The Zero-Outbound Conversational Commerce Engine
for High-Velocity Enterprise Trade.
Automate wholesale bulk orders, customized client negotiations, and transaction intent structuring across WhatsApp, web apps, and enterprise APIs — without ever surrendering system database keys or modifying your regulatory security perimeter.
Enterprise Infrastructure · Independently VAPT-Audited · June 2026
Every other AI commerce tool demands your database keys.
We built an engine that demands none.
The Old Way
AI Chatbots Today
- Hand over live inventory API keys or database credentials to a third-party AI vendor
- Vendor servers make constant outbound calls to your pricing or stock database on every request
- AI can be tricked into approving 90% discounts or zero-amount orders via prompt injection
- A supply-chain breach at your AI vendor exposes your full database admin credentials
- Compliance teams veto integration when third-party key custody violates your security policy
- Manual WhatsApp order processing creates staff bottlenecks and missed bulk order opportunities
The Vulcan Way
Zero-Outbound AI
- You inject your live pricing and stock matrix per request turn — Vulcan reads it in memory, never stores it
- Zero outbound calls from Vulcan to your production environment, enforced at the architecture level
- Server-side math guardrail auto-blocks any quoted price that deviates more than ±2% from your injected context
- Vulcan physically cannot store or leak your database credentials — enforced in code, not policy
- Non-custodial architecture removes third-party key custody risk and keeps your security perimeter intact
- Sub-2-second automated order structuring with validated JSON intent output, available 24/7
Zero-outbound is not a feature. It's our foundational legal and commercial differentiator.
By refusing to accept, store, or request client database keys or pricing credentials, Vulcan eliminates its surface area as a supply-chain attack target, keeps your security perimeter intact, and removes third-party key custody liability from your compliance team's desk.
How Vulcan AI Works
A single stateless API call powers the entire conversational order flow. Your backend stays in control at every step. Vulcan AI provides the brain — you keep the keys.
You Inject Live Pricing & Inventory
On every chat turn, your backend sends your current SKU pricing and inventory constraints directly in the API request body. Vulcan reads it in-memory — zero latency, zero outbound calls, zero exposure of your internal ERP or pricing systems.
Vulcan AI Negotiates the Order
Our AI engine engages your customer in natural conversation, quotes prices using your injected pricing matrix, validates stock constraints, verifies KYC ceilings and daily limits, and structures the order intent — all autonomously, in seconds.
Your System Fulfills
Vulcan returns a clean, structured JSON order intent. Tier 1 enterprise backends fulfill autonomously. Tier 2/3 receive a GENERATE_INVOICE_INTENT for a human sales agent to action. Vulcan never touches inventory, funds, or execution credentials.
POST /v1/engine/chat · Stateless · JSON · No Webhooks · No Persistent Connections
Inbound Context Injection
One endpoint. One stateless call per turn. Your rates, your keys, your execution.
Per-Turn Pricing Injection
Your validationContext map must be included on every single request — including mid-conversation turns. Vulcan never caches it. No cache = no staleness = no manipulation window.
No Credentials Accepted
Your gateway key authenticates your vendor identity. Vulcan receives no ERP credentials, no database secrets, no internal admin keys — by API design.
Server-Side Math Verification
After every AI negotiation, Vulcan recomputes the expected order total from your injected pricing. If the AI-quoted gross total deviates by more than ±2%, the order is blocked before a response is returned.
Structured Intent Output
On order completion, you receive GENERATE_INVOICE_INTENT (Tier 2/3) or EXECUTE_TRANSACTION_INTENT (Tier 1). Your systems fulfill using your own locally-held execution credentials.
Critical Requirement
Omitting validationContexton any turn — even when the customer is just saying "yes" — returns HTTP 400 and breaks the conversational flow.
1POST https://api.vulcanai.com.ng/v1/engine/chat2Content-Type: application/json3x-vulcan-gateway-key: vk_live_your_secure_token_here45{6"vendorId": "distributor_corp_001",7"customerId": "wa_2348031234567",8"message": "I need 200 bags of Dangote cement 50kg, what's the price?",9"kycLevel": "Tier_2",10"dailyLimitRemaining": 500,11"validationContext": {12// Your live SKU pricing — injected EVERY turn, never cached13"cement_dangote_50kg": 8500,14"indomie_chicken_70g_carton": 6200,15"steel_rebar_12mm_tonne": 95000016}17}
Endpoint
POST /v1/engine/chat
Auth Header
x-vulcan-gateway-key
Response Always
HTTP 200 + reply + intent
Choose Your Deployment Model
Every tier runs on the same battle-tested engine. Your tier determines how trades are executed and how rates are sourced — not the quality of the AI.
