New Website

Path: Callproof Support - New Website

CallProof New Web — Application Overview

CallProof New Web is a multi-tenant SaaS CRM for field sales teams. It combines account and contact management, Twilio calling and SMS, email, GPS and maps, appointments and tasks, sales opportunities, reporting, gamification, and admin tooling. The web app works alongside CallProof Android and iOS apps.

Core stack

• Python 3.12
• Django 5.2.3
• PostgreSQL via psycopg2-binary 2.9.10
• Apache2 with mod-wsgi 5.0.2
• Static and media under callproof-static
• No package.json or Pipfile — frontend libraries are vendored under callproof-static or loaded from CDN

Technology stack

Backend

• Django 5.2.3
• Python 3.12
• PostgreSQL
• mod-wsgi

Security mechanisms

Security Area	Mechanism	Description
Authentication & Access	Django auth.User + UserProfile	Uses Django's built-in authentication system with an extended UserProfile model to manage user accounts, company associations, roles, and additional profile information.
Authentication & Access	Complex Password Rules	Enforces password complexity requirements such as minimum length, uppercase and lowercase letters, numbers, and special characters where configured.
Authentication & Access	cp_login_required	Ensures users are authenticated and belong to an active company before accessing protected pages.
Authentication & Access	manager_required and Resource Decorators	Restricts access to manager-only features and validates user permissions for protected resources and administrative functions.
Authentication & Access	Single Browser Login	Optionally restricts users to a single active browser session per company to improve account security.
Authentication & Access	Company Two-Factor Authentication (2FA)	Supports optional company-wide two-factor authentication using the pyotp library for one-time password verification.
Authentication & Access	Permission-Based Feature Access	Controls access to features such as SMS, Call History, Phone Numbers, and other modules using menu permissions and feature flags.
Session & CSRF	Django Sessions	Maintains authenticated user sessions securely using Django's session framework.
Session & CSRF	CSRF Protection	Uses Django CSRF middleware with trusted origin validation to prevent Cross-Site Request Forgery attacks.
Session & CSRF	SameSite Cookie Handling	Configures SameSite cookie behaviour with additional handling for mobile (/m/) application paths where required.
Session & CSRF	X-Frame-Options	Prevents clickjacking attacks by controlling whether application pages can be embedded inside frames or iframes.
SSO & Social Login	SAML 2.0 with Duo IdP	Supports enterprise Single Sign-On (SSO) using SAML 2.0 with Duo Identity Provider, including Assertion Consumer Service (ACS), metadata exchange, and Single Logout (SLO).
SSO & Social Login	OAuth Authentication	Supports authentication through Google, Microsoft, and Apple OAuth providers.
Encryption & Secrets	AES Encryption	Encrypts sensitive email credentials and API-related secrets using AES encryption before storage.
Encryption & Secrets	CryptoJS	Encrypts selected client-side values stored in browser localStorage using CryptoJS.
Encryption & Secrets	AWS KMS	Uses AWS Key Management Service (KMS) to protect S3 objects when server-side encryption is enabled.
Encryption & Secrets	Environment-Based Secrets	Stores sensitive configuration such as API keys, passwords, and encryption keys in environment variables loaded through dotenv.
API Security	API Key Authentication	Authenticates API requests using API keys and shared secrets.
API Security	Role-Based API Access	Restricts API operations according to user roles and assigned permissions.
API Security	API Request Logging	Logs API requests while sanitising sensitive payload information to reduce exposure of confidential data.
Operational Security	Login Failure Throttling	Limits repeated failed login attempts using cache-based throttling to reduce brute-force attacks.
Operational Security	Account & Company Status Checks	Prevents access for disabled user accounts or suspended companies.
Operational Security	User Impersonation	Supports administrator or support impersonation using the old_user_id session value while preserving the original user identity.
Operational Security	Google reCAPTCHA	Supports Google reCAPTCHA on selected forms to reduce automated bot submissions where enabled.

