> ## Documentation Index
> Fetch the complete documentation index at: https://docs.orbit.devotel.io/llms.txt
> Use this file to discover all available pages before exploring further.
# Your Tenant Compliance Posture: The Toggle Map
> The one-page concept map of Orbit's compliance controls — which surfaces are tenant-toggleable, what defaults open, what is fail-open versus fail-closed, and three reference postures you can copy.
# Your Tenant Compliance Posture: The Toggle Map
The Compliance group in these docs is deep on individual surfaces —
send gates, quiet hours, DNC, RND, STIR/SHAKEN, HIPAA, DSAR, opt-out,
Sender-ID registration, KYC documents. This page is the map across all
of them: which controls are yours to switch, where each switch lives,
what the out-of-box default is, and the small set of surfaces the
platform deliberately does not let you toggle. Read this once, then
dive into the one or two deep pages your posture actually touches.
This page describes Orbit's platform controls. It is **not legal
advice.** Which laws apply to your traffic, and what posture is
adequate, depends on where you and your recipients are and what you
send. Confirm with qualified counsel.
***
## The platform posture
Orbit's compliance model has three commitments, and everything on the
map below hangs off them:
1. **Controls are tenant-owned.** Compliance for your traffic is your
responsibility. Orbit gives you the control surface — gates, windows,
scrubs, registries, policy knobs — and enforces what you set. It does
not mandate a posture for you, and it does not decide that a send is
"compliant." Several deep pages state this on their own surfaces
([STIR/SHAKEN](/channels/voice/stir-shaken),
[SCIM](/compliance/scim-provisioning),
[KYC documents](/compliance/documents-kyc),
[CPNI](/compliance/cpni)); this page is the statement for the group
as a whole.
2. **Everything defaults open.** Except for the hard asymmetries listed
in [What is not tenant-toggleable](#what-is-not-tenant-toggleable),
every gate ships **off / open**: a new tenant's sends are not held by
quiet hours, not scrubbed against DNC or RND, and not blocked by an
attestation floor, until you opt in. Where input can't be resolved —
a recipient timezone outside the US, an attestation lookup that
errors — these controls **fail open** rather than blocking traffic.
The posture you choose is additive: you tighten from an open default,
you don't loosen from a restrictive one.
3. **Orbit is the conduit and the ledger, not the compliance owner.**
Orbit carries your sends to the carriers, enforces the gates you set,
and keeps the auditable record — consent decisions, suppression
entries, certifications, traceback cases, scrub results. It never
files with a regulator for you, never sends a customer notice for
you, and never invents or auto-renews an identity document. The
ledger reflects what you did; the decisions stay yours.
***
## The posture map
One row per surface: where the toggle lives, how it defaults, how it
behaves when inputs can't be resolved, and the deep page to read before
you flip it.
| Surface | Toggle location | Default | Fail-open or fail-closed | Deep page |
| -------------------------------------------- | -------------------------------------------------------------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------- | --------------------------------------------------------------- |
| **Quiet hours — per-channel org gate** | `settings → quiet_hours..enabled` via `PUT /api/v1/settings/general`; dashboard org settings | Off per channel; no sends held | Fail-open — timezone-unresolved non-US recipients pass under the default `skip` policy (voice to US recipients is the exception) | [Quiet hours configuration](/guides/quiet-hours-configuration) |
| **Campaign fallback quiet-hours window** | `PUT /api/v1/campaigns/quiet-hours/settings`; Settings → Campaign limits | Off; drip/journey sends use the platform default 21:00–09:00 | Fail-open — an unset fallback simply inherits the platform window | [Quiet hours configuration](/guides/quiet-hours-configuration) |
| **DNC scrub** | Org setting `dnc_sync_enabled`; `GET /compliance/dnc/check` to query | Off — returns `403 DNC_SYNC_NOT_ENABLED` until opted in | Fail-open — while no federal feed is synced a number only on the FTC list reads back clear | [DNC Scrubbing](/compliance/dnc-scrub) |
| **RND (Reassigned Numbers) scrub** | `PUT /compliance/rnd/settings` | Off — returns `403 RND_SCRUB_NOT_ENABLED`; enabling is refused with `409` until the FCC feed is connected | Fail-open / no-data — until the feed is synced every verdict degrades to `no_data`, no safe harbor claimed | [Send Gates](/compliance/send-gates) |
