Tenant-owned compliance: the conduit and the ledger

Conduit plus ledger — the two roles

Orbit is the conduit: it routes your messages and calls and executes the gates you configure. It is also the ledger: it keeps the auditable record — consent decisions, suppression entries, certifications, traceback cases, scrub results — so the posture you set is also the posture you can prove.

What Orbit never does is own the decision. It never files with a regulator for you, never sends a customer notice for you, and never decides that a send is "compliant." Opt-in lists, dialing windows, suppression scopes, residency choices, country blocks — those are business decisions whose correct answer differs per tenant, per use case, per jurisdiction. A platform that decided them for you would either be too strict or too loose, and the liability is priced against your business either way.

So the platform ships the control surface, the enforcement machinery runs uniformly, and the policy it enforces is yours.

Defaults open — fail-open where the risk is yours

Every compliance control except one ships off. Quiet hours, DNC and spam and consent scrubs, GDPR data-residency, country blocks, frequency caps, sender-ID country rules — each stays inert until you switch it on. Two consequences follow:

• Fail-open on infra trouble. A gate whose risk is yours to price must not silently black-hole your outbound because an infra hiccup made your configuration unreadable. Tenant-owned gates resolve an unresolvable input to allow(a skip policy) by default and log it.
• Fail-closed only where the platform owns the rail. Exactly one control — described below — resolves an unresolvable input to refuse.

The posture you choose is additive: you tighten from an open default, you do not loosen from a restrictive one.

The one platform-global rail: the federal dialing window

There is exactly one control the platform owns outright, for all tenants, with no opt-out flag: the US federal TCPA voice dialing window — 8 AM–9 PM recipient-local for outbound calls to +1 recipients.

Why this one has no tenant opt-out when everything else does: the statutory exposure on an out-of-window call is assessed per call against whatever platform carried it, not against the tenant whose setting was wrong. Every other gate carries a misconfiguration risk you can price yourself, so the control is yours to disable. The federal window carries a liability that is not yours to waive, so the control is not yours to disable.

It is also the one fail-closed surface: an unresolvable recipient timezone on a +1 voice send is blocked even at 2 PM inside the nominal window, because without a timezone the platform cannot prove the call sits inside the window and the per-call penalty floor is too high to guess. Voice to US recipients is the exception called out on the quiet-hours row of the docs posture map.

What the ledger records

The conduit claim is hollow without the ledger. Every control you set writes an auditable record you can read back and export:

• Consent receipts — each opt-in or opt-out decision with its capture surface, timestamp, and scope.
• Suppression entries — the tenant-scoped list every send-time gate reads, with the entry point (STOP keyword, Consent API, preference center, bulk import) preserved.
• Compliance profiles and KYC documents — the submissions behind regulated-market numbers and senders, with their lifecycle status.
• BAA and posture commitments — the HIPAA mode, its executed BAA, and re-execution before the one-year term expires.
• Scrubs and checks — DNC, RND (reassigned numbers), and country-rule verdicts with the per-request decision.
• Traceback and ITG cases — disputed-call evidence bundles carried through the industry traceback group.
• An append-only audit log with a chained-hash record format — tampering breaks the chain and fails the integrity check on read.

The ledger reflects what you did; the decisions stay yours. That split is the entire model.

The health score is a signal, not a gate

Orbit computes a rolling 0–100 compliance-health score per tenant — a rollup of the controls it can see you configuring plus the send-time events your traffic raises. Read it as a checking instrument: indication, never enforcement. A score never blocks, never permits, and never substitutes for a counsel-reviewed posture. It exists so "did I actually wire in the things I intend to have wired in?" has a number you can watch and alert on when it drops.

Where to go next

• Security — the platform-side controls pair (encryption, tenant isolation, access).
• Posture overview — the full toggle map: which surfaces are tenant-toggleable, what defaults open, what fails open versus closed, and five reference postures you can copy.
• Tenant-owned compliance model — the concept anchor the docs group assumes, with the deep-page links each row of the map points at.

Evaluating Orbit for a regulated workload?

If your security or procurement review needs a signed DPA, a custom data-retention agreement, or a security questionnaire response, talk to us — the tenant-owned model above is the standing answer to "who owns the compliance posture."