IQ
IQForce.AI Tech Stack · May 2026

Built for speed,
designed to scale

A deliberate, lean stack chosen for rapid iteration in the MVP phase — single static page + Supabase backend + 21 serverless edge functions. No infra to own, no build step, every choice justified by a real constraint.

Architecture
How the system fits together
Serverless, API-first. Browser talks to Supabase Auth + Postgres directly (RLS-protected); everything else routes through Deno edge functions that hide third-party API keys and enforce compliance gates.
Request flow
Browser
app.html — ~4000 lines vanilla JS
→
Supabase Auth + Postgres
Direct SDK · RLS via auth.uid()
↓ via fetch() — JWT-verified by default
Supabase Edge Functions · 21 deployed
Deno runtime · auto-scale · zero infra
AI agents (Claude via proxy)
claude-proxy
JWT-verified · hides ANTHROPIC_API_KEY · all Nico/Ana/Max/Leo/Sam/Mia/MarIA calls route here
Email — outbound + replies + tracking
send-outreach
D0 send + D3/D7/D14 schedule · HITL queue · per-tenant rate limit
process-sequences
pg_cron-driven · sends due follow-ups · honors approvals
send-reply
RFC-2822 threaded reply · CAN-SPAM footer + unsubscribe
maria-inbound
Resend Inbound · Svix HMAC · 4-strategy correlation · 8-intent classifier · draft generator
resend-webhook
Open/click/bounce events · Svix HMAC-verified
suppress-prospect
HMAC-signed unsubscribe link · public · idempotent
SMS + WhatsApp — post-consent (Twilio)
send-sms
Twilio 10DLC conversational · TCPA gates · STOP footer · HITL
twilio-sms-inbound
HMAC-SHA1 · STOP/HELP · status callback · SMS-tuned MarIA
send-whatsapp
Twilio WABA · 24h conversation window enforced · 'read' status
twilio-whatsapp-inbound
HMAC · STOP-equivalent set · WA-tuned classifier + draft
admin-compose-message
Operator-initiated first SMS/WA after consent · AI-draft + HITL
admin-initiate-list
Lists prospects awaiting first non-email touch
Tenant onboarding + admin (per-client subdomains)
tenant-onboard-resend
Provisions <slug>.iqforce.solutions in Resend · DKIM/SPF/DMARC
tenant-verify-resend
Triggers Resend domain re-verification
tenant-admin-list
Admin Tenants table backing data
tenant-admin-replies-list
HITL Review Queue backing data · channel-aware
tenant-admin-update
Capture physical_address + display_name + cal.com link
Compliance + retention
purge-expired-records
3-tier retention (12mo bodies / 4yr consent / indef opt-outs) · pg_cron daily 03:00 UTC · enforces SMS Consent promises
Telegram (scaffolding · cold deferred indefinitely per D54)
send-telegram
Pattern reused by Twilio integrations
telegram-webhook
Inbound stub · not in pilot scope
Scheduled jobs (pg_cron + pg_net)
pg_cron
Postgres native scheduler
→
pg_net
HTTP POST from DB
→
purge-expired-records
Daily 03:00 UTC · auth via x-purge-secret
External scheduler
cron-job.org / GH Actions
→
process-sequences
Sends due D3/D7/D14 steps · honors HITL
Hosting & deploy pipeline
GitHub
zalogonza/iqforce
push to main →
deploy-prod.yml
sed-swap PROD creds + CNAME
→
iqforce.ai
PROD · GH Pages
GitHub
zalogonza/iqforce
push to dev →
deploy-dev.yml
sed-swap DEV creds + orange DEV badge
→
iqforce.solutions
DEV · iqforce-dev gh-pages
DNS: 4× GitHub Pages A records + 4× AAAA records on the apex (GoDaddy URL-forwarding removed May 7 · D57); Let's Encrypt cert auto-provisioned. Edge function deploys are manual (supabase functions deploy <name> --project-ref <ref>) — CI does not push SQL or functions.
Services
Managed services — no infra to own
Every external service was chosen for its free/cheap tier, REST API quality, and zero-ops footprint.
⚡
Supabase
Auth · Postgres · Edge Functions runtime · RLS via auth.uid() on all 18 tables · pg_cron + pg_net for scheduled jobs · separate DEV / PROD projects
Free tier · 2 projects
🧠
Anthropic Claude
All 9 AI agents (Nico, Ana, Max, Leo, Sam, Mia, MarIA, Luna, Vera). Accessed via claude-proxy edge function so the API key never reaches the browser.
claude-sonnet-4
📧
Resend
Outbound email from per-client subdomains (maria@<slug>.iqforce.solutions); Resend Inbound on replies.iqforce.solutions for MarIA. Webhooks for opens, clicks, bounces, inbound — all Svix HMAC-verified.
Pro · $20/mo · 10 domains
📱
Twilio
Post-consent SMS (shared IQForce 10DLC toll-free) + WhatsApp (WABA). Outbound HITL-gated; inbound HMAC-verified; STOP keyword set honored. Cold SMS/WhatsApp forbidden per D54.
Phase 8 · TF verification pending
📅
Cal.com
Per-tenant booking link surfaced by MarIA when prospect signals interest. Voice handoff path in MVP = Cal.com schedule + WhatsApp at the slot. Real AI voice deferred to Phase 10.
Per-tenant · Free
📄
GitHub Pages
Static hosting for both apex + landing + docs. Custom domain via A/AAAA records (no GoDaddy forwarding). CI/CD via GitHub Actions on every push to dev / main.
Free · custom domains
💳
Stripe
Phase 13 (post-pilot). 90-day demo → $500 promo / $2K Starter / $5K Growth via Stripe Checkout + stripe-webhook edge fn.
Phase 13 · LLC done · Atlas next
✈️
Telegram Bot API
Scaffolding kept in-tree (send-telegram, telegram-webhook, telegram_* tables). Cold Telegram outreach deferred indefinitely per D54; provides the pattern Twilio integrations reuse.
