Skip to main content

​
TCPA Evidence Pack in the Binder

The evidence binder generates one signed, download-ready pack per framework — SOC 2, ISO 27001, GDPR, or HIPAA. When a TCPA demand letter, a discovery request, or opposing counsel asks for your TCPA posture, assemble the pack yourself from four existing exports. This page maps each TCPA obligation to the export that proves it, and walks one worked assembly end to end.
A TCPA evidence pack is a signal-assembling runbook, not a legal judgment. The exports below prove what your platform recorded — when a scrub ran, when consent was granted, when a window blocked a call. Whether that record satisfies your TCPA obligations is a question for qualified counsel. Orbit documents tenant-owned controls; it does not certify your compliance posture.

​
Mapping TCPA obligations to exports

Each row pairs one obligation a TCPA plaintiff or examiner typically probes with the export that carries the proof. Assemble these rows — the table below is the pack’s table of contents. Review the full pre-dispatch chain before you assemble — the same order that runs at send time resolves which exports actually carry your proof. A campaign voice block, a DNC check, and a litigator verdict all land in the same audit trail.

​
Worked example — assemble a litigation-defence handout

Opposing counsel serves a demand letter for a specific phone number, alleging a call placed outside permitted hours on a specific date. Build the handout from four exports, in this order:
  1. Bound the audit window. Queue an audit export for the disputed UTC day(s), plus the trailing days that carry your recent scrub verdicts. Poll to complete, download inside the 7-day signed-URL window, and mirror the bundle into your own evidence store before you read it.
  2. Filter for the TCPA rails. From the bundle, pull entries for messages.tcpa_litigator_blocked, messages.tcpa_litigator_consented_bypass, messages.tcpa_litigator_soft_warn, and the federal-window block (TCPA_FEDERAL_DIALING_WINDOW_BLOCKED rejects). Together they prove the gate fired, and which of the three litigator verdicts resolved (or that none applied).
  3. Export consent and suppression for the number. Run consent export and suppression export filtered to the phone plus the window around the disputed date. The consent row answers “was there consent”; the suppression row answers “was the number on the STOP ledger”.
  4. Snapshot the quiet-hours posture. Save the quiet-hours preview verdict for the recipient’s number at the disputed timestamp (or the current window configuration if the dispute is about posture, not a single call). That snapshot proves which window Orbit resolved and what it allowed.
  5. Attach the chain, the routing record, and the payload proof. The audit export’s chain-verify response (rows_checked, chain_valid, first_hash, last_hash) attaches as the integrity witness. Cite your SIEM sink category filter as the evidence-routing record — it proves which events your own archive received continuously, so a gap in the raw export is explainable. Where the dispute turns on what a call actually said, pin the recording (or the message body for SMS/MMS) with an immutable archival export — the tamper-evident WORM bundle covers the payload the audit log only describes.
  6. Hand four artifacts over. The audit bundle, the two CSVs, and the quiet-hours snapshot — plus the chain-verify JSON — make up the handout. Do not forward a broken chain_valid: false bundle without the caveat agreed with counsel.
The same four exports answer an inbound TCPA complaint, a regulator’s posture questionnaire, or your own quarterly posture review — the assembly order matters because each export must exist before the previous one is interpreted.

​
Limits

  • The binder does not auto-populate a TCPA chapter today. The four framework packs (SOC 2, ISO 27001, GDPR, HIPAA) are the only generated packs; a TCPA chapter is not among them. Assemble from the four exports on this page instead of waiting for a generated TCPA section, and regenerate the audits after each new relevant event.
  • Windows are rolling, so scrub dates matter. The suppression export is day-aligned (suppressed_at, not created_at); the quiet-hours config you snapshot today is the posture the examiner will audit against — snapshot before a posture change ships, not after. Say the snapshot date on the handout.
  • Four exports, one chain-verify. The audit export, the consent export, and the suppression export are separately status-gated jobs. Confirm each job reached complete and count a truncated export before you treat a row as evidence.
  • The known-litigator verdict is a gate, not a proof obligation. A consented_bypass entry proves the recipient passed the gate; it does not prove consent for the channel — that is the consent export’s job.
  • Versioned snapshots beat hand transcripts. Keep the row counts, the window dates, and the chain-verify response as files alongside the CSVs — a litigator’s counsel can re-hash without reaching your audit log.