TowerLine AI · operated by The AI Agency USA, Inc.

Security overview

For security questionnaires and vendor reviews · Facts as of October 22, 2026 · towerlineai.com/security

What we can verify today about this website and the providers the AI concierge relies on; how the product handles access; and the topics we answer in writing for your deployment. We don’t hold or claim security certifications.

Company

Company: The AI Agency USA, Inc.
Address: 7848 W Sahara Ave #504, Las Vegas, NV 89117
Founder and CEO: Adam Golob
Product: TowerLine AI, property operations software for residential communities

Providers, by category

Voice AI: Processes the AI concierge’s calls and keeps their recordings and transcripts.
Telephony and SMS: Phone numbers, calls, texts and SMS verification codes.
Managed database: Stores a deployment’s records. This website’s demo form is written to save requests to it.
Email delivery: Sends email. This website’s demo form can also send requests to our inbox through it.
Hosting: Serves this website and a deployment’s web application.

The security review for your deployment names each provider, the data it receives, where it is hosted and how long recordings are kept.

What we can verify today

Voice AI provider: A hosted voice AI platform that processes calls and keeps their recordings and transcripts. Named in the security review.
Telephony and SMS: A telephony and SMS provider for numbers, calls, texts and SMS verification
Website transport: HTTPS only, with HSTS (two years, subdomains included)
Website hardening: Content-Security-Policy, frame blocking (X-Frame-Options: DENY), MIME sniffing blocked, strict referrer policy, microphone limited to our own pages
Payments on the website: None. The website takes no payments.
Certifications: None claimed.
Demo requests: The form has a bot trap and a rate limit. Its code saves each request to a database, emails it to us through an email delivery provider, or both, and confirms a request only after one of them accepts it. Which of the two is switched on for this site is confirmed at launch.
Demo-line access (when the public demo line is enabled): A human-verification check, then a one-time SMS code sent through our telephony provider (US and Canada numbers). Verification starts a 30-minute session whose token is signed but not encrypted; it carries a truncated SHA-256 hash of the number, used to rate-limit calls per number. The AI concierge's number is shown only after verification and never appears in the page source. Browser calls are rate-limited per verified number and per IP address.

The public demo line is not open yet. The demo-line row describes how access works when it is switched on.

How the product handles access

Roles: One role per person, per community: Board, Manager, Front desk, Maintenance, Accountant, and AI concierge, whose access is limited to the caller on the line. Owners and residents sign in to their own portal. Every permission is agreed per community during implementation.
Two-step sign-in: The team and roles screen shows each staff member’s two-step sign-in status, and a manager can suspend a login from the same row.
Audit trail: Calls, check-ins, packages, approvals, sign-ins and access changes are logged with the person or the AI concierge, the role, the time and the unit. Filter, search and export.
Call disclosure: The AI concierge says it is an AI concierge and that the call is recorded. It is a locked rule, so a community’s settings cannot turn it off.
Outbound voice: Outbound voice notices go only to owners with voice consent on file.
Texts: When a resident replies STOP, the telephony provider’s opt-out handling blocks further texts to that number.

What the AI concierge checks before sharing anything

PIN or texted code first: Before a balance, a work order or anything else tied to a unit, the AI concierge verifies the caller with a PIN or a code texted to the number on file.
Residency and addresses withheld: The AI concierge doesn't confirm who lives in the community or where. A guest pass is checked against the resident's own guest list, and the desk checks photo ID in person.
No card numbers by voice: The AI concierge doesn't take card numbers on the call. After verification it can text a secure payment link.
Every call on the record: Each call is transcribed and logged in the product, with the caller match and the steps the AI concierge took.

Data

What a deployment holds

Resident roster: names, units and contact details
Requests and work orders, with photos and notes
Call transcripts and summaries
Guest list, package log and amenity bookings
Board records, bids and approvals

What the AI concierge doesn’t ask for

Social Security numbers
Bank or routing numbers
Full card numbers or security codes
Medical details
Passwords, or sign-in codes for any other account

What the security review covers

Answered in writing for your deployment.

Encryption in transit: The reference architecture uses TLS in transit. We list each connection it covers.
Encryption at rest: The reference architecture uses a database encrypted at rest. The provider and its settings depend on where you are hosted.
Sign-in and two-step: Team and roles shows who has two-step sign-in set up. We confirm whether it is required for staff and the board on your deployment.
Backups and restore: How often backups run, how long they are kept and who can restore them.
Recordings and transcripts: Whether audio is kept, for how long, and where transcripts and summaries live.
Administrative access: Who at The AI Agency USA can reach your data, for what purpose and how that access is logged.
Incident response: The named contact, how we notify you and what the notice contains.
Hosting and data location: Which provider hosts each part of TowerLine AI for you, and in which region.
Data export and exit: What you can export, in which format, and what happens to your data when you leave.