Skip to main content

​
Compliance Glossary

The terms below are Orbit platform vocabulary — how these docs name a control, not legal definitions. Where a term names a statute or a registry, the entry points you to the owning page that explains how the platform behaves with respect to it; it does not interpret the law. Confirm your own obligations with qualified counsel. Alphabetical. Each entry ends with a link to the page that owns the term.

​
A/B/C attestation (level)

The STIR/SHAKEN grade a softswitch asserts on a call — A (full: the caller ID number belongs to your org through Orbit), B (partial: an external number you legitimately control, raised by a delegate certificate), C (gateway: Orbit cannot vouch for the caller ID). You never pick a level directly; the level follows from how the caller ID resolves. See Attestation & Caller Identity.

​
BAA (Business Associate Agreement)

The contract you execute with Devotel before HIPAA mode will enable — until it is on file, PHI sends are rejected fail-closed. The BAA drives the HIPAA posture end to end; nothing health-data-adjacent proceeds without it. See Business Associate Agreement (BAA) flow.

​
Campaign fallback window (quiet hours)

The secondary quiet-hours setting for drip and journey campaigns: when a campaign has no window of its own, it inherits this fallback instead of the platform default 21:00–09:00 recipient-local. Configured per organization in Settings → Campaign limits. See Quiet hours configuration.

​
Delegate certificate

A certificate you register for a caller ID your org legitimately controls but does not own through Orbit, raising its STIR/SHAKEN attestation from C to B — never to A; full attestation is reserved for numbers owned on the platform. See STIR/SHAKEN attestation.

​
DLT (Distributed Ledger Telecom, India)

India’s carrier-side regulatory registration regime for A2P messaging: a brand (entity) registers with the DLT network operators, then headers and templates are whitelisted before a message may carry them. Unregistered traffic is dropped by the carriers, not by Orbit. See DLT-India Onboarding.

​
DNC (Do-Not-Call)

The US FTC National Do-Not-Call Registry — a list of numbers a telemarketer must not call. Orbit’s scrub is opt-in and fail-open: enabling it makes /compliance/dnc/check return status for your dialing decisions, billed per check as part of your RND/DNC bundle. See DNC Scrubbing.

​
DNO (Do-Not-Originate)

Caller IDs that must never be used to originate calls — Orbit’s caller-ID blocking surface that reject-drops outbound attempts on DNO-listed numbers, protecting both your brand and the carrier’s block lists. See Do-Not-Originate (DNO) Caller-ID Blocking. A two-step consent handshake: the contact submits consent, receives a channel verification challenge, and the confirmation is what records the consent entry. The confirmed handshake hardens your consent ledger against forged signup claims. See Confirmed Consent (Double Opt-In) Handshakes.

​
DSAR (Data Subject Access Request)

A data subject’s right-of-access request (GDPR Art. 15 and its state-law cousins): intake, SLA tracking, packaging, and deletion of the request, on the operator surface or the public portal you choose to link. See Data Subject Access Requests (DSAR).

​
Fail-closed

The control blocks the traffic when its inputs cannot be resolved — a deliberate conservative posture, used where the risk of a missed block outweighs a held send (HIPAA mode, sender-ID-required countries, the TCPA federal voice window, the suppression layer, the country allowlist once set). See the full per-surface table in Posture Overview.

​
Fail-open

The control passes the traffic when its inputs cannot be resolved — the default for all tenant-toggleable compliance gates: quiet hours, DNC/RND scrubs, attestation lookups, country allowlists while empty. Defaults open; you tighten from open. See Posture Overview.

​
KYC profile (Know-Your-Customer) / document / destination triangle

The identity model behind regulated markets: reusable documents you upload once, a compliance profile — the dossier of documents you assemble — and gated destinations (a regulated-country number, a 10DLC sender) that require an approved profile before they activate. One aspect of the triangle exists on no page; all three meet in the KYC identity model. See The KYC identity model and KYC Documents.

​
Lawful basis (GDPR)

The GDPR Art. 6 justification recorded on a consent entry — consent, contract, legitimate interest, or the other grounds. Unknown-consent marketing refuses unless you file a justification and a lawful basis, and the choice lands in the audit log. See Consent Management.

