Architecture & Security

1 Platform Overview

Deal Revenant is available in two deployment models, each designed for different organizational needs.

Teams App (Enterprise)

A Microsoft Teams tab application that reads meeting transcripts directly from the Microsoft Graph API. Analysis is performed by a Copilot Studio agent running inside the customer's own M365 tenant. No data leaves the tenant boundary.

• Installed from Microsoft AppSource
• Runs as a configurable tab in Teams meetings
• Uses the customer's own Copilot Studio license
• Transcript access via Microsoft Graph (meeting transcript API)
• No Technomancy Labs servers involved in analysis

DRWeb (Standalone Web App)

A browser-based application at drweb.technomancylabs.com. Users upload transcript files (VTT, SRT, or plain text) and receive streaming analysis. Analysis is performed via an API call to Anthropic's Claude model through a secure proxy.

• No installation required — works in any modern browser
• Google or Microsoft OAuth sign-in
• Transcript content passes through the server in-flight only — never persisted
• Analysis results stored client-side (IndexedDB) for paid users

2 Data Handling by Platform

What We Store

Data Type	Teams App	DRWeb
Transcript content	NEVER stays in your tenant	NEVER in-flight only, not persisted
Analysis output	NEVER cached in client browser only	NEVER stored in browser IndexedDB only
Chat/coaching messages	N/A	NEVER stored in browser IndexedDB only
User email	YES for license verification	YES for account and billing
OAuth provider ID	YES	YES
Subscription status	YES via AppSource	YES via Stripe
Analysis count	YES	YES for usage tracking
BYOK API key	N/A	ENCRYPTED Fernet AES at rest
PULSE scores	NEVER	NEVER client-side only

Data Flow — DRWeb

When a user submits a transcript for analysis:

1. Transcript text is sent to the DRWeb API over TLS 1.3
2. The server constructs an LLM prompt (transcript + PULSE system prompt) and forwards it to Anthropic's API via OpenRouter
3. Response tokens stream back through the server to the client via Server-Sent Events
4. The transcript is never written to disk, database, or any persistent storage on our servers
5. The analysis result is stored in the user's browser (IndexedDB) — not on our servers

Data Flow — Teams App

When a user opens the Deal Revenant tab in a Teams meeting:

1. The tab authenticates via Microsoft SSO within the Teams client
2. The tab reads the meeting transcript from Microsoft Graph using the user's delegated permissions
3. The transcript is sent to a Copilot Studio agent running in the customer's own M365 tenant
4. The agent performs the PULSE analysis and returns results to the tab
5. No data leaves the M365 tenant boundary at any point

3 AI Model & Processing

Both platforms use Anthropic's Claude Opus 4.6 as the underlying intelligence engine. Claude is a large language model built by Anthropic with strong performance on structured analysis, nuanced reasoning, and evidence-based scoring.

Model Access by Platform

Aspect	Teams App	DRWeb
Model	Claude Opus 4.6	Claude Opus 4.6
Access path	Copilot Studio (customer tenant)	OpenRouter API proxy
Who pays for inference	Customer (via Copilot Studio license)	Technomancy Labs (included in subscription)
Data sent to	Microsoft's Copilot infrastructure	Anthropic via OpenRouter
Model training on your data	NO	NO — Anthropic's API does not train on inputs

Anthropic's Data Policy

Per Anthropic's privacy policy and API terms: data submitted via the API is not used to train or improve their models. Inputs and outputs may be retained for up to 30 days for safety monitoring and abuse prevention, then deleted.

4 PULSE Scoring Methodology

PULSE is a proprietary framework developed by Technomancy Labs for evaluating the health and trajectory of sales opportunities based on conversation evidence. It produces structured, reproducible assessments from unstructured transcript data.

The Five Dimensions

Each dimension is scored 0.0 to 1.0 based on evidence present in the transcript. Scores reflect what was said (and what wasn't) — not the rep's self-reported confidence.

