Production voice AI for regulated industries

We did the compliance work so slow incumbents don't have to.

Sage Voice ships production-grade voice AI for insurance, healthcare, financial services, and government — with an immutable, hash-chained, HMAC-signed audit trail and vertical-specific disclosure capture for NAIC Model Bulletin 30 (December 2023), HIPAA, FCRA, Reg E, TCPA (FCC 23-107), and CCPA. Native English and Mexican Spanish. Built on Cloudflare Workers and Durable Objects.

This is a buy-vs-build decision, not a category-defining platform. Progressive, EverQuote, Cresta, Sierra, and Hippocratic can build the same scope. The bet is that they will not ship it inside the 24-36 month window during which procurement queues, counsel review, and integration backlogs make buying faster than building.

Reviewed by Addie Conner · Last updated 2026-06-05 · No demo log-in required.

Honest about the moat

This is a time-to-market wedge, not a 10-year category.

Kill-shot — read this first

Compliance is checkbox engineering, not a regulatory perimeter.

Sage Voice's compliance modules — NAIC capture, HIPAA Safe Harbor redaction, FCC 23-107 consent gating, Reg E and Reg BI scripts — are real and they ship today. They are not, however, a durable structural moat. Any well-funded incumbent (Progressive, Allstate, EverQuote) or AI-voice generalist (Cresta, Sierra, Hippocratic) can build the equivalent in 24-36 months once they commit budget and counsel. We are not Stripe. There is no money-transmission perimeter equivalent here.

What we sell is the 24-36 month gap between "the carrier knows it needs a regulated voice agent" and "the carrier has its own production-grade version live." Inside that window, buying from Sage Voice is faster and cheaper than building. Outside that window, the buy-vs-build math changes and we either get acquired or we wind down.

Kill condition. If Progressive, EverQuote, Allstate, Cresta, or Sierra ships production-grade insurance or healthcare voice AI covering the same scope before Sage Voice clears $5M ARR, the right move is to sell early or fold. The cap table is structured to allow either.

What is defensible (24-36 months)

  • Time-to-market arbitrage. The compliance + bilingual + audit-chain stack is built and shipping; a self-build is 6-12 months per vertical plus four counsel engagements.
  • Vertical depth in life insurance. 11 NAIC + state-aligned gates wired into the prompt and API layer, not retrofitted.
  • Native bilingual EN + Mexican Spanish. Authored in both, not machine-translated. ~60M Hispanic Americans plus LATAM expansion is a real wedge against monolingual incumbents.
  • Multi-vertical reuse. One audit-log primitive amortizes across four verticals; an each-company-builds-their-own world wastes the same engineering four times.
  • Audit-chain architecture. SHA-256 chained, HMAC-signed, OpenTimestamps-anchorable. Technically rare, not patented, decent 24-month moat.

What is NOT defensible (do not believe the pitch)

  • Compliance is not the moat. Every gate Sage Voice enforces is publicly cited and reproducible by any competent eng team plus counsel.
  • No regulatory perimeter. Sage Voice does not absorb licensing, money-transmission, or carrier-of-record status the way Stripe or Plaid absorbed payments rails.
  • No data-network effect. Audit logs are per-tenant by design; we do not pool data across customers and could not legally do so on healthcare and insurance lines.
  • No platform lock-in. Tenants bring their own LLM, TTS, and orchestrator keys. Migration cost is real (counsel re-review) but not contractual.
  • No 10-year category claim. If we are still pitching the same thing in 2034, we have failed at the exit-shape thesis.

Why publish this. Enterprise buyers and strategic acquirers read this page. Surfacing the kill-shot is a trust signal for the buyer (we know what we are and what we are not) and a credibility signal for investors (we are not selling the next Stripe). Hand-waving the moat is how voice-AI pitches lose the procurement review.

Why now

The regulatory perimeter is closing while the incumbents are still building.

