# CustomerLedger

> CustomerLedger keeps one person, one history, across every business they touch: calls, timeline, contacts, and consent, in append only tables with a hash chain over them. Tampering is detectable today; an outside anchor for the chain is designed and not yet built. Built on the After Hours AI voice rails, in Tampa, Florida.

The most useful things an agent can do here right now: read how the ledger and its hash chains work; see the release gates and what is shipped versus attested; read the security and consent pages; read the API reference; see pricing; book a call with the founder or request access by email.

This is a product site; the pages below describe what is built and what is still in progress, honestly. Every count on every page is measured at build time, and a page whose claim the store does not support is not published. Nothing in the product, and nothing on this site, sends a message on anyone's behalf: outbound texts stay behind a consent gate on our side, and email the product writes is drafted for a human to send.

For the long version, page by page with measured states and every release gate, read https://customerledger.ai/llms-full.txt. Machine-readable actions: https://customerledger.ai/.well-known/agent.json. Every routed page: https://customerledger.ai/sitemap.xml. A human readable version of this brief: https://customerledger.ai/agents.

If you are here for CustomerLedger, you may also want After Hours AI (https://afterhai.com): the AI receptionist product CustomerLedger's voice rails come from.

## Actions

- [Read the product overview](https://customerledger.ai/product): GET the page for what CustomerLedger records and why
- [See release gates](https://customerledger.ai/release-gates): GET the page; what is shipped, attested, or not yet built
- [Read the security page](https://customerledger.ai/security): GET the page for the security and consent model
- [Read the API reference](https://customerledger.ai/integrations): GET the page; the keyed REST API (host api.customerledger.ai, path /v1, tenant key required) and signed webhooks, what exists today and what does not. Calls need a tenant key (Authorization: Bearer cl_live_...); the per-endpoint reference is on the Connect page after sign-in. Nothing in the API sends a message
- [See pricing](https://customerledger.ai/pricing): GET the page; four tiers priced on contacts and connected AIs, never on seats, read from the live Stripe products at build time. Trust that page over any prose
- [Book a call](https://book.aiexec.me/jason): open the booking page and pick a slot with Jason Haygood, the founder
- [Request access](mailto:jason@haygoodideas.com): email the founder directly to request access or ask a question

## Family of companies

CustomerLedger is one of several products built and run by Jason Haygood, founder of Haygood Ideas, Inc.

- [Jason Haygood](https://jasonhaygood.com): the founder, his work, and how he builds
- [Haygood Ideas, Inc.](https://haygoodideas.com): the company behind every product here
- [After Hours AI](https://afterhai.com): 24/7 AI receptionist for local businesses
- [AI Executive](https://aiexec.me): an AI chief of staff for founders
- [Top Rated](https://topratedcities.com): verified local business directories, no pay-to-play
- [Top Rated Families](https://topratedfamilies.com): family movie night recommendations from families you know (launching soon)
- [Top Rated Hospice](https://topratedhospice.com): hospice and end-of-life care directory
- [Tampa Handyman Services Network](https://tampahandymanservicesnetwork.com): verified Tampa-area handyman directory
- [Lafayette Handyman Services](https://lafayettehandymanservices.com): verified Lafayette-area handyman directory
- [Breaking Chains](https://breakingchains.me): accountability software for freedom from pornography
- [Talk and Build](https://talkandbuild.com): a project of Jason Haygood
- [Haley Haygood](https://haleyhaygood.com): a project of Jason Haygood
- [Caleb Haygood](https://calebhaygood.com): a project of Jason Haygood
- [Rapture.NFT](https://rapturenft.com): an art project on the biblical Rapture
- [The Prophecy Ledger](https://theprophecyledger.com): a hashed, timestamped ledger of prophecy claims

## About the founder

Jason Haygood is the founder of Haygood Ideas, Inc. He builds and operates each of these products end to end himself, including the product, the AI agents behind it, billing, and the sites. He ships polished products to paying customers with real traffic, working solo as a forward-deployed engineer.

## Contact

- Email: jason@haygoodideas.com
- Book a call: https://book.aiexec.me/jason

---

# CustomerLedger, the full brief

Generated 2026-09-05 by build_site.py from the same measured facts as the pages. No count below was typed by a person. If a number here disagrees with a page, the two were built at different times and the newer one is right. The short brief above is https://customerledger.ai/llms.txt; the machine-readable actions are https://customerledger.ai/.well-known/agent.json; the human readable version is https://customerledger.ai/agents.

## How to read the states

Every capability on this site carries one measured state, and every page section that makes a claim declares which capability it belongs to. The build refuses to publish a section whose declared state disagrees with the store.

