> ## Documentation Index
> Fetch the complete documentation index at: https://docs.orbit.devotel.io/llms.txt
> Use this file to discover all available pages before exploring further.
# Configure Your Tenant's Compliance Posture Before the First Send
> Day-one runbook for the send-time compliance gates: consent baseline, opt-out and suppression paths, quiet hours per channel, DNC and RND pre-flight, country rules, and the emergency kill switch — in the order you configure them, with every default stated.
# Configure Your Tenant's Compliance Posture Before the First Send
The Compliance section documents each send-time gate on its own page —
quiet hours, DNC, RND, suppression, the preference center, the
emergency stop. This guide is the runbook across all of them: the
order a new tenant configures the gates in before its first send, the
dashboard path and API endpoint for each write, the default every
control ships with, and what leaving a gate off actually permits. It
extends the
[posture map](/compliance/posture-overview) — that page inventories
every toggle; this one walks you through flipping them.
This page describes Orbit's platform controls. It is **not legal
advice.** Which obligations apply to your traffic depends on where
you and your recipients are and what you send. Confirm your posture
with qualified counsel before the first send.
## The one thing to know before you start
**Every gate below ships off or empty.** A new tenant's sends are not
held by quiet hours, not scrubbed against DNC or RND, and no
preference center or suppression entries exist until you create them.
The posture is additive: you tighten from an open default, one control
at a time. Orbit enforces what you configure — it never mandates a
posture for you, and only the short list of platform rails in
[what is not tenant-toggleable](/compliance/posture-overview#what-is-not-tenant-toggleable)
blocks traffic you didn't hold yourself.
Work the steps in order. Each later step reads the surfaces the
earlier ones populate.
***
## Step 1 — Record the consent baseline
Consent is the layer the send-time gates read first: an explicit
consent record is what the quiet-hours consent carve-out checks, what
the DNC check reports as a source, and what your compliance-health
score counts.
Record consent per channel before the first send:
* **API:** `POST /api/v1/compliance/consent` — see
[Consent Management](/compliance/consent-management).
* **Dashboard:** consent records are also writable from the contact
profile.
* **Default:** no consent records exist. Nothing is blocked by this,
but nothing has cover either — consent coverage is 30% of the
[compliance-health score](/compliance/compliance-health), and a
recipient without a consent record won't pass the quiet-hours
carve-out in step 3.
For US SMS, record consent per `(contact, channel)` pair with the
capture source (the 10DLC campaign reviewers ask for that provenance).
For GDPR traffic, fill `lawful_basis` on the same write. Keep the
proof: `GET /api/v1/compliance/consent/export` downloads the
tenant-wide proof-of-record for an audit
([Export Consent & Suppression Records](/compliance/consent-suppression-export)).
## Step 2 — Wire the opt-out paths
Consent you capture must be cheap to withdraw. Two configuration
surfaces cover it, and both feed the same suppression layer every
send reads:
1. **Import your legacy suppression list** before the first send if
you are migrating from another platform —
`POST /api/v1/compliance/suppression-list/import` accepts a CSV
upload. Phone and WhatsApp rows default to scope `all`, which gates
voice and dialer traffic too; email rows default to scope `email`.
Details in
[Opt-Out & Suppression Lists](/compliance/opt-out-suppression).
2. **Configure a preference center** —
`POST /api/v1/compliance/preference-center`, then mint per-contact
signed links with `POST …/preference-center/link` and publish them
in your footer or welcome flow. A contact who opts out through the
link lands on the same suppression list a STOP keyword or a
Consent API opt-out would — structured now instead of as a support
ticket later. Details in
[Send Gates → Preference center](/compliance/send-gates#preference-center).
* **Defaults:** the suppression list is empty until STOP keywords,
opt-outs, or imports populate it — and suppression is the one gate
that is **fail-closed for entries that exist**: a suppressed address
is dropped before dispatch regardless of how the entry got there.
