Compliance Posture Is a Quarterly Discipline, Not a Launch Checklist

Quick answer: A compliance posture you configured once and never re-examined is quietly drifting — consent records stale behind real traffic, opt-out flows breaking at re-platform, recording announcements missing in a new region, DSAR exports you have never actually opened. Orbit gives each of those a tenant-owned surface, and this post frames them as one quarterly operational discipline: read the health score for drift, audit consent and recording coverage, exercise the DSAR pipeline end to end, then close with the evidence binder so the quarter ends proven, not just done.

The material underneath this post is the Compliance docs section — 30-plus pages of per-control references. This is the operating rhythm that ties them together.

Posture decays between audits

Compliance configuration behaves like a garden, not a vault. The controls you set at launch — quiet hours per channel, the DNC pre-flight, the preference center, the recording announcement — are point-in-time decisions, and four forces move them without touching a toggle:

• Traffic drifts. You launched with one SMS campaign; by Q3 you run WhatsApp, a dialer, and a reactivation flow a contractor added. A 12,000-recipient import quietly lowers your consent coverage from 98% to 81%. The first place that drift registers is not a carrier throttle but the compliance-health score, which blends consent coverage, opt-out velocity, STOP-reply rate, and carrier rejections into a 0–100 read per organization, sender, and campaign.
• Jurisdictions drift. A US SMS program expands to Brazil (LGPD, 15-day DSAR clock) and the UK. Each market re-asks the consent and disclosure questions you last answered at launch.
• Teams drift. The contractor who wired the preference center left. The quiet-hours override someone set for a Black Friday blast is still on six months later.
• Evidence ages. A proof-of-record export from January answers a January audit. When counsel asks in October, the file you hand them has to cover the traffic you actually ran.

The fix is not more configuration — it is a cadence. Quarterly works because it matches how the data ages: consent windows expire on 90-day and annual boundaries, carrier score windows top out at 90 days, and a statutory DSAR clock is short enough that discovering a broken pipeline during a live request is a breach you chose.

One discipline, three layers of surface

The review below draws on three layers of Orbit surface. Keep them distinct — they answer different questions:

1. Live signal (read-only). GET /api/v1/compliance/health, /health/numbers, /health/campaigns, and GET /compliance/quiet-hours/preview report what the send path will do right now. None of them gates a send or blocks traffic — a low score is advisory until you act on it. This is the layer that catches drift.
2. Enforcement surfaces (default-open). Quiet hours per channel, DNC and RND pre-flight, the suppression ledger, the emergency stop. All of it ships off or empty and stays tenant-configured — Orbit enforces what you set, it never mandates a posture for you. The first-run configuration guide is the launch-time walkthrough of these toggles; the quarterly review assumes they are set and asks whether they are still set correctly.
3. Proof (on demand). The exports and binders are write-once, read-at-audit artifacts: GET /compliance/consent/export, GET /compliance/suppression-list/export, the DSAR export a request produces, and the compliance evidence binder that maps a quarter of posture to a SOC 2 or GDPR framework in one download. Audit log plus checksum means the artifact is itself part of the evidence trail.

Framed this way, the quarterly review has a shape: read layer 1 for what changed, verify layer 2 still reflects your intent, and refresh layer 3 so the quarter closes with proof instead of memory.

A quarterly review in four checks

An hour-ish per quarter for a single-market tenant. Each check names the surface, the failure it catches, and the fix path.

Check 1 — Consent drift (20 minutes)

Surface: GET /api/v1/compliance/consent/export?state=all&from=<quarter-start> (format=csv default) plus the consent-coverage factor on GET /compliance/health. Field details: Export Consent & Suppression Records and Compliance Health Scores.