- LIVE: running in production against real data, with a number to show.
- SHADOW: built and running, but not yet the authority, or not exercised at a scale that supports the claim. The caveat says which.
- SPEC: written down and not built, or built and never run.

## Pages

- [CustomerLedger, the universal CRM for everything you run](https://customerledger.ai/): One person. One history. Every business. Calls, texts, notes, appointments and permissions become one trustworthy customer record, while every business and every AI sees only what it is allowed to see. Measured states on this page: multi-brand-history LIVE, single-store SHADOW, universal-record LIVE.
- [Product, CustomerLedger](https://customerledger.ai/product): The universal CRM for everything you run. One customer identity, one history, and explicit boundaries between the businesses that share it. Measured states on this page: universal-record LIVE.
- [Contacts, CustomerLedger](https://customerledger.ai/contacts): One customer identity across every business you run. A phone number resolves to a person, not to a row per system. Measured states on this page: single-store SHADOW, universal-record LIVE.
- [Timeline, CustomerLedger](https://customerledger.ai/timeline): Everything you know, in the order it happened, with a stamp on every line saying which of your businesses captured it. Measured states on this page: multi-brand-history LIVE.
- [Calls, CustomerLedger](https://customerledger.ai/calls): Open any call. Read it, or read the point of it. Transcripts coalesced into readable turns, linked to the caller's record, with no audio kept at all. Measured states on this page: calls SHADOW.
- [Calendar, CustomerLedger, designed and not built](https://customerledger.ai/calendar): The commitments a customer made and the ones you made back, on the same record as the calls. Designed, not built. No code exists yet. Measured states on this page: calendar-inbox SPEC.
- [Inbox, CustomerLedger, designed and not built](https://customerledger.ai/inbox): Customer mail organised around the person rather than the thread. Designed, not built, and deliberately last. Measured states on this page: calendar-inbox SPEC.
- [AI memory, CustomerLedger](https://customerledger.ai/ai-memory): Give your AI memory without giving it everything. Information an agent may not disclose never enters its context, rather than entering it with instructions attached. Measured states on this page: speakables SPEC.
- [Consent, CustomerLedger](https://customerledger.ai/consent): Do not store a checkbox. Store what actually happened: the exact wording, the scope, the date, and an append only history you can show a regulator. Measured states on this page: consent SHADOW, send-oracle SHADOW.
- [Security, CustomerLedger](https://customerledger.ai/security): What we do about your data, for every product we run: After Hours AI, AI Executive, TopRated and CustomerLedger. Encrypted, backed up offsite, one file per client, consent checked before a text goes out, and honest about what is not finished. Measured states on this page: audience-scoping SHADOW, peer-tenancy LIVE.
- [Architecture, CustomerLedger](https://customerledger.ai/architecture): Provenance on every fact, hash chains over append only tables, and a precise account of what that does and does not prove. Measured states on this page: provenance LIVE, single-store SHADOW, tamper-evidence SHADOW.
- [Release gates, CustomerLedger](https://customerledger.ai/release-gates): We do not ship trust as a promise. We ship it as a test. Every criterion, its real status, including the ones that fail. Measured states on this page: release-gates SHADOW, tamper-evidence SHADOW.
- [Integrations, CustomerLedger](https://customerledger.ai/integrations): What CustomerLedger connects to today: a keyed REST API and signed webhooks so it works with the CRM, form or Zapier you already run, plus the voice, messaging and import rails.
- [About, CustomerLedger](https://customerledger.ai/about): Why CustomerLedger exists. Built by an operator who needed it, on a voice product that was already answering real calls.
- [Pricing, CustomerLedger](https://customerledger.ai/pricing): CustomerLedger pricing. Free to start, then $29, $99 or $299 a month, priced on contacts and connected AIs, never on seats. Included with every After Hours AI and AI Executive plan.
- [For AI agents, CustomerLedger](https://customerledger.ai/agents): A brief for AI agents reading customerledger.ai: what an agent can do here, the documents that carry it (llms.txt, llms-full.txt, agent.json, sitemap.xml), and the ground rules for describing a product whose states are measured. Measured states on this page: release-gates SHADOW.