The preference center has no public page until you create it over
the API.
* **Leaving it off:** your first campaign starts honoring keywords
the moment it runs, but it starts with zero entries — every legacy
opt-out you failed to import becomes a complaint or a carrier
rejection instead of a suppressed send.
## Step 3 — Set quiet hours per channel
Two knobs, both off by default:
1. **The per-channel org gate.** Each channel's quiet-hours toggle
ships off — a new tenant's SMS, WhatsApp, and voice sends are not
held by any window until you enable the channel. Enable it per
channel by writing the `quiet_hours` block through
`PUT /api/v1/settings/general` with `settings.quiet_hours..enabled`
(the `voice` channel can additionally be flipped from **Settings →
Voice** in the dashboard). Windows default to 08:00–21:00
recipient-local for SMS/voice and 09:00–21:00 for WhatsApp/Meta
channels once enabled; set your own `start_hour` / `end_hour` to
override.
2. **The campaign fallback window.** Drip and journey sends that
carry no window of their own inherit the platform default
21:00–09:00 until you write
`PUT /api/v1/campaigns/quiet-hours/settings` — or set **Settings →
Campaign limits → Default quiet hours** in the dashboard.
The `consent_overrides_quiet_hours` flag defaults to `true`: a
recipient with an explicit consent record from step 1 stays reachable
inside the window. Set it to `false` only if you want consented
recipients held too.
* **Leaving them off:** sends dispatch at any hour. For US traffic
that is a TCPA exposure on every message outside 08:00–21:00
recipient-local — the per-channel gate is the control that holds
them, and it is off until you flip it.
* **Verify before rollout:** `GET /api/v1/compliance/quiet-hours/preview`
answers "would this send, to this recipient, be held right now — and
until when?" without sending.
Campaign and dialer **voice** to US recipients is the exception you
don't control: it is hard-blocked outside the federal 8 AM–9 PM
recipient-local window regardless of these toggles, with stricter
state overlays on top. See
[Quiet hours configuration](/guides/quiet-hours-configuration) for the
full picture.
## Step 4 — Read the country rules before you launch in a market
Before the first send to a new country, read what that market
requires:
* `GET /api/v1/compliance/country-rules?channel=sms®ion=EU` —
per country and channel: allowed sender types, whether Sender-ID
registration is `none` / `recommended` / `required`, STOP-keyword
requirements, two-way support, DLR support, and default throughput.
This endpoint is read-only and reports back whatever you pass it — it
changes nothing. It is your pre-launch checklist: wherever it answers
`registration: required`, complete
[Sender-ID registration](/compliance/sender-id-registration) before
the first send, because that surface is fail-closed — A2P SMS to a
country requiring registration is blocked until the entry is
approved. Full walkthrough in
[Country Compliance Requirements](/compliance/country-requirements).
## Step 5 — Acknowledge and enable the DNC and RND pre-flight checks
Two pre-send screening endpoints, both off by default, both behind a
per-organization opt-in that is an *acknowledgment*, not just a flag.
**DNC pre-flight.** `GET /api/v1/compliance/dnc/check` reports whether
a number is on any Do-Not-Call source your send path enforces — your
contact DNC flag, the platform DNC list, your suppression list, or a
consent opt-out. Enable it in **Settings → Compliance** (the DNC
pre-flight card) with the acknowledgment checked, or by writing
`settings.dnc_sync_enabled: true` through
`PUT /api/v1/settings/general`.
* **Default:** off — the endpoint returns `403 DNC_SYNC_NOT_ENABLED`
until you opt in.
* **Why the acknowledgment exists:** until a federal register snapshot
is synced to the platform, a number that appears only on the FTC
list reads back as `on_dnc: false`. The toggle confirms you
understand the check is your own list plus whatever registries have
synced, not a guaranteed national scrub. Read `federal_feeds_synced`
on every response to see which state you're in.