Dimension	Evaluates	Key Signals
P — Power	Proximity to decision-making authority	Economic buyer presence, org chart clarity, delegation patterns
U — Urgency	Severity and ownership of the problem	Quantified impact, timeline pressure, consequence awareness
L — Landscape	Competitive positioning clarity	Named alternatives, differentiation acknowledgment, evaluation stage
S — Spend	Commercial readiness	Budget references, procurement process, timeline specificity
E — Engagement	Stakeholder investment in the conversation	Question quality, unprompted disclosures, follow-up energy

How Scores Are Derived

The PULSE scoring engine uses a structured evaluation prompt that instructs the AI model to assess each dimension against specific evidence criteria. The process is deterministic in methodology, though individual scores may vary slightly between runs due to the probabilistic nature of language models.

• Scores are grounded in transcript evidence — the model is instructed to cite specific moments from the conversation
• Each score includes a rationale explaining why it was assigned
• Scores above 0.8 require strong, specific evidence — the framework penalizes vagueness
• Missing information is treated as a risk signal, not a neutral gap
• The framework evaluates the conversation itself, not the rep's self-assessment

Beyond Scores

In addition to the five PULSE dimensions, each analysis produces:

• Cast of Characters — every participant identified by name and inferred role
• Key Themes — what the conversation was actually about
• Opportunity Signals — specific moments that indicate forward momentum
• Risk Indicators — gaps, vagueness, or red flags that could stall the deal
• Due-Outs — action items with owners and deadlines
• Narrative Insight — the deeper story the rep may not be seeing
• Suggested Action — one specific next move for the next 48 hours

5 Teams App Deployment

Prerequisites

• Microsoft 365 tenant with Teams enabled
• Copilot Studio license (for the AI agent that runs in your tenant)
• Teams meeting transcription enabled in the tenant
• Global Admin or Teams Admin role to complete the one-time setup

Admin Setup (One Time)

Deal Revenant runs analysis through a Copilot Studio agent in your own tenant. This means you need to provision the agent once, then connect it to the Teams tab. Setup takes about 5 minutes.

Step 1 — Install the Teams app

1. Complete your purchase (or start the 30-day free trial) on Microsoft AppSource.
2. On the activation page, follow the "Open in Microsoft Teams" link, or go to Teams → Apps → search for "Deal Revenant" → Add.
3. Your Teams admin may need to approve the app in the Teams Admin Center if custom app approval is enforced.

Step 2 — Create and configure the Copilot Studio agent

1. Sign in to Copilot Studio with a Global Admin or Teams Admin account.
2. Download the Deal Revenant Copilot Studio solution and import it via Solutions → Import solution.
3. After import, open the Deal Revenant agent and click Publish.

Step 3 — Enable the Direct Line channel and copy the secret

1. In your agent, open Settings → Channels.
2. Enable the Direct Line channel if it isn't already on.
3. Click the channel to open its settings, then reveal and copy the Primary secret (also labeled "Web channel security").

Keep this secret private. It grants access to your agent. Deal Revenant stores it encrypted in your subscription record and uses it only to mint short-lived tokens for the Teams tab.

Step 4 — Connect the agent to Deal Revenant

1. Open Deal Revenant inside any Teams meeting (or from the Teams app bar).
2. Because you are a Global Admin or Teams Admin, the app will show the setup wizard automatically.
3. Paste your Direct Line secret into the form and click Save configuration.
4. Click Test connection to verify the agent is reachable.

That's it. All users in your organization can now add the Deal Revenant tab to any Teams meeting and run analysis. The admin setup is one-time per tenant.

Troubleshooting

• "Admin Setup Required" shown to me when I'm already an admin — the app reads your admin role from the Teams SSO token. Sign out of Teams and sign back in to refresh your token, then reopen the tab.
• Test connection fails with 401 or 404 — confirm the Direct Line channel is enabled and the agent is published. Re-copy the secret and save again.
• Analysis fails with "no transcript" — meeting transcription must be enabled for the meeting, and the meeting must have ended. Teams sometimes takes a few minutes to make the transcript available after a meeting ends.

