Vertical Compliance Bundles

Vertical bundles are a catalog of pre-packaged activation packs for regulated traffic families: healthcare (HIPAA), fintech (KYC), e-commerce, and payments & collections (PCI). Each pack provisions everything a new workspace in that vertical needs in one click: a draft compliance profile, draft campaigns, a vertical-tuned AI agent, an opt-in confirmation flow, and an in-product go-live checklist. The catalog and activation flow live at Settings → Compliance → Vertical bundles.

Activate a pack early, while you are still setting up a workspace. The resources it provisions are drafts you review and edit — nothing sends until you work the go-live checklist and submit the compliance profile for verification.

What activation creates — draft only

Activation is one-click, draft-only. For the pack you choose, Orbit provisions four kinds of resources:

Resource	What you get
Compliance profile	A draft profile for the vertical’s primary use case (for example, a US 10DLC SMS business registration).
Draft campaigns	Three to five message templates tuned for the vertical — appointment reminders for healthcare, KYC and account alerts for fintech, order lifecycle and re-engagement for e-commerce.
Vertical-tuned AI agent	An assistant with a system prompt written for the vertical’s rules — for example, the healthcare assistant refuses to carry PHI over SMS and routes emergencies to 911.
Opt-in confirmation flow	Seeded double-opt-in copy with your brand name and help contact substituted in.

Draft means draft. Activation wires no carrier and places no outbound send. Every provisioned resource — the profile and every campaign — is a draft that stays unsent until you review it, submit the profile for verification, and attach your senders. The pack sets your starting defaults; the send decision is always yours.

The four-step flow

The page walks you through four steps. The dashboard calls the API as follows — the same endpoints are available if you script activation instead of using the UI.

1. List the packs

The catalog lists the shipped packs with a summary, campaign count, and checklist step count for each.

Endpoint: GET /api/v1/compliance/vertical-bundles
Dashboard: cards rendered on the Vertical bundles page.

2. Preview the manifest

Open View pack contents on a card to see exactly what activation provisions before you commit — every draft campaign’s message template, the AI agent’s system prompt, the double-opt-in confirmation copy, and the go-live checklist, fetched lazily while the dialog is open.

Endpoint: GET /api/v1/compliance/vertical-bundles/:key

A 404 on an unknown pack key means the key is not in the shipped catalog.

3. Activate

Press Activate pack (optionally filling in your brand name, help contact, and ISO-2 country code to brand the seeded copy), then confirm.

Endpoint: POST /api/v1/compliance/vertical-bundles/:key/activate
Optional body fields: brand_name, help_contact, country_code (ISO-2), or countries (an ISO-2 list that takes precedence over country_code).

Activation returns the full activation state: the provisioned compliance profile id, the draft campaign ids, the agent id, and the go-live checklist. Every activation and checklist change is written to the audit ledger — see Audit log.

4. Work the go-live checklist

The page renders the returned checklist and keeps you on it until go-live. The checklist is a mix of two step kinds:

Provisioned steps — the resources activation created, marked done automatically.
Manual steps — gates only you can clear: attach required compliance documents, submit the profile for verification, review the double-opt-in copy, confirm the quiet-hours window, and approve campaign copy. Toggle a manual step done or pending as you complete it.
Toggle endpoint: PATCH /api/v1/compliance/vertical-bundles/activations/:profileId/checklist/:stepId with { "status": "done" } or { "status": "pending" }.
Read back the checklist anytime: GET /api/v1/compliance/vertical-bundles/activations/:profileId.

If you activated earlier in another session, reopen from Resume a previous activation — a list of packs you already provisioned, so a reload never strands you.

Roles and audit

Action	Who
List packs, preview a manifest, read a checklist	`owner`, `admin`, `developer`, `viewer`
Activate a pack, toggle a checklist step	`owner`, `admin`, `developer`

Activation and checklist updates are audit-logged with the actor’s user id and the provisioned profile id, so the go-live trail is reconstructible.

Tenant-owned controls

Vertical bundles are a tenant-owned posture: the pack ships the vertical’s sensible defaults, and your workspace stays responsible for the rest — attaching senders, confirming the copy, and clearing the go-live checklist. The pack does not decide that a send is compliant; it gives you a reviewed starting point for the vertical and a checklist that keeps go-live gates visible. The pages under Your Tenant Compliance Posture describe the toggle map these defaults hook into.