| **RMD (Robocall Mitigation) filing** | `GET`/`POST /compliance/rmd` and its lifecycle endpoints | Nothing filed — a record you create, not a gate | Neither — it is a register, not a send-time check (the opt-in call-time guard is off by default) | [RMD Registration](/compliance/rmd-registration) |
| **Emergency stop (org-wide kill switch)** | `POST /compliance/emergency-stop/activate` and `/deactivate`; admin/owner | Inactive | Fail-open by design — inactive until you pull it; while active it blocks outbound SMS, MMS, voice, and dialer traffic | [Send Gates](/compliance/send-gates) |
| **Sender-ID registration** | `POST /compliance/sender-id-registrations` | Nothing registered | **Fail-closed** — A2P SMS to a country requiring a registered Sender ID is blocked until that country's entry is `approved` | [Sender-ID Registration](/compliance/sender-id-registration) |
| **Opt-out / suppression** | STOP keywords, Consent API, preference center, CSV bulk import | Empty list — nothing suppressed | **Fail-closed for entries that exist** — a suppressed address is dropped before dispatch, regardless of entry point | [Opt-Out & Suppression Lists](/compliance/opt-out-suppression) |
| **Suppression scopes** | The `channel` column on bulk import; scope `all` from STOP / Consent / preference center | Phone rows default to scope `all`; email rows to `email` | Scope decides breadth, not strictness — an `all`-scope entry gates voice and dialer too | [Opt-Out & Suppression Lists](/compliance/opt-out-suppression) |
| **US state calling-window overlays** | Not toggleable — the mini-TCPA overlays (FL, MS, OK, LA, AL, AR, WV) intersect with the federal window automatically | Active for campaign/dialer voice to covered states | **Fail-closed** — most-restrictive-wins; a stricter state window or day ban blocks | [What is not tenant-toggleable](#what-is-not-tenant-toggleable) |
| **STIR/SHAKEN outbound attestation level** | Implicit — from number ownership, lease, and delegate certificates; no on/off switch | C (gateway) unless the caller ID resolves to your org | Fail-open — a failed ownership lookup signals C rather than blocking the call | [STIR/SHAKEN](/channels/voice/stir-shaken) |
| **Inbound attestation floor per DID** | Minimum-attestation policy on each DID | No floor — every call admitted | Fail-open — with no policy set, nothing is rejected | [STIR/SHAKEN](/channels/voice/stir-shaken) |
| **HIPAA mode** | `PUT /api/v1/settings/hipaa`; Settings → Compliance | Off; `baa_status: not_required` | **Fail-closed toward PHI** — HIPAA mode won't enable and PHI sends are rejected with `422 HIPAA_BAA_REQUIRED` until the BAA is executed | [HIPAA](/compliance/hipaa) |
| **DSAR pipeline (operator + public portal)** | `POST /compliance/dsar` (operator); the public portal is a flow you choose to link | No requests in flight — intake is demand-driven | Neither — intake only; the SLA clock is what runs | [DSAR](/compliance/dsar) |
| **Preference center** | `POST /compliance/preference-center`, then per-contact signed links | Not configured — no public page exists until you create it | Fail-open — absent a config, no contact-facing surface exists | [Send Gates](/compliance/send-gates) |
| **KYC documents & compliance profiles** | `POST /compliance/documents`, `…/compliance-profiles/*` | No profiles — none required until you buy numbers or register senders in regulated markets | **Fail-closed for gated assets** — a number in a regulated country idles at `pending_compliance` until a profile satisfies it | [KYC Documents](/compliance/documents-kyc) |
Two adjacent surfaces are **read-only, not toggles**: the org-wide
[compliance-health scores](#read-the-signals-dont-guess) and the
quiet-hours [preview endpoint](/compliance/send-gates). They report
your posture; they never change it.
***
## Three reference postures
Copy the posture closest to your traffic, then adjust. Each lists
exactly which toggles to flip and which deep page documents the write.
### Posture A — US marketing SMS operator
You send A2P marketing SMS to US recipients under TCPA.
1. **Quiet hours:** enable the `sms` channel on the org gate. Platform
hours 08:00–21:00 recipient-local apply immediately; keep
`consent_overrides_quiet_hours: true` (the default) so permitted
recipients stay reachable inside the window. See
[Quiet hours configuration](/guides/quiet-hours-configuration).
2. **Campaign fallback window:** set it in Settings → Campaign limits
(or `PUT /campaigns/quiet-hours/settings`) if your drip sends should
use a tighter window than the platform default.
