Every line answered with the right script. Every message delivered.
Signalstream is the platform for telephone answering services. Operators handle several lines from one console, follow the script and form each client built for that call type, and save a message that is dispatched, escalated and acknowledged without anyone chasing it.
Multi-tenant from the database up. One deployment can host many answering services, each with its own clients, accounts, users and audit trail, separated by Postgres row-level security.
Built for medical accounts. Access logging, automatic logoff, enforceable MFA and PHI-free notifications are part of the product, not a premium tier.
Fast on a keyboard. Find any account by number, name, phone or address in seconds, and switch call types without retyping the caller's name and number.
Call control on the left. The client's own form on the right.
Signalstream Communicator holds the lines: answer, hold, dial out, transfer, conference and wrap up. Beside it runs the Signalstream take screen for the selected line, with the account's instructions, its call types and the form the client's supervisor built. Pick a moment in a call to see each screen.
Communicator in development · design previewsThe telephone side and the data side share a call ID.
Communicator knows who called, how long they held and which legs were dialed. Signalstream knows the account, the script, the form and who needs to hear about it. Every message carries a reference to its call, so a supervisor reviewing a message sees the whole call.
Signalstream Communicator In development
The call-handling console for operators on headsets.
- Line rail with live, hold, ringing and wrap-up states at a glance
- Preview an incoming account before answering; answering holds the current line
- Dial out from the account's directories and on-call schedule
- Consult or blind transfer to operators by skill
- Three-way conference with per-party hold and drop
- Talk, hold and leg timings captured for the call record
Signalstream
Accounts, scripts, messages, dispatch and the client portal.
- Organizations, clients, accounts and contacts, each with its own time zone
- Scripts and forms built without code, versioned on every publish
- Several call types per account, each mapped to its own form
- Message boards for the organization, each client and each account
- Escalating dispatch by SMS, email and signed webhook
- Client portal for reading, closing and annotating messages
Quick search
A command palette finds any account by account number, name, phone number, address or client name while the call is still connecting.
Directories without duplicates
Contacts live once at the client. Directories reference them, so one phone number change updates every directory and every account that uses it.
On-call schedules
Each client keeps on-call categories with scheduled slots. Operators see who is on call now with their numbers; dispatch resolves the schedule when a step runs.
Dispatch instructions
Rich-text procedures such as "text the on-call lead first, call their mobile after 30 minutes" sit beside the form for the whole call.
Live message boards
Open and closed messages update in place over server-sent events, with a toast and an unread inbox that survives reconnects.
Client portal
Client users read, close, reopen and add notes to messages for the accounts they may see, check the on-call schedule and, if you allow it, manage their own users.
Supervisors build the script and the form. No code, no tickets.
Each client owns its forms. Accounts offer them as call types, so "Maintenance Request" and "Lockout" can share one caller section and branch from there. The preview renders exactly what the operator will see, with rules running.
Maintenance Request for Summit Property Management, shared by three properties. Use the Properties, Rules and Preview tabs.
Script blocks that read like a script
Rich text with bold, lists and links, plus variables for the account name, caller name or any field already collected. A script block can be shown only when a rule matches, which gives branching scripts without a scripting language.
Fifteen field types
Rules without code
Show, hide or require any block when conditions match. Conditions combine with all or any groups, nest, and compare numbers and dates in order, so "more than 10 units affected" or "callback after 5 pm on 24 December" work as written.
Versions you can trust
Drafts autosave. Publishing creates an immutable version and first lists every account and call type that uses the form. Each message records the exact version it was taken with, so old messages still render after fields change.
Fields that follow the caller
Mark caller name and callback number to carry across call types. Switching from Maintenance Request to Lockout keeps them and asks before discarding anything else. Test-call mode validates a form without saving a message.
Saving the message starts the follow-up. Acknowledging it stops the chase.
Each account has dispatch rules: which call type, which condition on the form's values, and an ordered chain of up to ten steps. Deliveries are queued in the same database transaction as the message, so a message is never saved without its notifications.
Message created
Maintenance Request · urgency equals EmergencyRoutine requests match a second rule that emails the property manager instead.
SMS whoever is on call
Resolved from the Maintenance on-call schedule at the moment the message is saved. One text per person on call.
SMS the on-call again
Resolved again when the step falls due, so a shift change between steps reaches the new person.
Email the property manager
Any acknowledgement cancels the steps still queued. If the chain runs out unacknowledged, supervisors are alerted.
Acknowledged from the text itself
A reply of OK, YES or ACK acknowledges the newest delivery to that number. Emails carry a one-time Acknowledge link that needs no login and works only by button press, so mail scanners cannot trigger it. A rule can close the message automatically once every recipient has acknowledged.
- Channels
- SMS through Twilio, email through your SMTP provider, and HTTPS webhooks signed with HMAC-SHA256.
- Targets
- A contact, a typed address, a whole directory, the contact chosen in a directory-lookup field, or whoever is on call.
- Content policy
- Per step: a notice with only the portal link, the form's one-line summary, or every field grouped by section.
- Retries
- Failed sends retry after 1, 5 and 15 minutes and 1 hour. A permanent failure notifies every supervisor and admin.
- Manual dispatch
- Resend a delivery, or dispatch to any contact, address, directory or on-call category from the message page. Both are audited.
- Scale
- Workers claim deliveries with
FOR UPDATE SKIP LOCKED, so several app containers can send without double delivery.
Open above, closed below, always current.
The same board serves the whole organization, a single client, a single account and the client portal, each scoped to what the viewer may see.
Find it fast
Filter by date range, call type or any text in the message. Filters apply to the open and closed listings together.
Times where they happened
Times show in the viewer's time zone with the account's zone on hover. A caller who wants a 9 am callback means 9 am at the account, and that is what is stored.