Worked examples

List the packs

GET /api/v1/compliance/vertical-bundles returns the catalog summaries:

{
  "bundles": [
    {
      "key": "healthcare_hipaa",
      "version": "1.0.0",
      "displayName": "Healthcare (HIPAA-conscious patient messaging)",
      "vertical": "healthcare",
      "campaignCount": 4,
      "checklistSteps": 6
    },
    {
      "key": "fintech_kyc",
      "displayName": "Fintech (KYC onboarding & account alerts)",
      "vertical": "fintech"
    },
    {
      "key": "ecommerce_transactional",
      "displayName": "E-commerce (order lifecycle & re-engagement)",
      "vertical": "ecommerce"
    },
    {
      "key": "pci_payment_collection",
      "displayName": "Payments & Collections (PCI-safe payment collection)",
      "vertical": "payments"
    }
  ]
}

Preview a manifest

GET /api/v1/compliance/vertical-bundles/healthcare_hipaa returns the full manifest — complete draft-campaign copy, the agent, the opt-in copy, and the checklist:

{
  "key": "healthcare_hipaa",
  "version": "1.0.0",
  "displayName": "Healthcare (HIPAA-conscious patient messaging)",
  "campaignTemplates": [
    { "slug": "appointment_reminder",   "name": "Appointment reminder" },
    { "slug": "prescription_refill",    "name": "Prescription refill ready" },
    { "slug": "post_visit_followup",    "name": "Post-visit follow-up" }
  ],
  "agent": { "name": "Patient Intake Assistant", "type": "chatbot" },
  "doubleOptIn": { "confirmationCopy": "Reply YES to receive ..." },
  "checklist": [
    { "id": "attach_documents", "kind": "manual" },
    { "id": "submit_profile",   "kind": "manual" }
  ]
}

(Fields abbreviated — the live manifest carries the full message templates, the agent’s system prompt, the opt-in confirmation copy, and every checklist step.)

Activate

POST /api/v1/compliance/vertical-bundles/healthcare_hipaa/activate with a branded body:

{
  "brand_name": "Acme Clinic",
  "help_contact": "front desk",
  "country_code": "US"
}

returns 201 and the full activation state:

{
  "bundleKey": "healthcare_hipaa",
  "version": "1.0.0",
  "complianceProfileId": "cprof_01J9...",
  "campaigns": [
    { "slug": "appointment_reminder", "id": "cmp_01J9..." },
    { "slug": "prescription_refill",  "id": "cmp_01J9..." },
    { "slug": "post_visit_followup",  "id": "cmp_01J9..." },
    { "slug": "billing_notice",       "id": "cmp_01J9..." }
  ],
  "agentId": "agt_01J9...",
  "checklist": [
    { "id": "attach_documents", "status": "pending", "kind": "manual" },
    { "id": "submit_profile",   "status": "pending", "kind": "manual" },
    { "id": "review_optin_copy","status": "pending", "kind": "manual" },
    { "id": "review_quiet_hours","status":"pending", "kind": "manual" },
    { "id": "sign_baa",         "status": "pending", "kind": "manual" },
    { "id": "review_campaign_copy","status":"pending","kind":"manual" }
  ]
}

Checklist states

Each checklist step is in one of the states below; provisioned resources are marked done by activation, and manual gates you toggle yourself as you clear them.

Step	Kind	Status as you work	Status when cleared
`attach_documents` — Attach required compliance documents	manual	`pending`	`done`
`submit_profile` — Submit the compliance profile for verification	manual	`pending`	`done`
`review_optin_copy` — Review double-opt-in confirmation copy	manual	`pending`	`done`
`review_quiet_hours` — Confirm quiet-hours window	manual	`pending`	`done`
`sign_baa` (healthcare only) — Sign a Business Associate Agreement	manual	`pending`	`done`
`review_campaign_copy` — Review and approve campaign copy	manual	`pending`	`done`

The e-commerce pack adds separate_marketing_optin (confirm promotional sends only target marketing-consented contacts), the fintech pack adds configure_transactional_optin, and the PCI pack adds confirm_hosted_payment_page — same pending → done toggle, same manual kind.

Limits

No send on activation. The profile and campaigns stay in draft until you submit the profile and attach senders; nothing is scheduled or sent on your behalf.
Drafts are yours to edit. The pack seeds starting copy; review and edit it before go-live — the checklist gates do not clear themselves.

Getting Started

Channels

Channels (Voice)

AI Agents

Flows

Numbers & Verify

Concepts

Features

Billing

Webhooks

Security & SSO

Compliance

Legal

Changelog

Vertical Compliance Bundles

Vertical Compliance Bundles

What activation creates — draft only

The four-step flow

1. List the packs

2. Preview the manifest

3. Activate

4. Work the go-live checklist

Roles and audit

Tenant-owned controls

Worked examples

List the packs

Preview a manifest

Activate

Checklist states

Limits

​Vertical Compliance Bundles

​What activation creates — draft only

​The four-step flow

​1. List the packs

​2. Preview the manifest

​3. Activate

​4. Work the go-live checklist

​Roles and audit

​Tenant-owned controls

​Worked examples

​List the packs

​Preview a manifest

​Activate

​Checklist states

​Limits

Vertical Compliance Bundles

What activation creates — draft only

The four-step flow

1. List the packs

2. Preview the manifest

3. Activate

4. Work the go-live checklist

Roles and audit

Tenant-owned controls

Worked examples

List the packs

Preview a manifest

Activate

Checklist states

Limits