Your buyers trust you. You need to trust the assistant.
Here is how Quoteline keeps prices right, keeps your records to yourself and keeps a person accountable, with the test results we hold ourselves to. Each section has something you can try.
No price from the AI, and every quote can be priced again
The language model writes the conversation. The pricing engine, which is ordinary code with no AI in it, works out every figure from your published list, in exact cents.
- Tested against worked examples. The engine's results are checked against 64 hand-worked quotes and thousands of generated ones on every change.
- Reproducible. A quote stores what was asked and the list version it used. Pricing it again gives the same total to the cent, and the Trust screen in the portal runs that check on demand.
- Deliberate changes. A new list takes effect only when someone allowed to publish it does so. Open quotes on the old list are priced again before they can be accepted.
| Line | Stored | Priced again |
|---|---|---|
| Nasi Lemak Buffet, Standard × 40 | S$592.00 | · |
| Delivery, East zone | S$30.00 | · |
| GST 9% | S$55.98 | · |
| Total | S$677.98 | · |
Press "Price it again" to rerun the engine on the stored input.
Sample quotation. In the new list the Standard buffet goes from S$14.80 to S$15.20 a pax.
12 checks before any reply is sent
Every draft passes through numbered checks, in order, and the first failure decides. If one fails, the assistant tries once more with the reason; if it fails again, the conversation goes to a person.
- Figures must come from the engine or the buyer's own words.
- No price before a quote exists; no allergen or halal answer that is not on record.
- No links to other sites, no markup, no request for passwords or card numbers.
- No repeating its own instructions, and no reply longer than a buyer would read.
Eleven of the twelve checks are plain code that gives the same answer every time. Only the scope check (is this about your business?) uses a model, and its result is logged.
Your total for 40 pax with East zone delivery is S$677.98 with GST. Here is quotation KS-Q-2026-0058.
- Reply format
- Every figure from the engine
- No price without a quotation
- In scope for the business
- Sensitive details checked
- No request for personal data
- Inside the messaging window
- Nothing from another email thread
- Every requested line answered
- Only safe links, no markup
- No instructions repeated
- A sensible length
Every query names one business. Try reaching across.
Your records, kept to your business
Two locks, not one. Every query in the code is bound to one business, and the database itself refuses rows from any other business, so a mistake in one layer is caught by the next.
- Kept apart. Every read and write names one business, and Postgres row-level security checks it again on every row. Isolation tests try to reach another business's records on every path and must fail.
- Used for one purpose. A buyer's details are used to answer that buyer. Marketing messages go only to buyers who opted in, and every opt-in is recorded.
- Personal data handled under the PDPA. Buyers can ask for their data to be removed; the portal erases it and keeps a record that it did.
- Secrets sealed. Channel credentials such as Telegram bot tokens are encrypted before they are stored and never written to a log.
Every change is chained to the one before
Each entry carries a fingerprint (hash) of the entry before it. Change any old entry and every fingerprint after it stops matching, so tampering shows. Press an entry to alter it.
Chain intact: all 6 fingerprints match.
Attacked on purpose, findings published
We test the portal the way an attacker would meet it, against OWASP ASVS level 2, and the assistant with hostile messages mapped to the OWASP Top 10 for LLM Applications. Every finding is recorded with its fix and how the fix was checked.
Fixed and checked againAccepted for now, with a recorded decision
Critical
Easy to exploit and serious, such as reading another business's records without signing in. None found.
High
Serious under some conditions, such as a signed-in person doing what their role does not allow.
Medium
Limited harm, or harm that needs another weakness first, such as a missing security header.
Low
Hardening: little harm on its own, fixed so it cannot add up with something else.
The 2 findings accepted for now, and where they stand today
F-12 · "View as" takes the role and business from a cookieHigh · ASVS 4.1.2
What was found. The demo has one sign-in, the platform operator, who may view the portal as any role and business. The choice is a cookie the browser sends.
Today. Business accounts now take their business and role from their own sign-in; the "view as" cookies are ignored for them and the portal refuses to change them. Only the platform operator's own account can still view the portal as another role.
Closes when platform staff sign in through an identity provider with their own roles, before self sign-up opens.
F-13 · One shared demo account without a second factorLow · ASVS 2.2.3, 2.8
What was found. One login ID and password for the demo.
Today. Each business user has their own account, with a PBKDF2-hashed password or Google or Microsoft sign-in, and sessions end on sign-out, a password reset or a disabled account. The platform operator still signs in with one password, and two-factor sign-in is not built yet.
Closes when two-factor sign-in is added for password accounts, before self sign-up opens.
Buyer links are signed with their own random key, never a password, and production refuses links without it. Red-team run on 2026-10-22: 19 of 19 hostile messages refused on prompt version 1.7.1+1.7.0. How we test
The assistant knows when to step back
It introduces itself as an assistant for your business. Anything that needs judgement, money or an apology goes to a person, and you can take over any conversation with one press.
- You can switch it off. Move any kind of message back to copilot, or set the whole assistant to manual from the Rules screen.
- It falls back on its own. If spot checks on an autopilot message type go badly, that type goes back to copilot and you are told why.
Assistant. It asks for what the quote needs and the engine prices it. During the first 14 days you approve the reply first.
See the tests for yourself
Every finding with what was found, the fix and how it was checked, the 19 attacks on the assistant and the security checks run on the portal.