> ## Documentation Index
> Fetch the complete documentation index at: https://docs.orbit.devotel.io/llms.txt
> Use this file to discover all available pages before exploring further.
# Vertical Compliance Bundles
> One-click HIPAA, fintech-KYC, e-commerce, and PCI payment-collection packs that provision a draft compliance profile, draft campaigns, a vertical-tuned AI agent, and an opt-in flow — then walk you through a go-live checklist.
# Vertical Compliance Bundles
Vertical bundles are a catalog of pre-packaged activation packs for regulated
traffic families: **healthcare (HIPAA)**, **fintech (KYC)**, **e-commerce**,
and **payments & collections (PCI)**. Each pack provisions everything a new
workspace in that vertical needs in one click: a draft compliance profile,
draft campaigns, a vertical-tuned AI agent, an opt-in confirmation flow, and
an in-product go-live checklist.
The catalog and activation flow live at
**Settings → Compliance → Vertical bundles**.
Activate a pack early, while you are still setting up a workspace. The
resources it provisions are drafts you review and edit — nothing sends
until you work the go-live checklist and submit the compliance profile for
verification.
***
## What activation creates — draft only
Activation is **one-click, draft-only**. For the pack you choose, Orbit
provisions four kinds of resources:
| Resource | What you get |
| ---------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
| **Compliance profile** | A draft profile for the vertical's primary use case (for example, a US 10DLC SMS business registration). |
| **Draft campaigns** | Three to five message templates tuned for the vertical — appointment reminders for healthcare, KYC and account alerts for fintech, order lifecycle and re-engagement for e-commerce. |
| **Vertical-tuned AI agent** | An assistant with a system prompt written for the vertical's rules — for example, the healthcare assistant refuses to carry PHI over SMS and routes emergencies to 911. |
| **Opt-in confirmation flow** | Seeded double-opt-in copy with your brand name and help contact substituted in. |
**Draft means draft.** Activation wires **no carrier** and places **no
outbound send.** Every provisioned resource — the profile and every
campaign — is a draft that stays unsent until you review it, submit the
profile for verification, and attach your senders. The pack sets your
starting defaults; the send decision is always yours.
***
## The four-step flow
The page walks you through four steps. The dashboard calls the API as
follows — the same endpoints are available if you script activation instead
of using the UI.
### 1. List the packs
The catalog lists the shipped packs with a summary, campaign count, and
checklist step count for each.
* Endpoint: `GET /api/v1/compliance/vertical-bundles`
* Dashboard: cards rendered on the Vertical bundles page.
### 2. Preview the manifest
Open **View pack contents** on a card to see exactly what activation
provisions **before** you commit — every draft campaign's message template,
the AI agent's system prompt, the double-opt-in confirmation copy, and the
go-live checklist, fetched lazily while the dialog is open.
* Endpoint: `GET /api/v1/compliance/vertical-bundles/:key`
A `404` on an unknown pack key means the key is not in the shipped catalog.
### 3. Activate
Press **Activate pack** (optionally filling in your brand name, help
contact, and ISO-2 country code to brand the seeded copy), then confirm.
* Endpoint: `POST /api/v1/compliance/vertical-bundles/:key/activate`
* Optional body fields: `brand_name`, `help_contact`, `country_code`
(ISO-2), or `countries` (an ISO-2 list that takes precedence over
`country_code`).
Activation returns the full activation state: the provisioned compliance
profile id, the draft campaign ids, the agent id, and the go-live checklist.
Every activation and checklist change is written to the audit ledger — see
[Audit log](/guides/audit-log).
### 4. Work the go-live checklist
The page renders the returned checklist and keeps you on it until go-live.
The checklist is a mix of two step kinds:
* **Provisioned** steps — the resources activation created, marked done
automatically.
* **Manual** steps — gates only you can clear: attach required compliance
documents, submit the profile for verification, review the double-opt-in
copy, confirm the quiet-hours window, and approve campaign copy. Toggle a
manual step done or pending as you complete it.
* Toggle endpoint:
`PATCH /api/v1/compliance/vertical-bundles/activations/:profileId/checklist/:stepId`
with `{ "status": "done" }` or `{ "status": "pending" }`.
* Read back the checklist anytime:
`GET /api/v1/compliance/vertical-bundles/activations/:profileId`.
If you activated earlier in another session, reopen from **Resume a previous
activation** — a list of packs you already provisioned, so a reload never
strands you.
***
## Roles and audit
| Action | Who |
| ------------------------------------------------ | --------------------------------------- |
| List packs, preview a manifest, read a checklist | `owner`, `admin`, `developer`, `viewer` |
| Activate a pack, toggle a checklist step | `owner`, `admin`, `developer` |
Activation and checklist updates are audit-logged with the actor's user id
and the provisioned profile id, so the go-live trail is reconstructible.