Performance optimizations

• Django cache used for login attempts, filter options, and selected lookups
• Default cache is LocMem unless production overrides it; shared Redis is not configured in checked-in settings
• PaginationMixin with configurable rows per page across list screens
• AJAX partial HTML and JSON responses to avoid full page reloads
• ORM use of select_related, prefetch_related, and only where implemented
• sorl-thumbnail for resized images such as logos and avatars
• Session-stored filter state for heavy list screens
• Specialized static routes for recordings, greetings, and user files

Scalability

• Company-based multi-tenancy supports many isolated customers on one application
• Apache and mod-wsgi multi-process hosting
• AWS S3 for media, files, and email mailbox storage
• AWS SQS for asynchronous workers
• Twilio for telephony and SMS capacity
• Firebase for push delivery to mobile and web clients
• Background export and scheduled report pipelines so large jobs do not block the request thread
• Multiple deploy environments such as apptest, staging, UAT, and production via CodeDeploy

Notable implementation details

• Thin views with service and utility layers in helper, cplib, and app services
• Mostly class-based views, with some function-based views and decorators still in use
• Soft deletes and hide flags on many domain models
• People Tab switches Contacts vs Accounts wording and enables personnel and Roles
• CallProof Voice section appears only when company Twilio is enabled
• System report mail under /mail/ is separate from synced personal email under /em/
• Logging uses rotating app logs plus console and domain-specific loggers

Deployment and operations

• Deployed with Apache and mod-wsgi
• Assets served from callproof-static
• Media and specialized recording paths under configured static or media URLs
• Environment variables drive database, Twilio, SendGrid, AWS, OAuth, SAML, maps, and billing configuration
• CodeDeploy supports multiple environments

Summary

• CallProof New Web is a Django 5.2 and Python 3.12 multi-tenant field-sales CRM on PostgreSQL
• Integrates Twilio, SendGrid, Google and Microsoft services, AWS, Firebase, and Duo SAML
• Security centers on company-scoped access, CSRF, optional 2FA, encrypted secrets, and SSO
• Performance and scale rely on pagination, AJAX partials, caching, S3, SQS workers, and background exports

Login

Use this screen to sign in to CallProof with your email and password, or with Google, Microsoft, or Outlook. The Login screen lets you securely access your CallProof account so you can use contacts, calls, events, reports, and other features for your company.

From this screen you can also:

Reset a forgotten password Create a new account Sign in with Google, Microsoft, or Outlook Enter a verification code when your company requires extra security

More Info: Login

Login

Signup

Use this screen to create a new CallProof account for your company. The Signup screen lets you register as a new member so you can start using contacts, calls, events, reports, and other CallProof features.

From this screen you can also:

• Sign up with your company and contact details
• Continue with Google, Microsoft, or Outlook
• Go back to Sign in if you already have an account

More Info: Signup

Signup

Dashboard (New Web)

Home screen after login. Shows sales activity at a glance: KPI counts, recent events, a map of rep locations, and an opportunity leaderboard. Navigation Sidebar CallProof / home icon → Dashboard. Route name: dash_index. Common landing page after login and a common redirect when access is denied elsewhere. Access Login required. Available to all logged-in company users. Not manager-only. If Terms of Service are not accepted, users are redirected to /tos/ first.

More Info: Dashboard (New Web)

Dashboard

Communication Menu

Where it lives Sidebar phone icon → Communication. The Communication submenu fills dynamically from the company menu. What Communication is for Make calls, send texts, manage recorded voicemails, review call history, maintain Do Not Call lists, and choose which Event Form appears after a call.

Communication Menu

More Info: Communication Menu

People Menu

The People submenu fills dynamically from the company menu. In code, the main list still uses /contacts/ even when the UI says Accounts. What People is for Manage accounts or contacts, build visit routes, and find and merge duplicate records. Related items such as Roles, Companies, Contact Types, and Imports may also appear depending on company settings.

People Menu

More Info: People Menu

Sales Menu

Where it lives Sidebar → Sales. The Sales submenu fills dynamically from the company menu. In code the app and URLs use funnel (for example /funnel/...), but the product labels are Sales and Opportunities. What Sales is for Manage the opportunity pipeline: create and move deals through stages, categorize by type, add opportunity-specific fields, review and export opportunity reports, set dollar or points goals, and define achievement badges tied to the points system.