3. **DNC scrub:** turn on `dnc_sync_enabled` so `/compliance/dnc/check`
and the suppression feed back your dialing decisions. Plan around
the documented caveat: until a federal snapshot is synced, a number
only on the FTC list reads back clear. See
[Send Gates](/compliance/send-gates).
4. **Suppression:** bulk-import any legacy opt-out list via
`POST /compliance/suppression-list/import` before your first send;
phone rows default to scope `all`, which also gates voice.
5. **Sender ID / 10DLC:** complete your brand and campaign registration
([10DLC guide](/guides/10dlc-registration)) — US long-code traffic
without it degrades regardless of these gates.
6. **Emergency stop:** know where it is before you need it —
`POST /compliance/emergency-stop/activate` halts all outbound SMS,
MMS, voice, and dialer traffic in one call.
7. Leave RND off unless you operate a re-consent program that needs the
§ 227 safe harbor reads.
### Posture B — EU GDPR + APAC drip operator
You run drip campaigns to EU/APAC recipients under GDPR and local
marketing rules. The full end-to-end walkthrough of this posture is
[Assembling a GDPR Posture End to End](/compliance/gdpr-posture-guide);
the steps below are the map-level summary.
1. **Campaign fallback window:** set your local regime in Settings →
Campaign limits (e.g. 22:00 → 07:00) so every drip or journey that
lacks its own window sends inside it. This is the single highest-
value toggle for this posture.
2. **Org gate per channel** if you also want 1:1 traffic held —
enable per channel with your own `start_hour` / `end_hour`.
3. **Consent records:** file per-channel consent through
`POST /compliance/consent` before campaign sends, with the GDPR
lawful basis recorded. Consent coverage is 30% of the
[compliance-health score](/compliance/compliance-health), and
carriers read it.
4. **DSAR:** decide your intake path — operator-filed through
`POST /compliance/dsar`, the public self-service portal behind your
privacy-policy link, or both. The SLA tracker applies per
jurisdiction (`gdpr` 30 days, `pdpa` 30, `lgpd` 15).
5. **Processing register:** document your Art.30 activities and run
Art.35 DPIAs in the [privacy register](/compliance/privacy-register)
if your processing is high-risk.
6. **Preference center:** configure one and sign per-contact links so
GDPR delete/consent requests arrive structured instead of as support
tickets.
### Posture C — US voice dialer operator
You run outbound voice campaigns and ad-hoc dialing to US recipients.
1. **Accept the hard rails first.** Campaign and dialer voice outside
the 8 AM–9 PM recipient-local federal window is always blocked
(`422 TCPA_FEDERAL_DIALING_WINDOW_BLOCKED`), a timezone-unresolved US
recipient is blocked fail-closed, and stricter state overlays
(Florida's Sunday ban, Oklahoma/Mississippi windows, and the other
mini-TCPA states) sit on top. No toggle relaxes any of this — see
[What is not tenant-toggleable](#what-is-not-tenant-toggleable).
2. **Ad-hoc 1:1 dialing:** decide whether the dashboard soft-dials stay
advisory (the default) or become hard holds — enable the `voice`
channel on the org gate for the latter.
3. **Suppression:** phone-scoped opt-outs gate voice and dialer
traffic; import your DNC list and wire STOP handling before the
first campaign.
4. **STIR/SHAKEN:** run your traffic from numbers your org owns — the
only path to full (A) attestation. Register delegate certificates
for external caller IDs you legitimately control to raise them C → B,
and set the attestation policy plus the inbound floor per DID. All in
[STIR/SHAKEN](/channels/voice/stir-shaken).
5. **RMD:** create and submit your Robocall Mitigation Database filing
through `POST /compliance/rmd` before originating voice; keep the
recertification deadline on your calendar. The full lifecycle —
submit, certify, remediate, resolve, withdraw, and the opt-in
call-time guard — is in [RMD Registration](/compliance/rmd-registration).
6. **Emergency stop:** the same kill switch covers voice — one call
halts dialer traffic mid-incident.
***
## What is not tenant-toggleable
A short list, on purpose. These are the surfaces where an open default
or a tenant opt-out would be wrong — either the statute forbids it, or
the control exists to protect the recipient and the platform alike.