A complete history
Open a message to see every field rendered with the form version it was taken with, every delivery and acknowledgement, and notes from staff and clients in order.
The controls a medical account will ask about, already built.
Tenant scoping, access logging and log hygiene are expensive to add after the fact, so Signalstream was designed around them from the first migration. Here is what the application enforces today.
Tenant separation in the database
- Every row carries
organization_id; every query goes through a repository that requires a tenant context. - Postgres row-level security on every tenant table, keyed to a transaction-local setting.
- Each repository ships with a cross-tenant negative test, and the policies are proven with raw SQL as a restricted role.
- Client users are scoped to their client, and optionally to specific accounts.
Sign-in that holds up
- Unique logins for every person, with no shared accounts.
- Passwords hashed with scrypt; 12 to 128 characters, length over complexity.
- TOTP multi-factor, enforceable per organization and per role.
- Ten failed sign-ins lock the user for 15 minutes; rate limiting on sign-in, search and live streams.
- Invitations and resets use single-use, expiring links. A manual reset ends the user's sessions.
Automatic logoff
- Server-side sessions in HTTP-only, Secure, SameSite cookies, stored in Postgres.
- Idle timeout enforced on every request: 60 minutes by default, shorter per organization.
- An absolute session lifetime on top of the idle check.
- Operators and clients sign in through separate entry points; the role decides where each lands.
Who saw what, and when
- An insert-only audit log with actor, action, entity, time, IP address and user agent.
- Reads of message detail are logged as well as writes:
message.view. - Over sixty audited actions, from
form.publishtodelivery.acknowledged. - Admins search and export the log, and exporting it is itself audited.
Minimum necessary, by default
- No PHI in URLs, logs, error reports, email subjects or real-time payloads.
- Live events carry IDs and labels only; the browser fetches details through an authorized request.
- The logger redacts message data, passwords, tokens and cookies before anything is written.
- Email subjects read "New message for Lakeside Downtown Office", never the caller's symptoms.
- Each dispatch step chooses notice, summary or full content.
Browser protections
- A nonce-based Content Security Policy: same-origin scripts only, no framing, no plugins.
- HSTS for a year including subdomains,
X-Frame-Options: DENY,nosniffand a strict referrer policy. - Camera, microphone and location blocked by permissions policy.
- Scripts and instructions stored as document JSON, rendered through an allowlist, then sanitized again.
Outbound and inbound, verified
- Webhooks signed in
X-SignalStream-Signaturewith HMAC-SHA256 and a timestamp. - HTTPS only; private, loopback, link-local and cloud-metadata hosts are refused.
- Webhook secrets are never returned by the API or written to logs or audit rows.
- Inbound Twilio replies are validated with
X-Twilio-Signature. - Failure reasons come from a fixed list that never contains message data or addresses.
Records that do not drift
- Message data cannot be edited after it is saved; only status changes, and notes are append-only.
- Published form versions are immutable and every message points at the one it used.
- All timestamps stored in UTC with the account's time zone recorded alongside.
- Parameterized queries throughout; no raw table access from page handlers.
Retention and encryption
- Deletes are soft; a scheduled retention job hard-deletes after each organization's window.
- Encryption in transit everywhere and at rest at the database and volume level.
- Ready for field-level encryption of message data if a client requires it: one data-access path and a version column already exist.
| Role | Sees | Can do |
|---|---|---|
org_admin | The whole organization | Users, clients, forms, directories, security settings, audit log |
supervisor | All clients and accounts | Build and publish forms; edit directories, contacts, on-call and dispatch; take messages |
operator | All accounts | Take messages; read forms, directories and contacts |
client_admin | One client, all its accounts | Read and close messages; manage that client's portal users when the client's toggle is on |
client_user | One client, chosen accounts | Read, close and add notes to messages |
Mapped to the technical safeguards
HIPAA compliance belongs to your organization, not to a piece of software. Signalstream removes the technical blockers and gives you the evidence: audit exports, access reports and user lists.
Signalstream provides
- Access control, MFA and automatic logoff
- Audit logging of reads and writes
- PHI-free logs, URLs and notifications
- Retention jobs and immutable records
Your host provides
- A Business Associate Agreement
- Encrypted managed Postgres and backups
- A private network for the database
- Secrets in a secrets manager
Your business provides
- Risk assessment and written policies
- Workforce training and incident response
- BAAs with your SMS and email vendors
- BAAs with clients that are covered entities
One container image. Runs where your BAA does.
Signalstream ships as a single Node image with no local file state, so you can run several behind a load balancer and promote the same image from testing to production.
SvelteKit
Server-rendered pages for operators and the client portal, with form rules evaluated in the browser and again on the server.
PostgreSQL
Row-level security, JSONB message data with GIN indexes, and trigram search across account names and phone numbers.
Real time
Server-sent events over Postgres LISTEN/NOTIFY. Every container hears every event without extra infrastructure.
Checked on every change
Type checks, linting, unit, integration and end-to-end tests, a migration drift check and dependency scanning.
Built for every client on your board.
Medical
Page the on-call physician, log who viewed each message, and keep symptoms out of text messages.
Prescription Refill · Urgent · New PatientProperty management
One maintenance form shared by every property, with emergencies dispatched and routine requests emailed.
Maintenance Request · Leasing Inquiry · LockoutLegal
Intake forms per practice area and portal access limited to the attorneys on each account.
New Matter · Existing Client · Court DatePlumbing and HVAC
Rules that separate a burst pipe from an estimate request, and an on-call rotation that stays current.
No Heat · Leak · Estimate RequestSee it with your own accounts.
Bring a script from one of your toughest clients. We'll build it in the form builder during the demo and take a test call on it.