Card data handled entirely by Paystack — never touches PipeGuide |
| Google / Microsoft OAuth | SSO sign-in; optional read-only calendar | Email, name; upcoming event metadata only — never writes to calendars |
| Resend | Transactional email (verification, coaching digests, reminders) | Recipient email + report content |
| Object storage | Logos & catalogue uploads | Files only, organisation-scoped |
Authentication
JWT access + refresh tokens in httpOnly secure cookies (XSS-resistant); optional Google SSO; token versioning for instant global session revocation
Passwords & identity
bcrypt hashing, 6-digit email verification at signup, disposable-email domains blocked
Brute-force protection
5 failed attempts triggers a 15-minute lockout per IP + email, with per-endpoint rate limiting across auth, uploads and AI routes
Encryption at rest
Third-party credentials encrypted (Fernet / AES-128) before storage; TLS everywhere in transit
Webhook integrity
Payment and bot callbacks verified with HMAC signatures — forged events are rejected
Audit logging
Administrative and platform actions recorded with actor and timestamp; strict Content-Security-Policy headers
Clean offboarding
Suspend → terminate (configurable retention window) → hard purge with full cascade across all collections. Irreversible deletion requires typed confirmation.
Revocable access
Calendar access is revocable in-app at any time; synced events are deleted on disconnect. No call recordings at rest — transcripts and summaries only.
Transparent processing
All sub-processors disclosed publicly (see list), including the Google Limited Use compliance statement.
Do you train AI on our data?
No. All AI providers run on no-training API tiers, and calendar data never reaches AI at all.
Can another customer see our data?
No — organisation-scoped queries are enforced server-side on every endpoint.
What happens if we leave?
Your organisation can be terminated and hard-purged on request; PDF summaries are exportable beforehand.
Where does call audio go?
Streamed for live transcription, transcribed, then discarded — no recordings at rest.
Who can start recording a call?
Only the sales rep, explicitly, per call — and the bot is a visible participant in the meeting.
How are payments secured?
Paystack handles all card data; PipeGuide never stores payment details and verifies every webhook signature.
Download the PDF for your proposal pack, or ask us to walk your IT stakeholders through a live architecture review and complete your security questionnaire.
PipeGuide (Pty) · Last updated June 2026
We use strictly-necessary cookies to keep you signed in. No analytics, no ads, no third-party trackers. Read our Privacy Policy for details.