Preflight
Cockpit

Pre-dial compliance interlock for the Vonage Voice API

Watch a call that would break federal law stop before the network ever hears it.

Preflight sits inside your Vonage account, in the call-control path. It reads the flow your own server is about to serve, runs monitors compiled from the federal and Georgia telemarketing rules over it, and refuses the call before the carrier is asked to place it. Then the fix is made and the same phone rings.

Dial it yourself Read the evidence log
A handset on paper beside a runway centreline, the product image

The reference application's flow, evaluated by the engine in this browser

The problem, on a real object

One branch nobody traced.

A call flow is a JSON object your server returns when the platform asks what to do. This one plays a greeting and connects you to a scheduler. On one branch, the one that runs when nobody presses a key, it speaks with a synthesized voice and offers no way to opt out.

Nobody traced it, because no single document contains it: the platform asks your server for a new object every time a caller presses a key or stays silent.

Liability accrues per call, not per campaign: 500 USD for each violation under 47 U.S.C. 227(b)(3), up to three times that at the court's discretion for a willful or knowing violation. Georgia removed the knowledge requirement from its own statute on July 1, 2024 and extended liability to whoever the call is made on behalf of: up to 2,000 USD for each violation in Attorney General proceedings, up to 1,000 USD for each violation in a private action, no cap in a class action.


            

          

        

      


      
      

        

          
The block, live

          
Recomputed on every load.

          
These are the interlock's own counts on the deployed host, not a screenshot. Reload and they recompute. The chain head below is sealed to a public transparency log once a day.

          

            

              
0

              
blocked before the dial

              
            

            

              
0

              
held for a person

            

            

              
0

              
placed

            

          

          

            evidence log head …
            reading the host…
          

          

          

          
reading the host…

        

      


      
      

        

          
How it works

          
Four things, in order, every call.

          

            

              
              
Read the flow.

              
The platform calls Preflight instead of your server. Preflight verifies the platform's signature, forwards the request to your real server unchanged, and reads the object that comes back.

              
            

            

              
              
Compile the statute.

              
Five properties, each a formula over what the object does: calling hours, identification first, an opt-out that can be reached, a caller id that is set, Georgia's identification-first rule. Each quoted clause is a byte-for-byte substring of the fetched text, enforced by a test.

              
            

            

              
              
Decide before the dial.

              
Every monitor is true, the object passes through byte for byte. Any monitor is false, the call is refused and a safe object names the rule. A monitor that cannot decide holds the call for a person, because it does not guess.

              
 outbound calls go through the gateway, because the platform only asks for the flow once a call is answered. Answered at 868 ms, the flow asked for at 1,009 ms.

              
            

            

              
              
Write the receipt.

              
Every decision is an entry in a hash-chained log. The head is sealed to Sigstore Rekor daily, and the platform's own call records are reconciled against the log every night: nothing the interlock refused has reached the carrier.

              
            

          

        

      


      
      

        

          

            
Dial it yourself

            
+1 943 244 5023

            
That number runs the small notification flow from above, on purpose, with the defect in it. Call it and you hear the interlock intervene.

            
To have Preflight call you instead, enter your number; the platform calls it first and speaks a four-digit code, and only that code lets one demonstration call through. Your number is kept as a keyed hash, never as digits.

            
No phone at hand? The browser softphone places the same call from a page.

          

          

            

              
              
              

                
              

              
              
              

                
                
              

              

            

          

        

      


      
      

        

          

            
Sandbox

            
Paste an object. No account.

            
The same engine that decides on the host runs here in your browser. Paste a call-control object and every property answers in under a second, with its citation and, on a false, the exact sequence of actions that reached the prohibited state.

            
A single object, not your whole flow. Discovery of the branches your server serves at runtime happens on the host, from traffic.

            

              
              
              
              
            

            
            
            
            
            

              
            

          

          

            
The tower says

            
…

            

            

            

          

        

      


      
      

        
        

          
The evidence

          
You cannot rewrite this, and neither can we.

          
Every decision is an entry. Each entry hashes its own canonical form together with the previous entry's hash. The head is signed and uploaded to a public transparency log once a day. Anyone with the URL recomputes the chain from genesis:

          
npx preflight-interlock verify-ledger https://preflight-api-rc34.onrender.com

          
Last carrier reconciliation: reading the host…

          
The last seal, verified against the public log:

          
rekor-cli verify --uuid <the last seal's uuid, read from the log>

          
Rate properties, from the platform's own event webhooks: reading the host…

          
    
        
    
      
    

      
      
    
        
    
          
    Honest limits
    
          
    What this is not.
    
          
    
            
    
              
              
    Preflight verifies the structure of your call flow against a published set of rules. It does not verify consent, business relationships, or the content of what is spoken.