***
## Tenant-owned controls
Vertical bundles are a **tenant-owned posture**: the pack ships the vertical's
sensible defaults, and your workspace stays responsible for the rest —
attaching senders, confirming the copy, and clearing the go-live checklist.
The pack does not decide that a send is compliant; it gives you a reviewed
starting point for the vertical and a checklist that keeps go-live gates
visible. The pages under
[Your Tenant Compliance Posture](/compliance/posture-overview) describe the
toggle map these defaults hook into.
***
## Worked examples
### List the packs
`GET /api/v1/compliance/vertical-bundles` returns the catalog summaries:
```json theme={null}
{
"bundles": [
{
"key": "healthcare_hipaa",
"version": "1.0.0",
"displayName": "Healthcare (HIPAA-conscious patient messaging)",
"vertical": "healthcare",
"campaignCount": 4,
"checklistSteps": 6
},
{
"key": "fintech_kyc",
"displayName": "Fintech (KYC onboarding & account alerts)",
"vertical": "fintech"
},
{
"key": "ecommerce_transactional",
"displayName": "E-commerce (order lifecycle & re-engagement)",
"vertical": "ecommerce"
},
{
"key": "pci_payment_collection",
"displayName": "Payments & Collections (PCI-safe payment collection)",
"vertical": "payments"
}
]
}
```
### Preview a manifest
`GET /api/v1/compliance/vertical-bundles/healthcare_hipaa` returns the full
manifest — complete draft-campaign copy, the agent, the opt-in copy, and the
checklist:
```json theme={null}
{
"key": "healthcare_hipaa",
"version": "1.0.0",
"displayName": "Healthcare (HIPAA-conscious patient messaging)",
"campaignTemplates": [
{ "slug": "appointment_reminder", "name": "Appointment reminder" },
{ "slug": "prescription_refill", "name": "Prescription refill ready" },
{ "slug": "post_visit_followup", "name": "Post-visit follow-up" }
],
"agent": { "name": "Patient Intake Assistant", "type": "chatbot" },
"doubleOptIn": { "confirmationCopy": "Reply YES to receive ..." },
"checklist": [
{ "id": "attach_documents", "kind": "manual" },
{ "id": "submit_profile", "kind": "manual" }
]
}
```
(Fields abbreviated — the live manifest carries the full message templates,
the agent's system prompt, the opt-in confirmation copy, and every checklist
step.)
### Activate
`POST /api/v1/compliance/vertical-bundles/healthcare_hipaa/activate` with a
branded body:
```json theme={null}
{
"brand_name": "Acme Clinic",
"help_contact": "front desk",
"country_code": "US"
}
```
returns `201` and the full activation state:
```json theme={null}
{
"bundleKey": "healthcare_hipaa",
"version": "1.0.0",
"complianceProfileId": "cprof_01J9...",
"campaigns": [
{ "slug": "appointment_reminder", "id": "cmp_01J9..." },
{ "slug": "prescription_refill", "id": "cmp_01J9..." },
{ "slug": "post_visit_followup", "id": "cmp_01J9..." },
{ "slug": "billing_notice", "id": "cmp_01J9..." }
],
"agentId": "agt_01J9...",
"checklist": [
{ "id": "attach_documents", "status": "pending", "kind": "manual" },
{ "id": "submit_profile", "status": "pending", "kind": "manual" },
{ "id": "review_optin_copy","status": "pending", "kind": "manual" },
{ "id": "review_quiet_hours","status":"pending", "kind": "manual" },
{ "id": "sign_baa", "status": "pending", "kind": "manual" },
{ "id": "review_campaign_copy","status":"pending","kind":"manual" }
]
}
```
### Checklist states
Each checklist step is in one of the states below; provisioned resources are
marked `done` by activation, and manual gates you toggle yourself as you clear
them.
| Step | Kind | Status as you work | Status when cleared |
| -------------------------------------------------------------------- | ------ | ------------------ | ------------------- |
| `attach_documents` — Attach required compliance documents | manual | `pending` | `done` |
| `submit_profile` — Submit the compliance profile for verification | manual | `pending` | `done` |
| `review_optin_copy` — Review double-opt-in confirmation copy | manual | `pending` | `done` |
| `review_quiet_hours` — Confirm quiet-hours window | manual | `pending` | `done` |
| `sign_baa` *(healthcare only)* — Sign a Business Associate Agreement | manual | `pending` | `done` |
| `review_campaign_copy` — Review and approve campaign copy | manual | `pending` | `done` |
The e-commerce pack adds `separate_marketing_optin` (confirm promotional sends
only target marketing-consented contacts), the fintech pack adds
`configure_transactional_optin`, and the PCI pack adds
`confirm_hosted_payment_page` — same `pending → done` toggle, same manual
kind.
## Limits
* **No send on activation.** The profile and campaigns stay in draft until
you submit the profile and attach senders; nothing is scheduled or sent
on your behalf.
* **Drafts are yours to edit.** The pack seeds starting copy; review and
edit it before go-live — the checklist gates do not clear themselves.