> ## Documentation Index > Fetch the complete documentation index at: https://docs.orbit.devotel.io/llms.txt > Use this file to discover all available pages before exploring further. # Vertical bundles by industry: a decision guide for regulated buyers > Which vertical bundle to activate, and which controls and runbooks to pair with it, for healthcare, financial services, higher education, and retail and CPG teams. # Vertical bundles by industry The [vertical bundle catalog](/compliance/vertical-bundles) ships four activation packs. This page translates that catalog into one decision view for the four regulated buyers that land on the compliance hub most often: healthcare, financial services, higher education, and retail and CPG. Each section below answers the same three questions: which bundle is your starting point, which tenant controls you set alongside it, and which runbooks close the distance between activation and your regulator's expectations. ## The decision view | Your industry | Start with | Pair with | Buyer reference | | - | - | - | - | | Healthcare (providers, pharmacies, care coordinators) | `healthcare_hipaa` | [HIPAA first-run checklist](/compliance/hipaa-first-run-checklist), [BAA gate](/compliance/baa-gate-guide), [PHI audiences](/compliance/phi-audiences), [archival export](/compliance/archival-export) | [Healthcare](https://orbit.devotel.io/en/healthcare) | | Financial services (banks, fintechs, broker-dealers, collections) | `fintech_kyc`, plus `pci_payment_collection` if you collect card payments by SMS | [Recording consent](/compliance/recording-consent), [audit ledger](/compliance/audit-ledger-posture-rollup), [evidence binder](/compliance/evidence-binder), [10DLC registration](/guides/10dlc-registration), [KYC documents](/compliance/documents-kyc) | [Fintech](https://orbit.devotel.io/en/fintech) | | Higher education (admissions, registrar, student life) | No dedicated pack today: compose from the education use case and the controls at right | [COPPA minors posture](/compliance/coppa-minors-posture), [10DLC education data guide](/compliance/ten-vs-educate-customer-data), [DSAR handling](/compliance/dsar), [audit export](/compliance/audit-export) | [Education](https://orbit.devotel.io/en/education) | | Retail and CPG (stores, e-commerce, brands) | `ecommerce_transactional`, plus `pci_payment_collection` for payment links | [CASL](/compliance/casl-canada-anti-spam), [CAN-SPAM](/compliance/can-spam), [CCPA/CPRA posture](/compliance/ccpa-cpra-posture), [opt-in disclosure templates](/compliance/opt-in-disclosure-templates), [emergency stop](/compliance/emergency-stop) | [Retail](https://orbit.devotel.io/en/retail) | Read your row, then read the walkthrough for your industry below before you activate anything. *** ## What a vertical bundle is, and is not A vertical bundle is a packaged set of compliance-profile use cases scoped to a regulated industry. Activating one provisions, in a single call, a draft compliance profile, three to five draft campaign templates, a vertical-tuned AI agent, a double-opt-in flow config, and an in-product go-live checklist. Three things a bundle is **not**: * **Not a pre-approved legal posture.** Activation does not certify you compliant with HIPAA, GLBA, FERPA, CASL, or anything else. It gives you a reviewed starting point and keeps the go-live gates visible; the posture is yours to finish. * **Not a platform decision.** Compliance stays tenant-owned. The bundle seeds defaults into *your* workspace, and your workspace edits, submits, and sends. Orbit provisions drafts and wires no carrier. See [tenant posture overview](/compliance/posture-overview). * **Not a send.** Every provisioned resource is a draft. Nothing schedules or sends until you submit the profile for verification, attach senders, and approve the campaign copy. *** ## The current catalog Four bundles ship today. All four provision the profile on the same primary use case, the US 10DLC business campaign registration (`sms_10dlc_campaign_us`); what differs per vertical is the seeded campaign copy, the agent's rules, and the manual go-live gates: | Bundle key | Draft campaigns | Vertical-specific gate | | - | - | - | | `healthcare_hipaa` | 4: appointment reminder, prescription refill, post-visit follow-up, billing notice; all keep PHI out of plain SMS | `sign_baa`: execute a Business Associate Agreement before any patient send | | `fintech_kyc` | 5: KYC reminder, onboarding welcome, transaction alert, statement ready, fraud alert | `configure_transactional_optin`: confirm security alerts stay transactional and promotions require marketing consent | | `ecommerce_transactional` | 5: order confirmation, shipping update, cart abandonment, review request, promotional offer | `separate_marketing_optin`: promotional sends target marketing-consented contacts only | | `pci_payment_collection` | 4: payment link request, invoice reminder, payment confirmation, failed payment retry; none carry card data | `confirm_hosted_payment_page`: payment links route to a PCI-DSS hosted checkout | Every bundle also appends the shared manual gates: attach compliance documents, submit the profile for verification, review the opt-in copy, confirm the quiet-hours window, and approve campaign copy. Preview any manifest before activating with `GET /api/v1/compliance/vertical-bundles/:key`. *** ## Healthcare Start with `healthcare_hipaa`. Its four draft campaigns are written so plain SMS never carries protected health information: reminders name the practice and the appointment, never the diagnosis, and anything clinical is pointed at your secure portal. The provisioned Patient Intake Assistant follows the minimum-necessary principle, refuses to relay PHI over chat, and routes emergencies to 911. Pair the bundle with: * [HIPAA first-run checklist](/compliance/hipaa-first-run-checklist) for the order in which to stand up your posture, and the [HIPAA posture guide](/compliance/hipaa-posture-guide) for the control map behind it. * [BAA gate guide](/compliance/baa-gate-guide): execute the BAA before patient messaging goes live. The bundle's `sign_baa` checklist step keeps that gate visible on your go-live list. * [PHI audiences](/compliance/phi-audiences) and the [PHI audiences setup guide](/guides/hipaa-phi-audiences) to define which patient segments may receive SMS at all, and what content classes are excluded from the channel. * [Archival export](/compliance/archival-export) to retain and export patient messaging records under the HIPAA basis your privacy officer documents. The bundle drafts assume a business-to-patient relationship with written notice at intake. If you message on behalf of multiple covered entities, review the BAA scope before you submit the profile. ## Financial services Start with `fintech_kyc`. Its drafts split cleanly into the two consent categories a financial tenant must keep separate: transactional and security messaging (transaction alerts, fraud alerts, statements) and promotional messaging, which the pack's `configure_transactional_optin` gate forces you to map explicitly. The provisioned assistant never collects full government ID numbers, card numbers, passwords, or one-time passcodes over chat, and escalates suspected fraud to a human. If you also collect payments by SMS or chat (card-on-file updates, past-due balances), activate `pci_payment_collection` as a second, separate activation: its drafts send a hosted payment link instead of ever taking card data in the message. Pair the bundles with: * [10DLC registration](/guides/10dlc-registration) for the carrier-side brand and campaign registration your financial use cases ride on. * [KYC identity model](/compliance/kyc-identity-model) and [KYC submission runbook](/compliance/kyc-profile-submission-runbook) for the verification documents the profile asks you to attach. * [Recording consent](/compliance/recording-consent) for any voice surface that sits next to your messaging program. * [Audit ledger posture rollup](/compliance/audit-ledger-posture-rollup) and [evidence binder](/compliance/evidence-binder) to assemble the trail an examiner or auditor requests. Where a retention obligation such as SEC 17a-4 or FINRA 4511 applies to your firm, map its retention periods onto [archival export](/compliance/archival-export) and keep the bundle's activation and checklist entries in the org audit log as part of the record set. ## Higher education No dedicated higher-ed bundle ships today, so compose the posture from the same primitives the packs use. Register your traffic under the education use cases described in [compliance profile use cases](/compliance/compliance-profile-use-cases), and read [10DLC vs education customer data](/compliance/ten-vs-educate-customer-data) before you decide what student data may appear in a campaign audience. Set these controls alongside: * [COPPA minors posture](/compliance/coppa-minors-posture) for any audience that includes minors: applicant, youth-program, and K-12-adjacent lists need the minors handling the page describes before you send. * [DSAR handling](/compliance/dsar) for student and applicant data-subject requests: access and erasure routing for the same records your campaigns touch. * [Audit export](/compliance/audit-export) so the send history your registrar or counsel needs is exportable. * [Quiet hours](/compliance/quiet-hours-faq) tuned to student local time, including overnight and exam-period windows. If your program includes retail-adjacent flows (campus stores, dining, housing deposits), review the `ecommerce_transactional` drafts as copy starting points and the `pci_payment_collection` drafts for payment links, then activate only if the transactional fit is real: each activation creates its own draft profile and checklist. ## Retail and CPG Start with `ecommerce_transactional`. Its drafts cover the order lifecycle (confirmation, shipping) as transactional messaging and keep re-engagement (cart, review, promo) separate, with