* **Leaving it off:** no pre-flight check at all; your send-path
suppression from step 2 still drops your own opt-outs, but nothing
screens against a registry before you dial.
**RND pre-flight (US voice).** `GET /api/v1/compliance/rnd/check`
queries the FCC Reassigned Numbers Database for the
`(phone, consent_date)` pair — the § 227 safe harbor. Enable with
`PUT /api/v1/compliance/rnd/settings` (`{"enabled": true}`) or from
**Settings → Compliance**.
* **Default:** off — the endpoint returns `403 RND_SCRUB_NOT_ENABLED`.
* **Fail-closed enable:** turning it on before the FCC feed is
connected is refused with `409 RND_FEED_NOT_CONFIGURED` — Orbit will
not let you flip a switch that screens against nothing. Until the
feed is synced every verdict degrades to `no_data` and no safe
harbor applies.
Deep pages: [DNC Scrubbing](/compliance/dnc-scrub) and
[Send Gates → RND](/compliance/send-gates#rnd-reassigned-numbers-database).
## Step 6 — Know where the emergency stop is
The org-wide kill switch, inactive by default and not toggleable in
advance — you just need to know it exists before you need it:
* `POST /api/v1/compliance/emergency-stop/activate` with a `reason`
(owner/admin key) halts all outbound SMS, MMS, voice, and dialer
traffic in one call.
* `GET …/emergency-stop` reports the state; `POST …/deactivate` lifts
it.
Transactional Verify/OTP sends and email are never gated by the stop
— a login code still reaches a contact mid-incident. Bookmark
[Send Gates → Emergency stop](/compliance/send-gates#emergency-stop)
in your incident runbook.
***
## End to end: a US SMS marketer's first-run posture
A concrete run of the six steps for a tenant sending A2P marketing
SMS to US recipients under TCPA. Each step states what you do; the
ratchet note is what breaks if you skip it.
```bash theme={null}
BASE="https://api.orbit.devotel.io/api/v1"
AUTH="Authorization: Bearer $ORBIT_API_KEY"
```
1. **Capture consent at opt-in** and record it the moment a recipient
grants it, before the first campaign:
```bash theme={null}
curl -X POST $BASE/compliance/consent -H "$AUTH" \
-H "Content-Type: application/json" \
-d '{
"identifier": "+14155550101",
"channels": ["sms"],
"opt_in": true,
"source": "signup_form"
}'
```
2. **Import the legacy opt-out list** — one CSV before the first
send, so inherited opt-outs are suppressed from day one:
```bash theme={null}
curl -X POST $BASE/compliance/suppression-list/import \
-H "$AUTH" -F "file=@legacy-opt-outs.csv"
```
Then set an ongoing export cadence for your own records:
`GET /compliance/suppression-list/export?format=csv` on whatever
schedule your counsel wants — weekly is common
([Opt-Out & Suppression Lists](/compliance/opt-out-suppression)).
3. **Complete 10DLC brand and campaign registration**
([10DLC guide](/guides/10dlc-registration)) — US long-code traffic
without it degrades regardless of the gates above, and `country-rules`
reports registration as required for `US`/`sms` (step 4 in reverse:
this is what the check tells you to do).
4. **Enable the SMS quiet-hours gate** — 08:00–21:00 recipient-local
is the platform window; keep `consent_overrides_quiet_hours` true
so consented recipients stay reachable:
```bash theme={null}
curl -X PUT $BASE/settings/general -H "$AUTH" \
-H "Content-Type: application/json" \
-d '{
"settings": {
"quiet_hours": {
"sms": { "enabled": true, "start_hour": 8, "end_hour": 21 },
"consent_overrides_quiet_hours": true
}
}
}'
```
The `quiet_hours` key is replaced wholesale on this write — put the
full tree in the body, not just the channel you are changing
([Quiet hours configuration](/guides/quiet-hours-configuration)).
