Quick answer: A citizen-notification program is five different legal and operational problems wearing one logo: the basis each alert class carries, the channel floor for residents without smartphones, the sender identity each market requires, the proof of reach when a reminder bounces, and a budget model a finance office can appropriate. This playbook works each one against controls your office owns on Devotel Orbit — quiet hours, per-country sender-ID rules, channel fallback, number masking, and audit exports — and pairs with the buyer explainer, which covers the procurement framing this post assumes.
1) Alert classes and the basis each one carries
Civic traffic is not one consent story. Split it into five classes and declare the basis per list before the first send, because the classes behave differently under quiet hours, opt-out, and audit.
- Emergency alerts. Evacuations, severe weather, boil-water notices. The basis is the agency's statutory duty to warn, an authority question rather than a marketing-consent question. Your office documents the duty per list, marks the lane urgent, and the quiet-hours window steps aside by that policy switch.
- Appointment and court-date reminders. The resident is a party to a proceeding or a scheduled service; the reminder is part of the service, a transactional send. A missed court-date reminder is a no-show and a missed no-show is a warrant or a rebooked clinic slot, so this class earns retry and voice fallback.
- Utility outage and service-disruption notices. An urgent service notice the residents' right to know about a disruption implies. Outage traffic bypasses the rest window while the restoration update that follows it can respect one.
- Permit, licensing, and status updates. The resident started the file by applying; status updates are administrative-transactional and stay inside the application's own thread.
- Benefit renewals and deadline notices. The statutory-notice lane. A missed renewal notice becomes a legal argument about whether the household was informed, so this class never shares a queue, a sender, or a consent list with anything promotional.
The discipline is the point: none of the five is a marketing send, and none of the five borrows reach from another. An outreach nudge folded into the statutory lane is what turns an audit into a dispute.
2) The channel matrix, with accessibility rows
The matrix below is ordered by who it reaches, not by which channel is newest. Each row is a tenant setting, not a vendor contract.
- Plain SMS is the floor. Every handset receives it, no app install, no data plan, no account login. Plain-text SMS is also the row a screen reader handles without surprises, which makes it the accessibility baseline every other channel has to degrade to.
- Voice callback for low-digital residents. Landline-only households, residents who do not own a smartphone, and residents who read poorly in any language all stay reachable through the voice lane, with text-to-speech rendering that keeps the spoken alert coherent. The accessibility for business messaging guide maps the delivery preferences your office configures per resident.
- Email as the document lane. Long-form notices, attachments, and the formal correspondence a hearing or a benefits decision requires. Email carries the record; it does not carry the alert.
- WhatsApp and RCS where residents actually read. Multilingual resource threads and rich status cards (permit approved, appointment confirmed) for the population that treats chat as the inbox, degrading to SMS when the handset has no rich lane.
- Number masking on the callback path. When a caseworker returns a resident's call, masking keeps the resident's number private on the staff side and the caseworker's direct line private on the resident's side — the accessibility request "call me back" stays a privacy-safe one.
Fallback order is policy you set once: a rich-channel attempt that is undeliverable falls to SMS, and an SMS that cannot land falls to voice. The channel fallback matrix post walks the order options.
3) Sender identity and registration posture per market
Residents must recognize a civic message as genuinely from their government before they act on it, and the recognition has to hold in every market you send into. The posture that survives scrutiny is tenant-owned end to end: your entity documents, your registrations, held in your workspace.
- Per-country sender-ID rules. Alphanumeric sender IDs, registered long codes, and short codes follow rules that change at every border. The country requirements reference is the per-market table, and the sender-ID by market decision tree is the working order for choosing and registering an identity per jurisdiction. The country-by-country sender-ID playbook keeps the registration sequence in one place.
- US 10DLC government posture. Government entities register their own brand and campaign; the registration is a tenant asset your office manages, with the throughput tiering that civic volume justifies rather than a pooled commercial tier.
- Calling windows per market. Routine reminders respect the recipient's local rest window and, in the US, state calling windows; the emergency class bypasses on the urgent switch your policy marks. The state calling windows reference lists the per-state shape, and the quiet-hours control enforces the window you configure at send time.
The common thread: the platform processes the registration and enforces the window, but the identity and the policy belong to the tenant. A shared pool sender would put civic traffic behind someone else's reputation; a tenant-owned loop keeps it provable to the carrier and auditable by your records office.
4) Failed delivery: retry, fallback, and audit evidence
A citizen notification that bounces is not a statistic; it is a resident who never learned about the shutoff or the hearing. The handling loop has three parts.
- DLR-driven retry. Delivery receipts drive the retry schedule per class: an emergency alert retries aggressively and escalates to voice, a permit update retries quietly and waits for the resident's next open.
- Fallback semantics. Undeliverable on the primary channel, the message follows the fallback chain your tenant sets, and the final disposition per attempt is recorded, so "we sent it" is never the answer to an audit.
- Audit-evidence exports. For FOI-style and public-records requests, the audit export produces the per-message delivery evidence your records office hands over: what was sent, to which channel, with which disposition, inside the retention window your workspace configures. The export scopes to your tenant alone, which is the boundary auditors ask about first.
The loop closes the accountability circle: every class has a basis, every send has a disposition, and every disposition is exportable.
5) Budget and total cost of ownership
Public-sector purchasing runs on appropriations, not on SaaS renewals, so the cost shape matters as much as the cost.
- Pay-as-you-go tracks actual volume. Message spend follows the alerts you actually sent, steady-state traffic in ordinary months and disaster-season surges when they come, without a seat count to defend before a budget committee.
- Per-seat incumbent contracts invert the risk. A per-seat platform charges for staff whether or not a message moves, and a disaster season that adds contractors adds license cost at exactly the moment the budget is least flexible.
- Procurement paperwork fits. Quotes and purchase-order artifacts match the appropriation window, and the pricing story is stable enough to survive the committee because the unit of spend is the message, a unit the finance office can estimate from last year's send volume.
The comparison is a cost-shape discussion, not a mandate: an office with predictable staff-driven volume may genuinely prefer seats. The test is whether the contract still fits in the year the volume doubles.
Frequently asked questions
Do emergency alerts respect quiet hours?
Only if your policy says so. The rest window applies to routine traffic; the emergency lane bypasses it through the urgent switch your office marks, and the same switch is the document you show when someone asks why an alert landed at 3 a.m.
What is the basis for a court-date reminder?
The reminder is part of a service the resident is party to, a transactional send. It is not marketing, it does not borrow marketing consent, and it does not stop because the resident opted out of an unrelated outreach lane — opt-out scope is a setting your suppression policy defines.
How do we answer a public-records request about delivery?
With the audit export: the per-message send and delivery evidence inside your configured retention window, scoped to your tenant. The records office answers from your own evidence rather than from a vendor's support ticket.
Can landline-only residents receive alerts?
Yes, through the voice lane. The fallback chain carries an SMS that cannot land to a voice callback with text-to-speech rendering, so the alert content reaches the landline household unchanged.