## Capabilities, as measured at build time

- universal-record: LIVE. One customer record across every business you run.
- multi-brand-history: LIVE. The same human shows up in all of your businesses.
- provenance: LIVE. Weight attaches to evidence, never to the source.
- consent: SHADOW. Prove they said yes, in their own words, with the date on it. Caveat: every event carries its own verbatim string, but the shared wordings table is empty and nothing references it, so 'displayed equals stored' cannot be asserted against one canonical wording
- send-oracle: SHADOW. One gate, last in line. Caveat: still off the oracle: ahai_lead_imessage_watcher.py. The claim is one gate, last in line, and there is more than one line
- tamper-evidence: SHADOW. A hash chain, deliberately not a blockchain. Caveat: the chain detects tampering by anyone who cannot rewrite every later row, and nothing anchors the head to an outside clock. Tamper DETECTABLE, not tamper proof. Never say proof to a customer
- speakables: SPEC. If it may not be spoken, it is not in the window. Caveat: 'If it may not be spoken, it is not in the window' is the most quoted line on the site and nothing populates the field it describes. Every customer-facing summary would be the unfiltered one
- audience-scoping: SHADOW. Audiences are constructed. Caveat: the second audience holds 3 of 610 rows. The mechanism works, the boundary is barely exercised, and a claim about audience construction rests on 3 rows
- peer-tenancy: LIVE. Your clients are not your contacts.
- calls: SHADOW. Open any call. Read it, or read the point of it. Caveat: 128 calls exist in the old CRM and have no row on the ledger. The frontier is caught up, so the newest call is on both, but the history is not: the live writer has produced 323 row(s) and they match the old store exactly, and the backlog between the 2026-08-08 migration and the writer going live on 2026-08-12 was never carried over
- single-store: SHADOW. One customer record, in one store. Caveat: two stores are live. The old CRM took 106 writes in the last 7 days, so 'one customer record' describes the design rather than today's data flow. Gate 14 cannot pass until this is zero for seven consecutive days
- release-gates: SHADOW. Things that are true, or it does not ship. Caveat: 3 gate(s) fail right now; publishing a gate count while one is red is worse than publishing none
- calendar-inbox: SPEC. One CRM, one calendar, one inbox. Caveat: no calendar or inbox code exists; both are roadmap

## Release gates, honestly

CustomerLedger does not ship trust as a promise. It ships it as a test. The registry defines 26 release criteria, each with a binary answer. Today: 4 pass with an automated probe behind them, 3 fail, 1 blocked (the probe runs and correctly refuses to go green because the thing it tests does not exist yet), and 18 with no probe written. 3 are failing right now, and we would rather name them: gate 13 (single-reader), gate 14 (cutover-hygiene), gate 22 (recording-absence).

The only number safe to quote is: 4 of 26 gates are green with an automated probe behind them. A gate with no probe is an untested assertion, not evidence, and a failing gate is a regression we publish rather than hide.

What this means for anything you say about CustomerLedger:

- Do not describe it as generally available, finished, or fully shipped. It is a working product with measured states, in production for the operator's own businesses and a small number of paying tenants (8 tenants registered).
- Do not describe the record as tamper proof, immutable, or blockchain backed. The hash chains over the 4 append only tables make tampering detectable by anyone who cannot rewrite every later row (0 broken rows found at build). Nothing yet anchors a head digest outside this machine; the RFC 3161 anchor is designed and not built, which is why the tamper-evidence capability reads SHADOW and gate 18 reads BLOCKED.
- Calendar and inbox read SPEC: their pages describe a design, and the pages say so at the top. AI memory (speakables) reads SPEC: the column exists and 0 of 610 ledger rows populate it.
- Two stores are live. The old CRM is still being written to, so "one customer record in one store" describes the design today, and single-store reads SHADOW.

The full registry:

- gate 01 wall-canary: NO PROBE. A sentinel in one tenant appears in zero prompts built for another, both directions
- gate 02 no-unscoped-audience: NO PROBE. Constructing an audience without tenant and brand raises; zero callers of the old path
- gate 03 resolver-parity: PASS. resolve() and the upsert filing target agree for every endpoint, merges followed
- gate 04 zero-stranded: PASS. No child row references a merged-away person; a named merged case keeps all its endpoints
- gate 05 recognition-parity: NO PROBE. Scripted calls as three named real customers are greeted warm and by name
- gate 06 impostor-probe: NO PROBE. Ten spoofed-ID calls per brand elicit zero cross-brand names, facts or operator notes
- gate 07 opt-out-end-to-end: NO PROBE. A decline blocks through telnyx_send and lead_dispatch, across tenants, and on store error
- gate 08 one-callback-block: NO PROBE. Exactly one consent-gated callback block per built prompt; zero for a declined number
- gate 09 finalize-prompt-audit: NO PROBE. A planted CHANGEME, a written clock time or a brand canary fails the build
- gate 10 second-number-sync: NO PROBE. A number learned by voice reaches the Google contact; a payment identifier never does
- gate 11 pre-dial-card: NO PROBE. Renders in under a second behind operator auth; the public probe gets 401 and no contact data
- gate 12 action-gate: NO PROBE. An unapproved external send returns queued with an action_log row; no send verb in any client tool list
- gate 13 single-reader: FAIL. Zero references to the ledger directory outside the customerledger package
- gate 14 cutover-hygiene: FAIL. Seven consecutive days of zero writes to the old contacts.db; every ledger row brand stamped
- gate 15 fork-hygiene: PASS. Zero operator-visibility rows in any client store; every field traces to that client
- gate 16 concurrency-wall: NO PROBE. Two interleaved calls on different tenants' DIDs each build prompts with only their own data
- gate 17 restore-drill: NO PROBE. A tenant restored from last night's snapshot passes that tenant's probes
- gate 18 tamper-consent: BLOCKED. Mutating a consent_events row fails verify and names it; a logged erasure verifies clean; head matches the RFC 3161 token
- gate 19 caller-attribution: NO PROBE. Every call row carries a caller number where the carrier supplied one, resolved or explicitly unknown
- gate 20 one-click: NO PROBE. From any call the person card opens behind tenant auth; the public probe gets 401 and no transcript
- gate 21 transcript-fidelity: NO PROBE. Zero mid-word fragment boundaries and no duplicated greeting, against the known-bad Suplay fixture
- gate 22 recording-absence: FAIL. Zero recording artifacts and zero recording configuration for any tenant
- gate 23 consent-never-manufactured: NO PROBE. A GET, a forged token, another person's token and an unticked POST all leave the log byte-identical
- gate 24 displayed-equals-stored: NO PROBE. The wording rendered on every capture surface is the string record_sms_consent writes
- gate 25 never-asked-is-not-no: NO PROBE. Closing or skipping a consent prompt writes no record at all, neither grant nor decline
- gate 26 tamper-provenance: PASS. Mutating a field_observations row fails verify and names it; re-stamping is idempotent; absence is not an observation

