​

Outbound compliance pre-flight checklist

Every outbound send on Orbit is admitted through a chain of gates before it reaches a provider. The send-gating model maps those gates and the order a send walks them. This checklist turns that map into a pre-launch pass: confirm each gate’s posture before a campaign opens, so a blocked row is a surprise you chose, not a gate you forgot to check. Run the checklist top-to-bottom — the order below mirrors the admission chain, so each check you pass is one fewer gate that can refuse your traffic mid-blast. Assign an owner per item, exactly like the production go-live checklist (which covers numbers, channels, and members — this page covers only outbound compliance).

​

1. Wallet posture — can the org send at all?

The wallet/billing gate is the first flag a send consults after quiet hours and duplicate-content are claimed. Resolve it first: nothing else matters until the org can legally open money.

• Balance is funded for launch volume plus headroom. A zero balance pauses the whole org with 402 SENDING_PAUSED; top up before the blast and let auto-resume lift the pause. Owner: Operations/Finance.
• No billing-alert pause or dunning hold is active. Read GET /api/v1/billing/balance — confirm outbound_paused is false and check outbound_block_reason for a hint if it isn’t. Owner: Operations/Finance.
• Billing alerts and actions won’t trip mid-campaign. An alert pause firing during the blast halts every remaining send; set thresholds above expected spend. Owner: Operations/Finance.

See Wallets, credits, and charges for the ledger and pause-flag semantics.

​

2. Opt-out and suppression — is the block list current?

Recipient block lists are consulted per recipient, after the org-level gate. A send to a suppressed address drops as a skipped row (campaign) or 422 RECIPIENT_OPTED_OUT (direct).

• Bulk-import the existing suppression list before launch. Upload the CSV you migrated from a prior platform or a partner list — per-row results, deduplicated against what’s already on file. See Opt-out & suppression lists. Owner: Compliance/Operations.
• Re-export and cross-check the live list. Use the suppression export to confirm the totals you expect post-import. Owner: Compliance.

​

3. Quiet hours — which window governs this send?

The quiet-hours evaluator is the first content-level gate and fails closed for marketing traffic. Decide the window before scheduling anything.

• Choose the org gate or the campaign fallback window explicitly. Public 1:1 sends follow the per-channel org toggle; drip/journey sends with no per-campaign window fall back to the org-wide default. Decide which one governs this send — don’t let a surprise fallback pick the window. See Quiet hours configuration. Owner: Operations/Compliance.
• Confirm the timezone policy for unresolvable recipients. Under a deny policy a recipient whose timezone can’t be resolved is blocked (422 QUIET_HOURS_TIMEZONE_UNKNOWN); pick that outcome consciously. Owner: Compliance.

​

4. Frequency caps — are per-contact limits set?

Frequency caps claim a slot per recipient; over the cap, direct sends get 429 FREQUENCY_CAP_EXCEEDED and campaign sends skip with frequency_capped. Set them before the blast, not after complaints.

• Configure rolling-window caps per channel and use case. Marketing gets recipient-facing caps; system traffic gets coherent limits. See Frequency caps. Owner: Operations.
• Distinguish caps from duplicate-content suppression. Caps limit how many sends; the message suppression content-hash policy blocks the same body re-sent inside a window. Set whichever one addresses the actual risk. Owner: Operations.

​

5. Compliance profiles — is the destination cleared?

Regulated destinations carry registration and profile requirements a send checks before dispatch.

• Evaluate eligibility for the destination before launch. Run GET /numbers/available’s requires_registration evaluation for the target market so a blocked destination is caught pre-launch, not at send time. See Assemble your tenant’s compliance posture. Owner: Compliance.
• Attach the required compliance profile for regulated traffic. HIPAA-mode sends are blocked until a BAA is executed and in term; confirm the profile before opening the campaign. See Send gates. Owner: Compliance.

​

6. TCPA federal voice window — if the campaign has a voice leg

For US (+1) recipients, the federal TCPA 8 am–9 pm recipient-local dialing window hard-blocks campaign and dialer voice regardless of tenant settings — there is no toggle, and a recipient whose timezone can’t be resolved is blocked outright.

• Schedule voice calls inside the recipient-local 8 am–9 pm window. Use the preview endpoint below to find the next allowed time per recipient. See Send gates: US voice TCPA. Owner: Operations/Compliance.
• Resolve recipient timezones before the blast. An unresolvable timezone hard-blocks the call on campaign/dialer traffic; supply recipientTimezone where you know it. Owner: Compliance.

​

7. Dry-run — preview the gates before the send

Two read-only endpoints answer “would this send go through right now?”:

• GET /api/v1/compliance/quiet-hours/preview?phone=<E.164>&channel=<channel> — is the recipient inside the permitted local window, and when does it next open? Call pattern in Send gates: Quiet hours.
• GET /api/v1/compliance/dnc/check?phone=<E.164> — is the number on a block list (on_dnc, plus the flagging source)? Call pattern in Send gates: DNC.
• Run the quiet-hours preview for a sample of recipients across the target time zone spread. Owner: Engineering/Operations.
• Run the DNC check (or batch POST /compliance/dnc/scrub for the whole list, up to 500 numbers per request) for the campaign audience. Owner: Compliance.

​

8. Post-launch — count blocked rows by error code

After the campaign fires, open the delivery log and group blocked sends by the gate that refused them. The error codes reference maps each code to a gate; the troubleshooting pages walk the resolution.

• 402 SENDING_PAUSED / SENDING_BLOCKED — wallet/billing flag. Poll GET /billing/balance until the flag clears, then resume.
• 422 RECIPIENT_OPTED_OUT / skipped opted_out — block-list hit. Remove the recipient from the audience until they re-consent.
• 422 QUIET_HOURS_BLOCKED — outside the window; reschedule at next_allowed_at. On US voice, 422 TCPA_FEDERAL_DIALING_WINDOW_BLOCKED — see TCPA window blocked calls.
• 429 FREQUENCY_CAP_EXCEEDED / skipped frequency_capped — over a cap you set; honor retry_after_seconds or widen the cap deliberately.
• 422 HIPAA_BAA_REQUIRED — HIPAA-mode blocked until the BAA is executed. See Phi audience BAA required.
• The rest of the gate-specific codes — quiet-hours timezone resolution, DNC/RND scrub gates, emergency stop — map at Send gates and the error codes reference.

A campaign with a verified scrub should see blocked rows only where you deliberately chose a strict gate; the goal of this checklist is to shrink that set to the intended one.

​

See also

• Send-gating model — the gate map and admission order this checklist walks.
• Production go-live checklist — numbers, channels, members, and billing readiness; this page covers only the outbound-compliance pre-flight.
• Send gates — BAA, quiet hours, DNC/RND/RMD scrub, and the emergency stop.
• Error codes — the full blocked-row map.