Required Permissions

Permission	Type	Purpose
OnlineMeetings.Read	Delegated	Read meeting metadata to locate the transcript
OnlineMeetingTranscript.Read.All	Delegated	Read the meeting transcript content
Chat.Read	Delegated	Resolve meeting chat to locate the meeting ID
User.Read	Delegated	Read the signed-in user's profile for license verification

All permissions are delegated (user-context) — the app never accesses data beyond what the signed-in user can see.

Tenant Isolation

The Teams version of Deal Revenant is architecturally isolated to the customer's tenant:

• The Copilot Studio agent runs in your tenant, under your Copilot license
• Transcript data flows from Graph → your browser → your Copilot agent
• No Technomancy Labs servers receive transcript content
• The only external call is a license verification check to confirm active subscription

6 Security Architecture

Authentication

Aspect	Teams App	DRWeb
Auth method	Microsoft SSO (Teams SDK)	OAuth 2.0 (Google or Microsoft)
Token type	Azure AD tokens (delegated)	Short-lived JWT (4-hour expiry)
Session revocation	Via Azure AD	Token version increment on logout
CSRF protection	Teams SDK handles	OAuth state parameter in httponly cookie

Encryption

• In transit: TLS 1.3 for all API communication
• At rest: BYOK keys encrypted with Fernet (AES-128-CBC). No transcript or analysis data is stored server-side
• Database: PostgreSQL with encrypted connections on Fly.io infrastructure

Infrastructure

Component	Provider	Region
DRWeb API	Fly.io	IAD (US East)
DRWeb Frontend	Firebase Hosting (Google)	Global CDN
Landing Site	Azure Static Web Apps	Global CDN
Database	Fly.io Postgres	IAD (US East)
Billing	Stripe	US
Teams App	Customer's Azure / M365 tenant	Customer-controlled

Rate Limiting

• Global rate limit: 60 requests per minute per IP address
• Chat endpoint: 10 requests per minute per user
• Analysis endpoint: gated by subscription tier and usage counter

7 FAQ

Do you store or retain our transcript data?

No. Transcript content passes through the DRWeb server in-flight during analysis and is never written to disk, database, or logs. For the Teams app, transcripts never leave your M365 tenant at all.

Is our data used to train AI models?

No. Anthropic's API terms explicitly state that API inputs are not used for model training. For the Teams app, processing happens within your Copilot Studio instance under Microsoft's data policies.

Can we use our own API key?

Yes. DRWeb supports Bring Your Own Key (BYOK). When configured, your transcripts are sent directly to Anthropic's API, bypassing our proxy entirely. Your key is encrypted at rest.

What happens if we cancel our subscription?

Your account reverts to the free tier. Analysis history stored in your browser remains accessible. We do not delete your account data — email and subscription status are retained so you can resubscribe later. We store no content to delete.

How is the PULSE score calculated?

Each of the five dimensions is evaluated against evidence found in the transcript. The AI model assesses specific signals — named stakeholders, quantified pain, budget references, competitive mentions, engagement quality — and assigns a score from 0.0 to 1.0 with a written rationale. The scoring criteria are calibrated to penalize vagueness and reward specificity. The exact evaluation rubric is proprietary.

Are PULSE scores consistent across runs?

Scores are highly consistent but not byte-identical between runs. The methodology is deterministic; the model is probabilistic. In testing, scores typically vary by ±0.05 across repeated runs on the same transcript. The relative ranking of dimensions is stable.

What compliance frameworks do you support?

The Teams app inherits your tenant's compliance posture (SOC 2, ISO 27001, GDPR, etc.) since processing stays within Microsoft's infrastructure. DRWeb's server-side architecture minimizes compliance surface area by not persisting content. We're happy to complete security questionnaires — contact us.

Can we get a SOC 2 report?

We are a bootstrapped startup and do not currently hold SOC 2 certification. Our architecture is designed to minimize the trust boundary: we store no content, the Teams app processes entirely within your tenant, and DRWeb's BYOK option eliminates our proxy from the data path entirely. We're transparent about our infrastructure and happy to discuss specifics.

Who do we contact for security questions?

peter.marchetti@technomancylabs.com