Deferred · pattern reuse
Design Principles
Why we built it this way
01
Single-file frontend
The entire product (~4000 lines of app.html) ships as one static HTML file. No bundler, no npm, no transpile step. Claude can read and edit the full context in one pass.
02
No own servers
100% serverless. Supabase handles auth, data, and compute (21 edge functions). Zero infra to provision or patch. Costs scale with paying tenants, not idle capacity.
03
API key safety
No third-party API key ever reaches the browser. Claude, Resend, Twilio, Cal.com — every outbound call routes through an edge function that injects the secret server-side and verifies the caller's JWT.
04
AI-native development
Stack chosen so Claude can act as the primary developer. Simple files, no transpilation, readable structure — Claude reads the whole repo, edits in-place, and pushes commits directly.
05
Security by structure
Row-Level Security on every table via auth.uid(). JWT verification on every user-facing edge function by default. Service-role only inside trusted functions, never on the client.
06
Compliance is code
CAN-SPAM footer + TCPA consent gates + STOP keyword honoring + per-channel suppression are enforced inside the edge functions, not in process. Retention promises are enforced by a daily pg_cron job.
07
HITL by default
Every outbound message — email reply, SMS, WhatsApp — is drafted by AI and held in the Review Queue until a human operator approves. The toggle is intentionally hidden during the pilot.
08
Two environments, fully isolated
DEV (iqforce.solutions · ejhwohpxhtkjciztzgwh) and PROD (iqforce.ai · ijeltlqfmlddufhlarid) are separate Supabase projects with separate keys. Workflows sed-swap creds at deploy time.
Decision Log
Every choice, with its rationale
DecisionChoiceRationale
Frontend framework Vanilla HTML/JS — no React, no Vue No build step. Claude reads the full file in one context window. Instant iteration. Tradeoff accepted: discipline required to keep app.html readable as it grows.
App structure Single app.html file (~4000 lines) GitHub Pages compatible · all state in JS · no module bundling. sed-based env swap at deploy time stays trivial.
Backend Supabase Edge Functions (Deno) Serverless, zero infra, TypeScript, co-located with the DB. 21 functions deployed; free tier still sufficient.
AI access Claude Sonnet 4 via claude-proxy API key never exposed in client-side code. Single place to audit all AI calls. Model: claude-sonnet-4-20250514.
Email delivery + inbound Resend (Pro plan, per-client subdomains) Better deliverability than raw SMTP, webhook support for open/click/bounce/inbound, generous free tier, doubles as Supabase Auth SMTP. Resend Inbound launched Apr 26 replaced Postmark — single provider, −$10/mo (D51).
Cold channels Email + (later) LinkedIn only — D54 Cold WhatsApp / SMS / Telegram are non-starters in US B2B (TCPA, Meta commerce policy, 10DLC marketing reg). LinkedIn cold deferred to Phase 9 post-pilot.
Post-consent channels SMS + WhatsApp via Twilio — D54 Same playbook a human SDR uses: prospect opts in via email reply, MarIA extracts phone/preferred_channel, then we use the channel they chose. Shared IQForce 10DLC + WABA — no per-client carrier registration needed.
Voice (MVP) Cal.com schedule → WhatsApp at the slot No outbound voice infra during MVP. Real AI voice (Vapi / Bland) deferred to Phase 10 after pilot data tells us which provider fits.
Hosting GitHub Pages + A/AAAA on apex (D57) Free static hosting · auto-deploy from GitHub Actions · Let's Encrypt cert. GoDaddy URL-forwarding removed May 7 because the apex subpath (iqforce.solutions/app.html) was 405-ing.
Multi-tenancy Single DB · RLS via auth.uid() One Postgres, one schema, RLS-scoped policies (Pattern B) on every table. No schema-per-tenant. Simple to operate, easy to audit.
HITL Mandatory during pilot — D38 Every outbound message held in Review Queue until operator approves. Toggle UI intentionally hidden. Returns post-pilot once trust is established.
Geo scope US-only — D37 Eliminates GDPR / CASL exposure during pilot. Enforced at CSV import + on every send-* function. EU / Canada deferred until DPAs + GDPR data-flow assessment are done.
Retention 3-tier: 12mo bodies / 4yr consent / indef opt-outs Public commitment on SMS Consent page §8 + Pilot Agreement §11.3. Enforced in code by purge-expired-records running daily 03:00 UTC.
Billing Stripe — Phase 13, three tiers 90-day demo → $500 promo / $2K Starter / $5K Growth. Webhook-driven subscription lifecycle.
Environments
PROD vs DEV — fully isolated
PRODDEV
Domain iqforce.ai iqforce.solutions
Repo / branch zalogonza/iqforce · main zalogonza/iqforce · dev
GitHub Pages iqforce (gh-pages) iqforce-dev (gh-pages)
Supabase project ijeltlqfmlddufhlarid ejhwohpxhtkjciztzgwh
Data Real client data Test data only
App header Clean — no badge Orange "DEV" badge injected by Action
Deploy trigger Push to main (explicit auth per D20) Push to dev (default)
Credentials swap deploy-prod.yml · sed replace deploy-dev.yml · sed replace
Edge functions Deployed manually via Supabase CLI Deployed manually via Supabase CLI
Migrations Pasted into SQL Editor Pasted into SQL Editor