Sales Menu

More Info: Sales Menu

Report Menu

Where it lives Sidebar → Reports. The Reports submenu fills dynamically from the company menu. In the menu API these items sit under the dashboard group, but they render in the Reports sidebar panel. What Reports is for Review field activity, productivity, appointments, tasks, notes, and rankings. Run scheduled or one-off company reports. Download finished files from My Exports. Some items are full working screens (Appointments, Tasks); others are report or stats views.

Reports Menu

More Info: Report Menu

Settings Menu

The remaining configuration screens allow administrators to customize how CallProof captures business data, organizes accounts and users, manages territories, and configures calling features. These settings include creating custom Event Forms for visit reporting, adding Custom Fields to contacts and opportunities, defining Account Types, Job Titles, Contact Roles, Markets, Territories, and Regions, as well as configuring CallProof Voice features such as Caller ID verification, Twilio phone numbers, Call Result options, Call Overrides, and Auto Text rules. The Info section provides access to the latest product updates through the What's New page. Most of these screens are intended for managers or administrators, and their availability depends on user permissions, company feature flags (such as Twilio or the People tab), and menu customizations. Menu items are loaded dynamically through the NewUIMenuURL configuration using the HomeMenuView.

Settings Menu

More Info: Settings Menu

Support Menu

Support → Submit Support Request. Does not leave the current page. URL: GET and POST /support/ Any logged-in user can use it if the menu item is visible.

What it does Opens a form to describe a problem or question. On submit, CallProof sends an email to the support team. No support ticket is stored in the database — it is email only. Success message: Support Request Sent Successfully.

Form fields Category — required. Choose from support categories (ordered list). Description of Problem or Question — required. Free-text details. Please Contact Me — required. Email, Phone, or Do not contact. Phone Number — shown and required when Phone is selected. Prefills your default phone. Email — shown and required when Email is selected. Prefills your user email.

Support Menu

More Info: Support Menu

Personnel Settings Menu

Where it lives Bottom sidebar icon (Personal Settings). Opens the Personal Settings panel. Shows CallProof logo, personal options, your company name, and Sign out. What Personal Settings is for Manage your own profile and integrations: report subscriptions, profile photo, time zone, linked email accounts, and calendar sync. This is per-user, not company Home → Settings → Customizations.

Personnel Settings Menu

More Info: Personnel Settings Menu

Sign out

Where it lives Personal Settings panel → Sign out. Also available from other session menus that call the same logout action. Tools sidebar may link directly to /logout/. URL /logout/ Purpose End your CallProof web session securely and return to the login screen. Clears local client data and, when Duo SSO was used, can also log you out of the identity provider. Access Available to any logged-in user. Not manager-only. How it opens Click Sign out under Personal Settings. The app calls GET /logout/ by AJAX, shows a success toast, then redirects. What happens when you sign out

Server ends the Django session. Clears browser login tracking on your user profile when this was the active browser session. Logs a web logout event. Duo SSO users get a Cisco Duo logout event instead. Saves a location log for logout when latitude and longitude are available. Clears device push fields used for notifications on that profile. Removes the current session device log row. Client clears IndexedDB and local storage keys such as locations and placeResponse. Shows toast: Logout Successful. Redirects to / or /login/, or to Duo single logout when SSO applies. SSO / Duo logout If you signed in with Duo SSO, logout may redirect to Duo single logout first, then return to the CallProof login page. Related endpoint: /saml2/sls/ handles Duo’s logout response and finishes clearing the local session. If SSO logout fails, CallProof falls back to local logout only.

Example use cases End of day — Sign out so no one else can use your open browser session. Shared computer — Sign out before leaving the desk. SSO user — Sign out of CallProof and Duo together when company SSO is enabled.

Related session behavior If your company limits one active browser login, logging in elsewhere can end the old session. That is separate from clicking Sign out, but the result is similar: you must log in again.

Sign out

More Info: Sign out