Frequently asked questions

Devotel Orbit is the Agentic Customer Communications Cloud — one platform spanning nine aaS pillars (CPaaS, CCaaS, UCaaS, AIaaS, NaaS, CSPaaS, RTC PaaS, CXaaS, CDPaaS) with APIs for SMS, WhatsApp, RCS, Viber, Email, and Voice, plus AI-native features like autonomous agents, visual flow builders, and intelligent routing. Build with the CPaaS APIs or run a finished internal phone system on the same tenant.

SMS (global coverage in 190+ countries), WhatsApp Business API (template and session messaging), RCS (rich messaging on Android devices), Viber, Email (transactional and marketing), and Voice (outbound and inbound calls, SIP trunking, IVR, and AI voice agents) — six channels on one bill.

On Google Cloud Platform (GKE Autopilot) in the europe-west1 region (Belgium), with data stored in Cloud SQL PostgreSQL 16 with at-rest encryption.

Pay-as-you-go with no monthly subscription tiers: pre-load credits and outbound usage (messages, voice minutes, AI agent invocations) deducts at per-channel rates. There are no Starter, Growth, or Business subscription plans — only PAYG and Enterprise (negotiated rate card).

Credits are purchased in advance through the dashboard or Stripe Checkout and consumed for messages, voice minutes, and agent invocations. Credits never expire. Enable auto-top-up in Settings → Billing → Auto top-up to prevent service interruption.

No free tier and no automatic trial credit: every account is pay-as-you-go — after KYC approval, fund the balance with a top-up before sending live traffic. The sandbox environment is free to test with before going live.

All phone numbers are in E.164 format — the plus sign, country code, then the subscriber number, e.g. +14155552671 (US), +447911123456 (UK).

Delivery channels — sms, whatsapp, email, voice, viber, telegram, rcs, and flashcall — carry a code to the recipient. Factor channels — totp, push, backup_code, sna, silent, and magic_link — validate possession of a secret or device with no code delivered, and are enrolled and verified through their own /verify/factors/*, /verify/push/*, and /verify/passkey/* endpoints.

A 429 with RATE_LIMIT_EXCEEDED means one of three rate-limit layers tripped: the per-API-key limit, the org-wide per-recipient limit, or the per-recipient brute-force lockout that stops code-guessing attacks. Honour the Retry-After header when present and retry instead of hammering the endpoint; VERIFY_RESEND_COOLDOWN (also 429) is the per-recipient OTP resend cooldown tripping on a re-send, distinct from the org-wide layers.

A direct send expires after 600 seconds (10 minutes) by default; set expirySeconds on a verify profile (up to a 60-minute ceiling) to change it. max_attempts (1–10, default 3) caps how many /verify/check calls can guess a code before the verification fails and needs a fresh send; a /check that arrives after expiry returns 410 EXPIRED_TOKEN and a wrong code returns 422 with the remaining attempts.

It returns a computed day-by-day ramp: the daily send caps that grow a fresh sending IP or domain from a conservative day-1 volume (default 50/day) up to the target daily volume, at a default ~50%/day growth factor. A companion status endpoint reports which ramp day the account is on, today's recommended cap, how much has already gone out, and the remaining headroom, and an enforcement endpoint turns a requested batch size into an accept/defer decision against today's live cap.

Respect the daily cap: throttle or gate the send instead of pushing full volume, and use the warmup-enforcement endpoint as the one authoritative accept/defer decision. The same ramp principle applies to a newly provisioned long code, short code, or alphanumeric sender ID — start with a small daily cap to engaged recipients with full SPF/DKIM/DMARC in place.

Every webhook includes an X-Orbit-Signature header (the canonical HMAC-SHA256 signature); a legacy X-Devotel-Signature header is also included for backwards compatibility. Verify either signature by computing the HMAC of the raw request body using your webhook secret.

Orbit retries failed deliveries on an exponential backoff schedule: up to 9 retries with a 30-second base delay (doubling with each attempt), spanning roughly 4.3 hours end-to-end, plus up to 20% jitter on each delay. After all attempts are exhausted, the event goes to a dead letter queue, and failed deliveries are reviewable in the dashboard.

Compliance gates are tenant-owned and open by default: you decide which controls enforce and which observe. An enabled toggle may not block yet because the control is still warming to its enforcement threshold or an external approval is pending; ops-facing controls are fail-open where a hard stop would break sends, and privacy / consent controls are fail-closed. The full posture map covers which controls fail open versus closed, which approvals carry external lead time, and the tenant-owned toggle surface.

Email support@devotel.io, use the in-app chat help widget in the dashboard, or — on Enterprise — reach the dedicated Slack channel and account manager.

status.orbit.devotel.io carries real-time platform status, incident history, and maintenance schedules.

Email security@devotel.io. Reports are answered within 24 hours and handled under responsible disclosure practices.