What you are looking for:

• Coverage dropped while volume grew — the org score's consent_coverage factor slid from ok (≥95%) toward warn (80–95%) and the raw signals show recipientsContacted rising faster than recipientsWithConsent. That is a list import or a new capture path that never wrote consent records: close the gap in the Consent API flow (POST /api/v1/compliance/consent), not in the score.
• Export rows with source: import and a stale consent_text_version — evidence that an old CSV is still the only consent proof for current traffic. Re-capture through the live path so each row carries the current policy_template and consent_proof_url.
• valid_until values that expired inside the quarter — time-bounded consent that nobody renewed.

Fix path: the export's channel, from, and contact_id filters narrow to the offending slice; write the missing consent records over the Consent API, then re-read GET /compliance/health with a fresh window_days to confirm the factor recovered. It pairs naturally with the GDPR posture guide — lawful_basis on each row is exactly what that checklist asks for.

Check 2 — DSAR readiness (15 minutes)

Surface: the DSAR pipeline — the operator queue (GET /compliance/dsar), the SLA snapshot (GET /compliance/dsar/sla), and the public portal under /compliance/public/dsar.

The failure this check catches is not a late request — it is a pipeline you have never exercised, discovered live: the privacy-request link on your site pointing nowhere, an unconfigured OTP sender, an export nobody has downloaded.

The exercise:

1. File one request against your own contact record — call it "the fire drill." Verify it appears in GET /compliance/dsar alongside real traffic, with the portal-filed ones pre-marked verified.
2. Read the SLA snapshot. GET /compliance/dsar/sla returns per-request days_remaining and a severity tier scaled to each jurisdiction's deadline (GDPR 30 days, CCPA/CPRA 45, LGPD 15 — alerting at the same fraction of its own clock). Anything in alerts.breached or a growing approaching count is a staffing problem surfacing a quarter early.
3. Download one export. An access request's signed export_url expires — open it, confirm the file contains what you would actually hand a data subject, and confirm your team knows where tables_exported describes the row counts.
4. Re-check the jurisdiction mix. If you launched GDPR-only and now market into California or Brazil, your 30-day assumption is wrong for a share of the queue. New-market requests need their applicable_jurisdiction set correctly at intake — the SLA tracker grades against whatever the request carries.

Check 3 — Recording-consent audit (15 minutes)

Surface: the per-organization recording policy — Voice → Calls → Recording settings, persisted as settings.recording.{eligibility_mode, consent_announcement_mode} — and the reference in Call Recording Consent.

What decays here is coverage, not configuration. The policy is a two-axis model — eligibility_mode decides which calls record, consent_announcement_mode decides who hears the notice — and a correct-at-launch pairing goes stale when:

• You start dialing into a two-party-consent state or country while consent_announcement_mode still says announce_caller (caller-only). All-party jurisdictions need announce_all.
• Someone demos with eligibility_mode: manual, promotion to all_calls happens later, and the announcement mode is left at none. Orbit surfaces an in-app warning for exactly this pairing — auto-recording with no announcement — and the quarterly check is where you catch a warning that got dismissed.
• A new agent-assist or QA flow starts capturing calls the announcement copy never mentioned.

The audit: read the current two settings, list the jurisdictions you actually placed or received calls in this quarter (call logs group by destination), and compare announcement mode against the strictest of them. Recording law varies by destination, caller location, call purpose, and industry — confirm the pairing with counsel; the check is to make sure the question gets asked before a complaint asks it.

Check 4 — Close with evidence (10 minutes)

Surface: the compliance evidence binder plus the two proof exports.

1. Re-run GET /compliance/consent/export and GET /compliance/suppression-list/export for the quarter and archive both — the suppression export at status=all preserves revoked rows, so the file proves re-permissioning, not just the active blocklist. These are the audit-file answers to a TCPA or GDPR inquiry.
2. Generate a binder — Settings → Compliance → Binder, pick the framework (SOC 2 for a procurement ask, GDPR for the privacy file) and the format. Even when nobody is asking, a quarterly generation builds the habit and a comparable archive: two generations over the same data are byte-identical and carry a SHA-256 checksum, so quarter-over-quarter diffs are mechanical, and a tamper-flagged generation — the integrity check on the audit chain — surfaces while there is still time to investigate.

