Lumora: voice agents for Indian service businesses

Problem

Small businesses in India lose leads to missed calls and slow follow-ups. Owners don't have time to learn another tool.

What I built

A voice-ops platform where each business gets a ready-made agent: an appointment receptionist or a lead follow-up caller. It's provider-neutral, so the telephony vendor can change without rewriting the agent.

Architecture diagram

Key decisions

1. 01

   Scoped, revocable API keys stored only as HMAC digests

   Why: Raw API keys are shown once at creation and stored strictly as HMAC digests in D1.

   Trade-off: Users cannot view an existing key again if they lose it (they must rotate/issue a new key), but a leaked database dump never exposes live tenant keys.

2. 02

   AES-256-GCM envelope encryption for customer destinations and secrets

   Why: Downstream webhook URLs, phone destinations, and tenant secrets are encrypted per record with AES-256-GCM before hitting storage.

   Trade-off: Adds key-management overhead on every worker invocation, but keeps customer routing data safe at rest.

3. 03

   Idempotent call admission

   Why: Every call trigger and telephony webhook requires an idempotency key checked at admission.

   Trade-off: Requires strict state tracking before call dispatch, but guarantees that a network retry never places an awkward duplicate call to a customer.

Result

• [PLACEHOLDER]

  [ADD METRIC: calls handled] once the first pilot runs.

• [PLACEHOLDER]

  [ADD METRIC: bookings made] once the first pilot runs.

• [PLACEHOLDER]

  [ADD METRIC: response time] once the first pilot runs.

Demo

Want one like this for your clinic, salon or business?