* **Campaign and dialer voice federal window.** The TCPA 8 AM–9 PM
recipient-local dialing window (47 U.S.C. § 227(b)(1)(B)) hard-blocks
all automated and bulk outbound voice to US (+1) recipients, and
**accepts no tenant toggle**: no per-organization bypass, no
`start_hour`/`end_hour` knob on the federal window, no fail-open on a
timezone-unresolved recipient. Ad-hoc 1:1 dashboard dialing is
advisory-unless-enabled (a tenant control — flip `voice` on the org
gate to harden it); the campaign/dialer path never is. Carriers and
the statute assess $500–$1,500 per violating call, so the rail is
platform-level. See the US-voice note in
[Send Gates](/compliance/send-gates) and the enforcement table in
[Quiet hours configuration](/guides/quiet-hours-configuration).
* **State mini-TCPA overlays.** Stricter state windows and day bans
(Florida's Sunday prohibition, Mississippi's 7:30 PM close,
Oklahoma/Louisiana/Alabama/West Virginia overlays) intersect with the
federal window on the most-restrictive-wins rule. They carry no
tenant toggle either — a state statutory window is not yours to
relax. Block reasons surface as `outside_state_window` or
`state_blocked_day` so you can separate state-driven holds from
federal ones in reporting.
* **Emergency-stop scope.** The kill switch is defined by what it
halts — outbound SMS, MMS, voice, and dialer campaign traffic. Its
carve-out is fixed, not configurable: transactional **Verify/OTP**
sends and email are never gated by it, because a login code must
still reach a contact mid-incident. You cannot widen the stop to
those paths through the switch — if you need them paused, disable the
Verify profile or email sender directly. See
[Send Gates → Emergency stop](/compliance/send-gates).
* **The delegate-certificate A ceiling.** A delegate certificate raises
an external number from C to **B only — never to A**. A attestation is
reserved for numbers owned through Orbit, and this ceiling is
deliberately not a setting: treating a self-registered artifact as
full attestation would let anyone spoof it for arbitrary numbers. See
[STIR/SHAKEN](/channels/voice/stir-shaken).
* **Wholesale signing authority.** Orbit signals the attestation level;
the Devotel-operated softswitch signs the PASSporT on-net, and it
will never sign higher than what the platform attests. There is no
tenant-side "sign at A anyway."
Nothing else on this surface is platform-mandated. The absence of a
fourth hard rail is the point of the posture model: defaults open,
tenant-owned, with these documented asymmetries.
***
## Read the signals, don't guess
Two read-only surfaces report the posture you actually have — use them
before and after you change a toggle, not as a substitute for one.
* **Compliance health** (`GET /compliance/health`, plus
`/health/numbers` and `/health/campaigns`) blends consent coverage,
opt-out velocity, STOP-reply rate, and carrier rejections into a
0–100 score per organization, sender, and campaign, with a
`warnings` array of ranked fixes. It never blocks a send; it tells
you which sender is about to be throttled before the traffic
degrades. Start with the list endpoints — they order worst first.
See [Compliance Health Scores](/compliance/compliance-health).
* **Quiet-hours preview** (`GET /compliance/quiet-hours/preview`)
answers "would this send, to this recipient, be held right now — and
if so until when?" with the resolved window and `next_allowed_at`.
Check it before a rollout, and use it to schedule around a window
rather than retrying into it. See
[Send Gates](/compliance/send-gates).
Read the health score and the preview together with the map above:
the map tells you which switch to flip, the signals tell you whether
the flip did what you intended.
***
## Related references
* [Compliance Posture FAQ](/compliance/posture-faq) — the operator
questions behind the map: why an enabled toggle may not be blocking
yet, which controls fail open versus closed, and which approvals
carry external lead time.
* [Configure Your Tenant's Posture Before the First Send](/compliance/tenant-posture-first-run) —
the guided runbook: this map's toggles flipped in day-one order,
with defaults and consequences for each.
* [Assembling a GDPR Posture End to End](/compliance/gdpr-posture-guide) —
the full walkthrough behind Posture B.
* [Send Gates](/compliance/send-gates) — the full gate stack this page
maps.
* [Quiet hours configuration](/guides/quiet-hours-configuration) — the
two quiet-hours knobs and their carve-outs.
* [Compliance Health Scores](/compliance/compliance-health) — the
read-only early-warning layer.
* [Opt-Out & Suppression Lists](/compliance/opt-out-suppression) — the
suppression layer the gates read.
* [STIR/SHAKEN attestation](/channels/voice/stir-shaken) — voice
caller-identity posture.
* [API Reference → Compliance](/api-reference/endpoints/compliance) —
full request/response schemas for every endpoint named here.