The binder only assembles what your workspace already produced; it is tenant-generated evidence of your own posture, not a compliance attestation from Orbit. Which brings up the boundary the whole discipline depends on.

Tenant-owned tooling, not a compliance guarantee

Every claim above is about surfaces a tenant operates. Orbit's side of the line is deliberately narrow:

• What Orbit provides: the consent record store and its proof exports, the send-time gates (quiet hours, suppression, DNC/RND pre-flight — all tenant-configured, default-open), the DSAR intake and fulfilment pipeline with jurisdiction-scaled SLA tracking, the recording announcement mechanics, the health score, and the binder generator. All of it is tenant-owned configuration; none of it blocks traffic you have not told it to block, with one platform rail (the federal voice window for US campaign/dialer calls) documented as such.
• What Orbit does not provide: the determination of which obligations apply to your traffic, consent language, recording policy, jurisdictional analysis, or a passing grade. Orbit enforces what you configure — it never mandates a posture for you, and none of the surfaces above substitutes for qualified counsel. The score, the exports, and the binder make your posture visible and provable; they do not make it correct.

That boundary is the reason the discipline is operational, not decorative: the platform hands you the readouts and the proof machinery, but the quarterly loop — read, audit, exercise, archive — only runs if you run it.

Frequently asked questions

Is Orbit's compliance-health score a compliance certification?

No. The score is a read-only early-warning blend of four signals — consent coverage, opt-out velocity, STOP-reply rate, and carrier rejections — computed per organization, sender, and campaign over a rolling window. It tells you which surface a carrier is about to act on before traffic degrades. Nothing about it blocks a send, and no score certifies your posture; corrective action and legal judgement stay with you and your counsel.

Do I have to configure everything before my first send?

No — the send-time gates ship off or empty by default, and Orbit enforces only what you turn on. That is exactly why the first-run checklist and the quarterly review both exist: the first-run guide gets the posture set deliberately at launch, and the quarterly cadence re-verifies it as traffic, markets, and team change. Skipping both leaves every gate open — sends are not held by quiet hours, not screened against a registry, and unproven for audit.

Which DSAR deadlines does the SLA tracker handle?

The tracker's applicable_jurisdiction covers GDPR (30 days), CCPA and CPRA (45), LGPD (15), PDPA, PIPEDA, and DPDP (30), and its severity tiers scale proportionally to each window rather than anchoring to one deadline. Operators can reclassify jurisdiction after intake when a request arrives under the wrong assumption — the SLA readout grades against whatever the request carries, so intake accuracy is part of the quarterly check.

What does the evidence binder actually contain?

One signed download mapping your existing compliance data — audit-log volume, access-review posture, consent and retention configuration, breach-incident counts — onto a public framework's control matrix (SOC 2, ISO 27001, GDPR, or HIPAA). Evidence is aggregate and hashed by construction (no phone numbers, message bodies, or keys), two generations over the same data are byte-identical with a SHA-256 checksum, and the signed link expires after 24 hours. It is your own evidence, assembled for an auditor — not an attestation from Devotel.

Does the quarterly review replace the first-run configuration guide?

No, they are complements. The first-run guide is the launch-time order of operations for the tenant-owned gates — consent baseline, suppression import, quiet hours, country rules, DNC/RND pre-flight, the emergency stop. The quarterly review assumes those are set and asks whether they are still correct after a quarter of drift, then closes with fresh proof exports and a binder. Run the first-run once per market, run the review every quarter.

The takeaway

A posture that survives contact with a real audit is not the one with the most toggles flipped — it is the one whose owner can prove, for any given quarter, what the consent record said, how the send path was gated, whether the DSAR clock was met, and which announcement callers heard. Orbit puts a read-only score in front of that, exports and binders behind it, and leaves every enforcement decision in your tenant's hands. The quarterly loop above is the smallest cadence that keeps the three layers — signal, enforcement, proof — telling the same story.