Two clocks are running. The regulatory clock tightens through NAIC Model Bulletin 30 adoption, FCC 23-107 TCPA enforcement, and state AI disclosure laws — and forces every regulated-industry voice deployment to capture the audit trail Sage Voice already produces. The competitive clock tells you how long the buy-vs-build window stays open: 24-36 months until Progressive, Allstate, Cresta, Sierra, or Hippocratic ships the equivalent in-house. Inside both windows, Sage Voice is the buy.

§

NAIC Model Bulletin on AI Systems

Adopted by the NAIC plenary in December 2023. As of 2026-06-05, 21+ states (CO, NY, CA, UT, KY, IL, NH, PA, WA, RI, NV, AK, CT, MD, NE, OK, OR, VT, VA, MO, MI) have issued aligned bulletins or rules. Sage Voice resolves the federal baseline plus state add-ons per call.

§

Colorado SB 21-169 + Reg 10-1-1

First state algorithm-governance rule for life insurance, effective 2023. Race-bias testing of external consumer data and algorithms. Sage Voice captures the governance + testing artifacts required.

§

FCC 23-107 (December 2023)

Clarified that AI-generated voices fall under the TCPA "artificial or prerecorded voice" rules; one-to-one prior express written consent required for outbound. Sage Voice rejects outbound calls without an on-file consent capture matching the dialed number.

§

California AB 3030 (2024)

Mandates AI disclosure on clinical patient communications. Sage Voice delivers and timestamp-acknowledges disclosure on every California healthcare call.

Four verticals

One audit primitive. Four vertical compliance packs.

Exit shape

This is structured for strategic acquisition, not for IPO.

Realistic exit math: $80-200M strategic acquisition at 4-6× ARR on $15-50M ARR in years 4-5, or a $40-100M acquihire to a voice-AI generalist (Cresta, Sierra) needing the insurance + healthcare vertical depth Sage Voice already shipped. We are not pitching a billion-dollar standalone outcome; the pitch is "fill the gap, sell the asset, return the fund."

Insurance acquirers

Progressive, Allstate, Verisk, Guidewire, Salesforce Insurance Cloud. Strategic motive: vertical voice-AI capability before in-house build finishes. 4-6× ARR multiple, 2028-2030 window.

Voice-AI generalists

Cresta, Sierra, Hippocratic, Polly. Strategic motive: insurance + healthcare vertical coverage they have not built. $40-100M acquihire range; faster path.

Healthcare and gov adjacents

Epic, Oracle Health, Salesforce Public Sector, ServiceNow. Lower-probability paths; gated on BAA chain maturity and FedRAMP path completion.

Architecture

Compliance enforced at the API boundary — not in the prompt.

1. Per-tenant Durable Object

Every call event SHA-256 hash-chained to the prior entry, HMAC-signed with a per-tenant key, persisted in a Cloudflare Durable Object scoped per tenant. The audit chain is verifiable in a single API call.

2. Compliance modules

HIPAA Safe Harbor redaction, NAIC Best Interest capture, federal + state AI disclosure resolution, TCPA pre-call check — each a small TypeScript module exercised before any call is provisioned.

3. BYO carrier + provider

Retell or Vapi for voice orchestration. OpenAI or Anthropic for the LLM. ElevenLabs for TTS. Tenants bring their own provider keys or pay pass-through. Sage Voice never resells minutes.

Trust

Built for the buyer reading the SOC 2 report.

11 gates Per insurance call, citing NAIC + state code
SHA-256 Hash-chained audit, HMAC-signed per tenant
6 years HIPAA retention by default (45 CFR § 164.530(j))
EN + ES Native Mexican Spanish prompts — not machine-translated

Sage Voice provides infrastructure for compliance capture; it does not constitute legal advice and does not certify any tenant as HIPAA-compliant, NAIC-compliant, FCRA-compliant, or otherwise. Tenants engage their own regulatory counsel — see Trust & SOC 2 readiness.