​
Mini-TCPA overlay (state calling windows)

A US state statute narrower than the federal dial window: Florida’s Sunday ban, Mississippi’s 7:30 PM close, the Oklahoma/Louisiana/Alabama/West Virginia overlays, and the rest of the seven-state set. It intersects with the federal window on most-restrictive-wins, carries no tenant toggle, and blocks outside_state_window or state_blocked_day. See US Calling Windows — Federal TCPA + State Overlays.

​
Penalty-bridge terms (mini-TCPA)

Safe-harbor vocabulary a mini-TCPA state shares with the federal statute — for instance the RND safe harbor a reassigned call may claim. Where a state statute bridges a federal safe harbor, the docs name the specific state and the specific federal anchor it bridges, not a blanket mini-TCPA label. See US Calling Windows — Federal TCPA + State Overlays.

​
PHI-adjacent audience

An audience designation for traffic that may touch Protected Health Information — tele-pharmacy, home-health, provider lists — so the PHI gate screens it before a HIPAA-mode send. Designated on the audience or the contact so the right fail-closed posture applies. See PHI-adjacent audience designations.

​
Platform default window (quiet hours)

The 21:00–09:00 recipient-local window Orbit applies when neither the org gate nor the campaign fallback window is set. Assumed rather than asserted; always tighten it explicitly rather than inherit it. See Quiet hours configuration.

​
Restricted industry

An industry a messaging carrier or regulator refuses or hard-publishes — related to the restricted USE in sms_restricted and the no-fly industries carriers enforce off their content scanners. Registration paths exist for most; a prohibited industry never sends. See Restricted & Prohibited Industries.

​
RND (Reassigned Numbers Database)

The FCC’s list of phone numbers whose ownership changed — checking it tells you whether the consent you hold for a number is still for the same person. Verdicts degrade to no_data until you connect the FCC feed, and the safe-harbor read that informs whether you may call reads back only on connected data. See RND Scrub.

​
RMD (Robocall Mitigation Database)

The FCC filing that proves your voice service provider met the robocall mitigation mandate — identity, mitigation plan, submitted on a lifecycle of submit → certify → remediate → resolve (or withdraw). The register, not a send gate. See Robocall Mitigation Database (RMD): Filing Lifecycle.

​
Scope all vs. per-channel scope (suppression)

The breadth of a suppression entry: scope all holds the entry across voice, SMS, dialer, and messaging; a per-channel scope (sms, email) gates only that channel. Scope decides breadth, not strictness — phone rows default to all on bulk import so a phone opt-out gates voice too. See Opt-Out & Suppression Lists. Two registers the gates read in opposite directions: the suppression ledger removes — a send is rejected whenever a suppression entry exists — and the consent ledger permits — a send proceeds under the consent defaults when its row exists, and a missing row is judged by the consent default policy. The suppression ledger always wins over the consent ledger. See Opt-Out & Suppression Lists and Consent Management.

​
TCR / 10DLC (The Campaign Registry / US A2P long-code SMS)

The US carrier registration regime for application-to-person long-code SMS: your brand registers first, your campaigns register second, both against The Campaign Registry (TCR), and unregistered traffic underperforms against every other control you set. Registration is the carrier-side requirement an A2P program cannot skip. See 10DLC Brand & Campaign Profiles and the 10DLC registration guide.

​
Tenant-owned control

A compliance control your organization owns end to end: you decide the posture, Orbit enforces what you set and holds the decision in the audit log. Everything is tenant-owned except the handful of hard asymmetries the posture map lists (federal voice window, state mini-TCPA overlays, emergency-stop scope, delegate-certificate A ceiling). See Posture Overview.

​
TFV (Toll-Free Verification)

The dedicated verification surface for US toll-free SMS senders — a registration path parallel to 10DLC for the traffic a toll-free number carries. One sender’s traffic decides the regime: a long code cannot pass through TFV, a toll-free number does not register on 10DLC. See 10DLC Brand & Campaign Profiles — US-market interplay and the Toll-Free Verification guide.
Alphabetical above, map first: the Posture Overview page both defines the platform posture terms in prose and maps every control they name. When a deep page says a term again, update this index rather than redefining it inline.