Multi-Tenant Telephony: How AI Voice Agents Scale Across Dedicated Client Lines

Building an AI voice agent prototype on a single test number takes an afternoon. Wiring voice AI across dozens of commercial clients—each with their own dedicated business phone line, isolated call logs, and usage limits—demands a fundamentally different engineering mindset. Here is how we engineered our multi-tenant telephony infrastructure at Ghost AI Systems to scale securely across client lines.

A standard voice demo connects a single web client or test phone number to an LLM through a speech pipeline. That architecture works when one person is testing a script. It collapses immediately when deployed across real businesses.

In a production agency environment, multiple clients cannot share a single inbound number. A luxury realtor, a commercial HVAC contractor, and a boutique gym require completely isolated personas, unique local area codes, separate CRM integrations, and strict accounting boundaries. A phone call meant for one business must never leak audio transcripts, metadata, or billed minutes into another client’s account.

To achieve reliable multi-tenancy without building fragile per-client microservices, we anchored our telephony architecture around five disciplined engineering pillars:

1. Cryptographic Webhook Ingress: Validating carrier signatures with constant-time HMAC-SHA1 verification before parsing payloads.
2. Deterministic Tenant Attribution: Mapping incoming calls strictly by destination E.164 phone numbers with fail-closed 404 routing.
3. Atomic Transactional Accounting: Protecting usage counters against carrier retries through unique CallSid deduplication and database transactions.
4. Telecom-Standard Minute Rounding: Applying deterministic ceiling math across normalized call states.
5. Collision-Proof Provisioning: Decoupling billing checkout from carrier number assignment with operator-verified validation runbooks.

1. Fail-Closed Cryptographic Webhook Ingress

When a call concludes on the carrier network, telephony infrastructure sends an HTTP status callback back to our ingest endpoint at /api/voice-agent/calls. Because this endpoint lives on the public internet, accepting unverified HTTP POST requests would expose the entire billing and reporting system to spoofing and artificial usage inflation.

Our ingest layer rejects unauthenticated requests immediately. If the server environment lacks configured credentials, the route fails closed with an HTTP 503 Service Unavailable rather than accepting unverified data.

Every incoming callback must satisfy one of two cryptographic authentication checks:

• Direct Carrier Status Callbacks: For raw webhooks delivered from Twilio, the endpoint computes an HMAC-SHA1 message authentication code over the full request URL concatenated with alphabetically sorted form parameters. This digest is matched against the X-Twilio-Signature header using constant-time comparison (crypto.timingSafeEqual) to prevent timing side-channel attacks.
• Internal Relay Ingest: For background workers reporting processed audio summaries, requests must supply a dedicated ingest secret in the x-ghost-ingest-key header, verified with identical constant-time string comparison.

Any request that fails both signature and secret checks is terminated with an HTTP 401 Unauthorized before any database query or business logic executes.

2. Deterministic Tenant Attribution via Destination E.164

In a multi-tenant system, associating an incoming call with the correct customer cannot rely on client-provided query parameters or unverified headers. The single source of truth for routing an inbound call is the destination number dialed by the caller—the To parameter formatted in international E.164 notation (e.g., +1407XXXXXXX).

When a verified callback arrives, our ingest handler queries the database for an active customer record whose assigned line matches the exact destination:

This fail-closed attribution guarantee ensures that even if carrier routing sends an erroneous callback, data cannot cross tenant boundaries under any failure condition.

3. Atomic Idempotency and Transactional Accounting

Telephony networks are distributed systems where network drops, carrier retries, and out-of-order webhook delivery are routine occurrences. A single phone call may emit multiple status callbacks over its lifecycle: initiated, ringing, in-progress, and completed. Furthermore, if an intermediate carrier proxy experiences a timeout, it may deliver the final completed callback three or four times in rapid succession.

If an accounting endpoint naively increments customer minutes on every webhook received, network retries will drain a client’s minute allowance within days.

To provide strict exactly-once accounting, our pipeline executes call record logging and balance updates inside a single database transaction:

• Unique Call Identifier: Every call is indexed by its globally unique carrier identifier (CallSid).
• Billed Status Check: Before updating balances, the transaction inspects whether an existing record for this CallSid was already marked as completed with a positive duration.
• Atomic Upsert: The VoiceCall record is upserted with normalized status, caller phone number, duration, and metadata, ensuring existing terminal outcomes cannot be regressed by delayed out-of-order packets.
• Protected Increment: The client’s usage balance (minutesUsed) is incremented if and only if the call had not been previously billed, reached terminal completed status, and recorded a positive duration.

Whether a carrier delivers a status update once or five times across twenty seconds, the client’s minute balance increments exactly once.

4. Telecom-Standard Minute Ceiling Math

How raw call seconds translate to billable account minutes must follow transparent industry standards. Telephony carriers meter usage on discrete minute boundaries, rounding any partial minute up to the next integer.

Our billing helper in lib/voice-usage.ts deterministically applies telecom ceiling rounding:

• A call lasting 32 seconds meters as 1 billable minute.
• A call lasting 64 seconds meters as 2 billable minutes.
• A call lasting 180 seconds meters as 3 billable minutes.
• Unanswered, busy, or 0-second failed attempts meter as 0 minutes.

Simultaneously, raw carrier statuses (completed, in-progress, answered, busy, no-answer, canceled, failed) are normalized into a unified four-state schema: initiated, in-progress, completed, or failed. This guarantees that customer portals, admin metrics, and export logs always reflect unambiguous call outcomes.

5. Decoupled, Collision-Proof Provisioning

A common trap in voice SaaS architecture is attempting to purchase and configure live phone numbers inside Stripe checkout webhooks. Doing so creates brittle failure modes: carrier API rate limits, inventory shortages in specific area codes, or invalid address registrations can fail mid-webhook, leaving customer payments orphaned from infrastructure.

We intentionally decoupled billing checkout from telephony number provisioning:

1. Checkout & Customer Creation: When a business purchases an AI Voice Agent plan, Stripe checkout creates the customer account record with twilioNumber = null.
2. Operator-in-the-Loop Verification: Number acquisition and binding is handled via an audited operational runbook using npm run voice-agent:assign-number.
3. Guardrail Enforcement: The provisioning CLI verifies international E.164 compliance, confirms the customer has an active subscription, prevents reassignment of existing numbers, rejects placeholder test numbers, and runs in dry-run mode until explicitly confirmed with --apply --confirm TWILIO_OWNERSHIP_VERIFIED.

Transparent Commercial Tiers

High-reliability multi-tenant telephony allows us to offer transparent commercial tiers with dedicated lines, isolated minutes, and 24/7 coverage:

• Starter ($497/mo + $497 setup): 200 included minutes/month, dedicated local number, custom business knowledge base, and full portal access.
• Pro ($997/mo + $497 setup): 500 included minutes/month, priority routing, CRM webhooks, and advanced appointment scheduling.
• Enterprise ($1,997/mo + $497 setup): Unlimited voice minutes, bespoke multi-agent workflows, and custom SIP trunking.

Whether you are managing twenty calls a day or five hundred, the underlying architecture remains the same: cryptographic verification, strict tenant isolation, and idempotent accounting.

Experience our real-time voice interface live on our homepage demo, or explore full deployment specifications and onboarding on our AI Voice Agent platform.