Then verify with `GET /compliance/quiet-hours/preview` before the
first campaign.
5. **Enable DNC pre-flight** and run `GET /compliance/dnc/check`
against campaign lists before each send (once per number; cache the
result per campaign batch):
```bash theme={null}
curl -X PUT $BASE/settings/general -H "$AUTH" \
-H "Content-Type: application/json" \
-d '{ "settings": { "dnc_sync_enabled": true } }'
```
In the dashboard the same change is **Settings → Compliance → DNC
pre-flight**, with the acknowledgment checked.
6. **Wire the preference center** and publish signed links in your
message footer flow, so opt-outs arrive structured — and confirm
your owner/admin key can call the emergency stop.
The ratchet: skip step 1 and no recipient passes the consent
carve-out; skip step 2 and legacy opt-outs become complaints; skip
step 3 and traffic degrades at the carrier; skip step 4 and messages
land at any hour; skip step 5 and nothing screens against the DNC;
skip step 6 and your fastest incident response is deleting a campaign
by hand.
***
## The posture checklist
One row per control, in configuration order. "Consequence if left"
is the send-time reality of the default, not a mandate — all of this
is yours to set.
| # | Control | Where (dashboard) | Where (API) | Default | Consequence if left |
| -- | ------------------------------------ | ----------------------------- | --------------------------------------------------------------------------- | ------------------------------------- | ---------------------------------------------------------------------- |
| 1 | Consent records | Contact profile | `POST /compliance/consent` | None recorded | No carve-out eligibility; low consent coverage on the health score |
| 1a | Consent proof export | — | `GET /compliance/consent/export` | On demand | No audit-grade proof-of-record file |
| 2 | Legacy suppression import | — | `POST /compliance/suppression-list/import` | Empty list | Legacy opt-outs hit carriers as complaints |
| 2a | Preference center | — | `POST /compliance/preference-center` | No public page | Opt-outs arrive as support tickets, not structured events |
| 3 | Quiet hours, per-channel org gate | Settings → Voice (voice only) | `settings.quiet_hours..enabled` via `PUT /api/v1/settings/general` | **Off per channel** | Sends dispatch at any hour; TCPA exposure for US traffic |
| 3a | Campaign fallback window | Settings → Campaign limits | `PUT /api/v1/campaigns/quiet-hours/settings` | Inherit platform 21:00–09:00 | Drip sends inherit a window you didn't choose |
| 4 | Country rules (read-only) | — | `GET /compliance/country-rules` | Read-only | Skipping the read means discovering `required` registrations as blocks |
| 4a | Sender-ID registration | Compliance → Sender IDs | `POST /compliance/sender-id-registrations` | Nothing registered | Fail-closed: A2P SMS blocked in countries that require it |
| 5 | DNC pre-flight | Settings → Compliance | `settings.dnc_sync_enabled` via `PUT /api/v1/settings/general` | **Off** (`403 DNC_SYNC_NOT_ENABLED`) | No pre-send registry screen; own suppression still enforced |
| 5a | RND pre-flight (`rnd_scrub_enabled`) | Settings → Compliance | `PUT /compliance/rnd/settings` | **Off** (`403 RND_SCRUB_NOT_ENABLED`) | No reassigned-number safe harbor reads |
| 6 | Emergency stop | — | `POST /compliance/emergency-stop/activate` | Inactive | Nothing blocks until you pull it — no way to halt fast in an incident |
| 7 | Posture signals | Compliance health dashboards | `GET /compliance/health`, `GET /compliance/quiet-hours/preview` | Read-only | The verification loop after every flip above |
Two reminders that don't fit in a cell: suppression entries are
fail-closed once they exist (row 2 is a one-way improvement), and
campaign/dialer **voice** to US recipients is hard-blocked outside
the federal window with no tenant toggle — see
[State Calling Windows](/compliance/state-calling-windows).