the `separate_marketing_optin` gate holding the line between the two consent classes. Pair the bundle with the consent and privacy surfaces your recipient base triggers: * [CAN-SPAM](/compliance/can-spam) for US commercial email that runs next to your SMS program, and [CASL](/compliance/casl-canada-anti-spam) for Canadian recipients: express-consent records and CRTC disclosure requirements are stricter than the US baseline. * [CCPA/CPRA posture](/compliance/ccpa-cpra-posture) for California consumers: sale and share treatment of contact data, and the opt-out-of-marketing path your preference center must honor. * [Opt-in disclosure templates](/compliance/opt-in-disclosure-templates) for the point-of-collection language at checkout, in-store signage, and keyword opt-in: program name, message frequency, rates, and help and stop language. * [Emergency stop](/compliance/emergency-stop) as the kill switch you test before your first promotional blast, not after a bad send. *** ## What activation changes, and what stays yours Activation runs through the vertical-bundles endpoints the dashboard uses: `GET /api/v1/compliance/vertical-bundles` lists the catalog, `GET /api/v1/compliance/vertical-bundles/:key` previews a manifest, and `POST /api/v1/compliance/vertical-bundles/:key/activate` provisions the drafts. The service behind those endpoints fans out to the same profile, campaign, and agent creators you would call individually; the bundle only saves you the wiring. Full lifecycle behavior (duplicates, version snapshots, checklist visibility) is documented in [activation semantics](/compliance/vertical-bundles-activation-semantics). What lands as a **recommended default**, seeded for you to review and edit: | Seeded default | What it encodes | | - | - | | Draft campaign copy | Vertical-appropriate messages with the mandatory STOP/HELP footer and PHI/card-data exclusions | | AI agent system prompt and model | The vertical's refusal rules (no PHI over SMS, no card data in chat, no medical or financial advice) | | Double-opt-in confirmation copy | Program name, help contact, and rates language, substituted with your brand | | Go-live checklist | The shared manual gates plus your vertical's specific gate | What **stays tenant-owned**, untouched by activation: * The inputs you pass at activation (`brand_name`, `help_contact`, `country_code` or `countries`) and every edit you make to the seeded drafts afterwards. * Attaching senders, attaching compliance documents, and submitting the profile for verification. * Your quiet-hours window, consent categories, suppression lists, and the decision to schedule any send. * The legal read on your traffic: your counsel and your regulator, not the bundle. Two mechanics to plan around. Activation is **not idempotent**: a second `POST` for the same bundle creates a second draft profile with a second checklist, so click once per bundle and edit the drafts rather than re-activating. And the checklist is a **tracker, not a send gate**: the real gates are the draft states themselves (draft campaigns do not send, the profile must clear verification). *** ## Anti-patterns * **Treating activation as certification.** An activated bundle is a set of drafts plus a checklist. It is evidence that you started from a reviewed baseline; it is not evidence that you finished. Your audit trail is the submitted profile, the attached documents, and the checklist entries you cleared. * **Activating overlapping bundles expecting a merge.** Activations never merge. Two activations of the same bundle, or of two bundles covering the same traffic, give you two profiles, two checklists, and two carrier verification journeys. If a carrier review fails, fix and resubmit the profile; do not re-activate. * **Reading seeded defaults as regulatory text.** The seeded copy encodes baseline rules (STOP/HELP language, minimum-necessary phrasing, card-data exclusions), but it is starting copy, not the regulation. Your obligations, your disclosures, and your counsel's review produce the final text. Ship the defaults unedited and you ship someone else's assumptions about your program. *** ## Related references * [Vertical Compliance Bundles](/compliance/vertical-bundles): the catalog, the activation endpoints, and the draft-only contract. * [Activation lifecycle semantics](/compliance/vertical-bundles-activation-semantics): duplicates, re-activation, and version pinning. * [10DLC vs education customer data](/compliance/ten-vs-educate-customer-data): the higher-ed data rule set. * [Industries overview](/guides/industries-overview): the buyer pages for [healthcare](https://orbit.devotel.io/en/healthcare), [fintech](https://orbit.devotel.io/en/fintech), [education](https://orbit.devotel.io/en/education), and [retail](https://orbit.devotel.io/en/retail). * [Tenant posture overview](/compliance/posture-overview): the toggle map every bundle default hooks into. This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.