TIER 3 — SELF-SERVE / WHATSAPP
Self-Serve SaaS
₦0
one-time + ₦5/turn + 0.5% / checkout
TIER 2 — WEBSITE / MOBILE APP
Native App
₦5,000,000
one-time + ₦1,500,000 / mo
TIER 1 — ENTERPRISE BACKEND
God Mode
₦10,000,000
one-time + ₦3,000,000 / mo
Feature
TIER 3 — SELF-SERVE / WHATSAPP
Self-Serve SaaS
TIER 2 — WEBSITE / MOBILE APP
Native App
TIER 1 — ENTERPRISE BACKEND
God Mode
Setup Fee
One-time
₦0
one-time
₦5,000,000
one-time
₦10,000,000
one-time
Monthly Retainer
Recurring
₦5/turn + 0.5% / checkout
₦1,500,000 / mo
₦3,000,000 / mo
Deployment Channel
Pricing Sourcing
AI Intent Output
Autonomous Fulfillment
Dev Infrastructure
KYC & Guardrails
Omnichannel DB Sync
Best For
No self-serve. No freemium. All onboarding is concierge-managed for quality control and contractual accountability. · Pricing in NGN.
Built for Risk Officers. Verified by VAPT.
Every security claim below is an architectural fact — not a marketing assertion — independently verified through a full SAST and penetration test audit completed June 2026.
Independent SAST/VAPT Audit — June 2026
5 vulnerabilities identified and patched across LLM Security, Auth, Cryptography & API Abuse vectors
Zero Key Custody
We physically lack the infrastructure to store your treasury keys. Our engine accepts no credentials, stores no credentials, and makes no outbound calls to your systems. A complete breach of Vulcan's infrastructure exposes zero client keys. Enforced in code, verified by audit.
Prompt Injection Guardrails
After every AI negotiation, a mandatory server-side validator recomputes the expected payout from your injected rate matrix. Any AI-quoted payout that deviates by more than ±2% is hard-blocked before the response is returned. An adversary cannot trick the AI into offering a higher rate — the math enforces reality.
CBN Compliance — No PSSP/MMO License Needed
Because Vulcan never routes Naira, crypto, or holds execution credentials, integrating our AI does not trigger PSSP or MMO licensing obligations for Vulcan. Your compliance posture is not complicated by our presence on your tech stack.
30-Day Chat Data TTL
All conversation sessions in Firestore are subject to a strict 30-day Time-To-Live automatic deletion policy. Server logs run through a five-pattern PII masking pipeline — redacting bank account numbers, EVM addresses, BTC addresses, and email addresses before reaching cloud dashboards.
Timing-Safe Authentication
All API key comparisons use Node.js crypto.timingSafeEqual() with fixed 128-byte padded buffers, eliminating timing-oracle side-channel attacks that would otherwise allow offline key recovery through response latency analysis.
Idempotent Intent Emission
Firestore-backed distributed transaction locking guarantees exactly one trade intent per negotiated trade — regardless of concurrent retries, network instability, or concurrent API calls from multiple server pods. Float-drift in AI-quoted values is eliminated by integer-cent key construction.
AES-256-GCM Encryption
12-byte random IV, 16-byte auth tag, 32-byte key validation. Authenticated encryption prevents silent data tampering.
Cross-Tenant Isolation
vendorId sourced exclusively from authenticated session — never from the request body. Structural isolation confirmed by audit.
Bi-Annual VAPT Cadence
Mandatory re-audit scheduled following any new AI model rollout or prompt engineering change.
Scale Your Enterprise. Keep Your Keys.
Stop losing bulk orders to slow manual replies. Stop risking your ERP with insecure chatbots. Our enterprise team manages every step of onboarding — from MSA signing to UAT and go-live. Most clients are live within days.
Contact Enterprise Sales
No demo forms. No automated funnels. You speak directly to the team that builds and operates Vulcan.
All onboarding is concierge-managed. No self-serve provisioning.