Your buyers trust you. You need to trust the assistant.
Here is how Quoteline keeps prices right, keeps your records to yourself and keeps a person accountable, with the test results we hold ourselves to.
No price from the AI
Every figure comes from the pricing engine and your published list, worked in exact cents. The engine's results are checked against 64 hand-worked examples and thousands of generated ones.
Every quote can be priced again
A quote stores its input and the price list version. Pricing it again gives the same total to the cent, and the Trust screen in the portal runs that check on demand.
Price changes are deliberate
A new list takes effect only when someone allowed to publish it does so. Open quotes on the old list are priced again before they can be accepted.
12 checks before any reply is sent
Each draft passes through numbered checks. If one fails, the assistant tries once more; if it fails again, the conversation goes to a person.
- Figures must come from the engine or the buyer's own words.
- No price before a quote exists; no allergen or halal answer that is not on record.
- No links to other sites, no markup, no request for passwords or card numbers.
- No repeating its own instructions, and no reply longer than a buyer would read.
Your records, kept to your business
- Kept apart. Every read and write is bound to one business. Isolation tests try to reach another business's records on every path and must fail.
- Used for one purpose. A buyer's details are used to answer that buyer. Marketing messages go only to buyers who opted in, and every opt-in is recorded.
- Personal data handled under the PDPA. Buyers can ask for their data to be removed; the portal erases it and keeps a record that it did.
- Audited. Every change is written to a hash-chained audit trail that shows if any entry was altered.
Attacked on purpose, findings published
We test the portal the way an attacker would meet it (OWASP ASVS level 2) and the assistant with hostile messages (OWASP Top 10 for LLM Applications). Every finding is recorded with its fix.
| Severity | Found | Fixed | Accepted for the demonstration |
|---|---|---|---|
| Critical | 0 | 0 | 0 |
| High | 2 | 1 | 1 |
| Medium | 7 | 7 | 0 |
| Low | 6 | 4 | 2 |
The findings accepted for this demonstration (a shared demo account without two-factor sign-in, the role switcher, and buyer links signed with a key taken from the demo password) would be closed before any business used it for real. A production service would sign staff in through their own identity provider.
The assistant says what it is
It introduces itself as an assistant for your business and hands over to a person whenever a buyer asks.
People approve what matters
Discounts above your limit, large quotes, payment changes and complaints always reach a person. The assistant never confirms that money was received.
You can switch it off
Any conversation can be taken over with one press, any kind of message moved back to copilot, and the whole assistant set to manual from the Rules screen.