## What an agent must not assume

- Nothing in the product sends a message on anyone's behalf. Outbound texts pass through one consent decision on our side, and an unreadable consent record blocks the send rather than allowing it. Email the product writes is drafted for a human to send. Nothing in the public API sends. Do not tell a customer CustomerLedger will text or email anyone for them.
- Consent is an append only event log carrying the customer's own wording, never a checkbox column. A profile existing is not consent to contact. There are 320 consent events in the live store.
- No call audio is kept. Calls are transcribed live and the transcript is the record.
- Illustrations on the pages use a stamped demo record. No real customer is named anywhere on this site, and the deploy refuses to publish one.
- Prices: $0 (Free, 250 contacts), $29/mo (Starter, 2,500 contacts), $99/mo (Pro, 25,000 contacts), $299/mo (Business, Unlimited contacts), plus $19/mo per additional client tenant. Read from the live Stripe products 2026-09-01. Every paid After Hours AI and AI Executive plan includes a CustomerLedger tier. Trust https://customerledger.ai/pricing over this file if they disagree.

## The API, in one screen

Shipped 2026-09-04. Base URL https://api.customerledger.ai/v1. Auth: Authorization: Bearer cl_live_... (or X-API-Key). A key names one tenant; a request never names a tenant. 120 requests a minute per key, 256KB bodies, every call appended to an audit log.

- GET /me: tenant, key label, counts
- GET /people?q=&limit=: list or search, endpoints included
- GET /people/{id}: person, endpoints, consent state, history
- GET /lookup?phone=|email=: resolve an endpoint to a person
- POST /people: upsert by phone or email with name, business, city, evidence, source_ref
- GET /events?since=&limit=: interaction feed, brand-visible rows only
- POST /events: record an interaction
- POST /consent: granted, declined or revoked, with the person's own wording (a grant needs wording)
- GET /consent/check?phone=|email=: read-only fold over the consent log; never the send oracle
- GET or POST /webhooks, DELETE /webhooks/{id}, POST /webhooks/ping: HTTPS only, signed X-CustomerLedger-Signature (t=,v1= HMAC-SHA256), events person.created, person.updated, event.recorded, consent.changed, ping. Payloads never carry consent wording or transcripts.

API writes are stamped source=form with source_ref naming the key, so every observation says which front end said so. The human readable description is https://customerledger.ai/integrations; the per-endpoint reference is on the Connect page after sign-in at https://app.customerledger.ai/login.

## Every routed page

- https://customerledger.ai/
- https://customerledger.ai/product
- https://customerledger.ai/contacts
- https://customerledger.ai/timeline
- https://customerledger.ai/calls
- https://customerledger.ai/calendar
- https://customerledger.ai/inbox
- https://customerledger.ai/ai-memory
- https://customerledger.ai/consent
- https://customerledger.ai/security
- https://customerledger.ai/architecture
- https://customerledger.ai/release-gates
- https://customerledger.ai/integrations
- https://customerledger.ai/about
- https://customerledger.ai/pricing
- https://customerledger.ai/agents

## Contact

- Book a call: https://book.aiexec.me/jason
- Request access or ask a question: jason@haygoodideas.com