***
## Verify the posture you just built
After the flips, read the two signal surfaces — they report what the
send path will actually do:
* `GET /compliance/health` (plus `/health/numbers` and
`/health/campaigns`) — the 0–100 score per organization, sender,
and campaign, with ranked warnings. Consent coverage from step 1
shows up here.
[Compliance Health Scores](/compliance/compliance-health).
* `GET /compliance/quiet-hours/preview` — the dry-run for step 3 and
step 4 of the example. If it says a send would be held until a time,
schedule to that time instead of retrying into the window.
Run the checklist top to bottom once per market, and re-run it when
you add a channel — a new channel arrives with its quiet-hours gate
off regardless of what the rest of the posture looks like.
***
## From first-run to production go-live
The six steps above harden the send-time gates. Before you move a
regulated channel to production, that hardening joins five heavier
surfaces that also have a tenant-owned control. Name each one before
you launch:
1. **Identity first.** Upload KYC documents and build at least one
compliance profile before numbers, registrations, or scrub toggles
— everything downstream references it. Control:
`POST /api/v1/compliance/kyc/documents`, referenced by document ID.
[KYC Documents & the Compliance-Profile Lifecycle](/compliance/documents-kyc).
2. **Consent at opt-in.** Record consent the moment each recipient
grants it, per channel — step 1 of the runbook above. Control:
`POST /api/v1/compliance/consent`.
[Consent Management](/compliance/consent-management).
3. **Registry pre-flight (voice/dialer).** Opt into the DNC check,
and add RND for US voice when you need the § 227 safe harbor —
steps 5 and 5a. Controls: `GET /compliance/dnc/check`,
`PUT /compliance/rnd/settings`.
[DNC Scrubbing](/compliance/dnc-scrub).
4. **Export your proof.** Before the first campaign, set the cadence
that downloads consent proof and the suppression ledger — the
audit file a TCPA or GDPR inquiry asks for. Controls:
`GET /compliance/consent/export` and
`GET /compliance/suppression-list/export?format=csv`.
[Export Consent & Suppression Records](/compliance/consent-suppression-export).
5. **Market rules.** Read `GET /compliance/country-rules` per market
(step 4), finish every registration it flags as `required`, then
close with the checklist above. Controls: the read-only
country-rules endpoint plus
`POST /compliance/sender-id-registrations`.
[Country Compliance Requirements](/compliance/country-requirements).
Close production readiness with the verification loop:
`GET /compliance/health` and `GET /compliance/quiet-hours/preview`
report what the send path will actually do before real traffic runs
on it.
## Common "gated surface" causes
Operators most often land on
[Troubleshoot a Pending Number or Sender ID](/compliance/troubleshooting-pending-gated-surfaces),
but the gating surfaces below trigger on un-set controls, not pending
approvals. Map the symptom to the control you skipped:
| Symptom | Root cause | Control to fix |
| ----------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------ |
| Outbound SMS / WhatsApp held at send time | Per-channel quiet-hours gate enabled with a window a send is outside — see the **Settings → General** `settings.quiet_hours.` block | `GET /compliance/quiet-hours/preview` tells you the hold-until time; adjust the window or schedule inside it |
| Dialer or campaign voice held in the evening | The federal voice window — it blocks outside 8 AM–9 PM recipient-local for US numbers regardless of your toggles | None to unset — schedule inside the window. See [the TCPA guard](/concepts/tcpa-federal-voice-guard) |
| `403 DNC_SYNC_NOT_ENABLED` on the DNC check | DNC pre-flight never opted in | `settings.dnc_sync_enabled: true` via `PUT /api/v1/settings/general` (or the dashboard acknowledgment) |
| `403 RND_SCRUB_NOT_ENABLED` on the RND check | RND pre-flight never enabled | `PUT /compliance/rnd/settings` with `{"enabled": true}` |
| `409 MESSAGING_*_SENDER_NOT_REGISTERED` or the country page blank | `GET /compliance/country-rules` never read before launch in that market | Complete the registration it flags; see [Country Compliance Requirements](/compliance/country-requirements) |
| A TCPA or GDPR audit requests proof you do not hold | Export cadence never set | `GET /compliance/consent/export` and `GET /compliance/suppression-list/export` |
| Suppression blocks a send but the compliant path is muddled | Preference center never published, so opt-outs arrive through support | `POST /compliance/preference-center` plus signed links in your footer flow |
| Compliance-health score low on launch | Consent coverage uncounted or gates still default-open | Read `GET /compliance/health` and close the ranked warnings |
## Sample rollout order (US voice + SMS + WhatsApp)
One ordering that moves the controls above, not a mandate. Work it in
the sequence here; a wrong order usually means re-doing a toggle after
the identity or registration surface it references lands.
