Compliance hub by role: where each persona starts
The Compliance group of these docs runs 184 pages deep: TCPA and quiet hours, GDPR and DSAR, HIPAA and the BAA, the EU AI Act, per-country sender rules, archival, and the evidence layer that proves all of it. The Compliance hub route map lists every console by task area, the route it opens, and who can reach it. This page does the other half of that job: it starts each reader on the subset of pages their role actually needs, in the order to read them.
Pick the persona that matches your seat, read its five pages in order, and treat everything else as reference you reach for when a send, an audit, or a regulator asks.
This page orients you in the docs; it is not legal advice. Which statutes apply to your traffic, and what posture is adequate, depends on where you and your recipients are and what you send. Confirm with qualified counsel.
The four personas and what each one needs
Compliance officer — regulator-facing posture and evidence
You answer for the posture and for proving it. You need the map of what is yours to control, the assembled evidence record, and the control mappings auditors ask for.
- Your tenant compliance posture — the toggle map of every control, its default, and the small set the platform does not let you switch.
- Evidence binder — where attestations, agreements, and audit exports assemble into one record.
- Trust center evidence pack — the shareable cut of that record for reviewers and customers.
- Audit ledger posture rollup — your posture over time, rolled up from the audit ledger.
- SOC 2 controls — the control-by-control mapping for SOC 2 reviewers.
You own the switches and the 3 a.m. rejection. You need the gate surface, the windows, the code-to-console routing, and the review queue.
- Send gates — which gate blocks which send, and the toggle that owns each gate.
- Quiet hours FAQ — recipient-local windows and the federal voice dialing window, in practice.
- Troubleshooting compliance error codes — route a rejected send’s code to the console that fixes it.
- Fraud review triage — work the review queue when Fraud Shield holds a send.
- Compliance health — the read-only signals that tell you the posture is doing what you set.
Legal / regulatory counsel — statute-mapped posture and country rules
You map statutes to controls and sign off on the per-country picture. You need the country directory, the consent and data-subject surfaces, and the customer-data posture pages.
- Country rules directory — the per-country ruleset directory your coverage is measured against.
- Consent management — how consent is captured, stored, and proven per recipient.
- DSAR — data-subject request intake, SLA tracking, and exports.
- Ten vs. educate customer data — the customer-data posture to pair with DSAR when a regulator asks what you told customers about their data.
- GDPR posture guide — the statute-to-control mapping for the EU and UK privacy block.
Developer / integrator — the API surface and the send-time decision chain
You integrate the sends and read the rejections. You need the API surface and the exact order the platform evaluates gates at send time.
- API reference — the endpoints your integration codes against.
- Send gate evaluation chain — the order gates and scrubs evaluate on an outbound send.
- Quiet hours preview — preview the window a send would land in before you send.
- Opt-out and suppression — suppression lists, keyword handling, and the bulk suppression surface.
- Troubleshooting compliance error codes — the code-to-cause mapping for rejected sends.
If you are X, read these five pages first
The shared posture invariant
Every page above describes tenant-owned controls. Compliance for your traffic is your responsibility; Orbit gives you the control surface, enforces what you set, and defaults open, so you decide what to enforce. The tenant-owned compliance model is the framing, and the posture overview is the map.
One asymmetric exception: the federal voice dialing window is the single platform-global hard guard. It is not tenant-toggleable, and it fails closed when a recipient’s timezone cannot be resolved. Everything else on this page defaults open until you configure it. When that guard blocks a call, the route map names the console and the posture page that owns the mitigation.
How this page relates to the route map
The route map is the index: every quick link, the route it opens, who can reach it, and the onboarding order for a new tenant. This page is the role-based entry path on top of that index. Start here to pick your five pages; use the route map to look up any console, role gate, or onboarding step this page does not cover. Both pages link to the same destinations deliberately. The route map stays the index; this page stays the starting point.
FAQ
Where do I start?
Match your seat to a persona above and read its five pages in order. If your job is configuring a brand-new tenant rather than reading for a role, follow the route map’s onboarding order instead; it sequences the controls so each one has the inputs the next needs.
How do I prove posture to an auditor?
Start from the evidence binder: it assembles attestations, executed agreements, and audit exports into the record you hand over. The trust center evidence pack is the shareable cut of it, the audit ledger posture rollup shows the posture held over time, and SOC 2 controls maps it for SOC 2 reviewers. The evidence consoles are gated to owners and admins, per the route map’s role table.
I need to satisfy both HIPAA and TCPA. Which page wins?
Neither, because the statutes govern different surfaces. HIPAA governs how you handle PHI; TCPA governs when and on what consent you contact people. Read both posture guides, HIPAA and TCPA, apply the stricter control wherever one send touches both (a voice call to a patient that carries PHI is the usual overlap), and keep each statute’s evidence in the binder as its own record. Which posture is adequate for your traffic is a counsel call, not a docs call.
See also
