Prospecting Copilot

Overview

A single-tenant B2B prospecting assistant for an insurance broker. Generates qualified US prospects daily, enriches them with C-suite contacts and recent news, and AI-drafts personalized 5-step email cadences. Operator copies drafts and sends from their own inbox.

Highlights

• On-demand prospect generation via Apollo.io (manual trigger, no cron)
• Bulk CSV import with duplicate detection
• Claude Sonnet 4.6 drafting 5-step cadences with tone fidelity
• News timeline per prospect (Tavily) — every email references something recent
• Pipeline tracking with send-by reminders + meeting notes
• Auto re-engagement cadences at Day +90

The problem

The SDR was building a prospect list in Excel, hand-checking news in 12 tabs, and ChatGPT-ing each email separately. Each prospect took 30+ minutes; voice consistency across emails was a coin flip; nothing tied news to outreach. The work was high-leverage but the execution was destroying her week.

Approach

1. 01Locked the architecture to a single user — auth surface stays minimal, sign-up is disabled at the provider level.
2. 02Built a tone system: writing-sample inputs train the prompt; cadence templates enforce per-step rules (peer-list parentheticals, lowercase subjects, no CTA on Step 3).
3. 03Wired Apollo for prospect + contact data, Tavily for news, Claude for drafting. Every external call writes to a usage_events audit table so cost and credit burn are visible.
4. 04Append-only audit tables (discovery_runs, usage_events, error_events) — no row is ever updated, so the timeline is provable.
5. 05All workflows user-triggered. No cron, no background queue. Cost predictability mattered more than automation theater.

Outcome

• 30+ minutes per prospect → ~10 minutes of review-and-send.
• Voice consistency moved from 'depends on the day' to 'matches her last 200 emails.'
• Apollo / Anthropic spend visible in a single dashboard — no surprise bills.

Security

• Per-IP and per-email sliding-window rate limiting on login (10 IP / 5 email failures over 15 min)
• Per-request CSP nonce middleware + HSTS + strict Permissions-Policy
• All inputs Zod-validated; all queries parameterized via Drizzle
• Failed-login + error events logged to dedicated audit tables
• Admin-only debug endpoints kept off the navigation

Stack