1. **KYC documents + compliance profile** — the identity surface every
later step references. [KYC Documents](/compliance/documents-kyc).
2. **Consent capture and suppression import** — the records everything
else reads. [Consent Management](/compliance/consent-management),
[Opt-Out & Suppression](/compliance/opt-out-suppression).
3. **DNC (and RND for US voice) pre-flight** — opt in before dialing
lists exist. [DNC Scrubbing](/compliance/dnc-scrub).
4. **Sender-ID registrations and the registration gates** — flip the
channels' quiet-hours and preference-center writes only after
traffic can flow. [Sender-ID Registration](/compliance/sender-id-registration).
5. **country-rules per market at expansion time** — re-run this before
each new country or channel. [Country Requirements](/compliance/country-requirements).
6. **Close with the FAQ's mental model** — what defaults open, what
fails open versus closed, and where the hard rails you can't unset
live. [Compliance Posture FAQ](/compliance/posture-faq).
Rollout per channel: complete WhatsApp after SMS — its window and
content rules differ ([WhatsApp Content Policy](/compliance/whatsapp-content-policy)),
and Meta surface rules still draw on the same suppression and consent
records.
***
## Where the hard rail ends
The gates above are tenant-owned and default open. One is not: campaign
and dialer **voice to US recipients** hard-blocks outside the federal
8 AM–9 PM recipient-local window, on the platform default 21:00–09:00
window for drip sends, with state overlays on top. That is the one
`422` you cannot unset — every other gate on this page yields to a
tenant toggle. Full mechanics in
[TCPA federal voice guard](/concepts/tcpa-federal-voice-guard) —
the posture checklist above covers the gates you own.
***
## Related references
* [Posture overview](/compliance/posture-overview) — the full toggle
map this runbook walks through, including what is not
tenant-toggleable.
* [Send Gates](/compliance/send-gates) — per-gate request/response
reference for every endpoint above.
* [Quiet hours configuration](/guides/quiet-hours-configuration) —
both quiet-hours knobs, carve-outs, and the voice exception.
* [DNC Scrubbing](/compliance/dnc-scrub) — the scrub chain and the
fail-open caveat behind the DNC acknowledgment.
* [Export Consent & Suppression Records](/compliance/consent-suppression-export) —
the audit-proof downloads for consent and the suppression ledger.
* [Country Compliance Requirements](/compliance/country-requirements) —
per-country sender rules and required documents.
* [Troubleshoot a Pending Number or Sender ID](/compliance/troubleshooting-pending-gated-surfaces) —
approval-side gating for numbers and sender IDs.
* [Compliance Posture FAQ](/compliance/posture-faq) — the mental model
for defaults-open gates and approvals with external lead time.
* [Opt-Out & Suppression Lists](/compliance/opt-out-suppression) —
scopes, STOP keywords, and CSV import format.
* [Assembling a GDPR Posture End to End](/compliance/gdpr-posture-guide) —
the sibling runbook for EU traffic.
* [Go-live checklist](/guides/go-live-checklist) — the non-compliance
pre-launch list this posture slots into.