Skip to main content

​
Vertical bundles by industry

The vertical bundle catalog ships four activation packs. This page translates that catalog into one decision view for the four regulated buyers that land on the compliance hub most often: healthcare, financial services, higher education, and retail and CPG. Each section below answers the same three questions: which bundle is your starting point, which tenant controls you set alongside it, and which runbooks close the distance between activation and your regulator’s expectations.

​
The decision view

Read your row, then read the walkthrough for your industry below before you activate anything.

​
What a vertical bundle is, and is not

A vertical bundle is a packaged set of compliance-profile use cases scoped to a regulated industry. Activating one provisions, in a single call, a draft compliance profile, three to five draft campaign templates, a vertical-tuned AI agent, a double-opt-in flow config, and an in-product go-live checklist. Three things a bundle is not:
  • Not a pre-approved legal posture. Activation does not certify you compliant with HIPAA, GLBA, FERPA, CASL, or anything else. It gives you a reviewed starting point and keeps the go-live gates visible; the posture is yours to finish.
  • Not a platform decision. Compliance stays tenant-owned. The bundle seeds defaults into your workspace, and your workspace edits, submits, and sends. Orbit provisions drafts and wires no carrier. See tenant posture overview.
  • Not a send. Every provisioned resource is a draft. Nothing schedules or sends until you submit the profile for verification, attach senders, and approve the campaign copy.

​
The current catalog

Four bundles ship today. All four provision the profile on the same primary use case, the US 10DLC business campaign registration (sms_10dlc_campaign_us); what differs per vertical is the seeded campaign copy, the agent’s rules, and the manual go-live gates: Every bundle also appends the shared manual gates: attach compliance documents, submit the profile for verification, review the opt-in copy, confirm the quiet-hours window, and approve campaign copy. Preview any manifest before activating with GET /api/v1/compliance/vertical-bundles/:key.

​
Healthcare

Start with healthcare_hipaa. Its four draft campaigns are written so plain SMS never carries protected health information: reminders name the practice and the appointment, never the diagnosis, and anything clinical is pointed at your secure portal. The provisioned Patient Intake Assistant follows the minimum-necessary principle, refuses to relay PHI over chat, and routes emergencies to 911. Pair the bundle with:
  • HIPAA first-run checklist for the order in which to stand up your posture, and the HIPAA posture guide for the control map behind it.
  • BAA gate guide: execute the BAA before patient messaging goes live. The bundle’s sign_baa checklist step keeps that gate visible on your go-live list.
  • PHI audiences and the PHI audiences setup guide to define which patient segments may receive SMS at all, and what content classes are excluded from the channel.
  • Archival export to retain and export patient messaging records under the HIPAA basis your privacy officer documents.
The bundle drafts assume a business-to-patient relationship with written notice at intake. If you message on behalf of multiple covered entities, review the BAA scope before you submit the profile.

​
Financial services

Start with fintech_kyc. Its drafts split cleanly into the two consent categories a financial tenant must keep separate: transactional and security messaging (transaction alerts, fraud alerts, statements) and promotional messaging, which the pack’s configure_transactional_optin gate forces you to map explicitly. The provisioned assistant never collects full government ID numbers, card numbers, passwords, or one-time passcodes over chat, and escalates suspected fraud to a human. If you also collect payments by SMS or chat (card-on-file updates, past-due balances), activate pci_payment_collection as a second, separate activation: its drafts send a hosted payment link instead of ever taking card data in the message. Pair the bundles with:

​
Higher education

No dedicated higher-ed bundle ships today, so compose the posture from the same primitives the packs use. Register your traffic under the education use cases described in compliance profile use cases, and read 10DLC vs education customer data before you decide what student data may appear in a campaign audience. Set these controls alongside:
  • COPPA minors posture for any audience that includes minors: applicant, youth-program, and K-12-adjacent lists need the minors handling the page describes before you send.
  • DSAR handling for student and applicant data-subject requests: access and erasure routing for the same records your campaigns touch.
  • Audit export so the send history your registrar or counsel needs is exportable.
  • Quiet hours tuned to student local time, including overnight and exam-period windows.
If your program includes retail-adjacent flows (campus stores, dining, housing deposits), review the ecommerce_transactional drafts as copy starting points and the pci_payment_collection drafts for payment links, then activate only if the transactional fit is real: each activation creates its own draft profile and checklist.

​
Retail and CPG

Start with ecommerce_transactional. Its drafts cover the order lifecycle (confirmation, shipping) as transactional messaging and keep re-engagement (cart, review, promo) separate, with the separate_marketing_optin gate holding the line between the two consent classes. Pair the bundle with the consent and privacy surfaces your recipient base triggers:
  • CAN-SPAM for US commercial email that runs next to your SMS program, and CASL for Canadian recipients: express-consent records and CRTC disclosure requirements are stricter than the US baseline.
  • CCPA/CPRA posture for California consumers: sale and share treatment of contact data, and the opt-out-of-marketing path your preference center must honor.
  • Opt-in disclosure templates for the point-of-collection language at checkout, in-store signage, and keyword opt-in: program name, message frequency, rates, and help and stop language.
  • Emergency stop as the kill switch you test before your first promotional blast, not after a bad send.

​
What activation changes, and what stays yours

Activation runs through the vertical-bundles endpoints the dashboard uses: GET /api/v1/compliance/vertical-bundles lists the catalog, GET /api/v1/compliance/vertical-bundles/:key previews a manifest, and POST /api/v1/compliance/vertical-bundles/:key/activate provisions the drafts. The service behind those endpoints fans out to the same profile, campaign, and agent creators you would call individually; the bundle only saves you the wiring. Full lifecycle behavior (duplicates, version snapshots, checklist visibility) is documented in activation semantics. What lands as a recommended default, seeded for you to review and edit: What stays tenant-owned, untouched by activation:
  • The inputs you pass at activation (brand_name, help_contact, country_code or countries) and every edit you make to the seeded drafts afterwards.
  • Attaching senders, attaching compliance documents, and submitting the profile for verification.
  • Your quiet-hours window, consent categories, suppression lists, and the decision to schedule any send.
  • The legal read on your traffic: your counsel and your regulator, not the bundle.
Two mechanics to plan around. Activation is not idempotent: a second POST for the same bundle creates a second draft profile with a second checklist, so click once per bundle and edit the drafts rather than re-activating. And the checklist is a tracker, not a send gate: the real gates are the draft states themselves (draft campaigns do not send, the profile must clear verification).

​
Anti-patterns

  • Treating activation as certification. An activated bundle is a set of drafts plus a checklist. It is evidence that you started from a reviewed baseline; it is not evidence that you finished. Your audit trail is the submitted profile, the attached documents, and the checklist entries you cleared.
  • Activating overlapping bundles expecting a merge. Activations never merge. Two activations of the same bundle, or of two bundles covering the same traffic, give you two profiles, two checklists, and two carrier verification journeys. If a carrier review fails, fix and resubmit the profile; do not re-activate.
  • Reading seeded defaults as regulatory text. The seeded copy encodes baseline rules (STOP/HELP language, minimum-necessary phrasing, card-data exclusions), but it is starting copy, not the regulation. Your obligations, your disclosures, and your counsel’s review produce the final text. Ship the defaults unedited and you ship someone else’s assumptions about your program.