Compliance as product

Most outbound tools position themselves as neutral pipes: you bring the list, they carry the messages, and the compliance question is yours. GTM sources leads itself. That makes us a controller of that data in our own right. A reading with roughly triple the compliance surface, taken deliberately, because the alternative is a product that works only when the customer already did the hard part.

Five features follow directly from that choice. Each one had to be built into the foundation, because none of them can be bolted on later.

• Per-field provenance. Every field on a contact records where it came from and when. Queryable per contact, not asserted in a policy PDF.
• Retention anchored to collection. Data expires from when we collected it, never from when it was last touched. Anchoring to last-updated quietly makes retention infinite; a European regulator fined a data vendor €240,000 for exactly that.
• A pre-send gate. Jurisdiction × entity type × lawful basis, evaluated before every send, with the database refusing an ungated message as a constraint violation.
• Suppression that outlives everything. Opt-outs are honored at workspace and platform scope, and suppression records are exempt from every purge. Deleting a contact must never mean forgetting they said no.
• Injected notices. The unsubscribe link, postal address, and localized notice are appended by the platform, not the sender, and cannot be turned off.

One detail from the list deserves its own paragraph. When a reply arrives, a plain keyword pass runs before any AI classification touches it. “Please stop emailing me” written in prose stops the sequence and writes the suppression whether or not a model would have read it correctly, because a missed opt-out is a regulatory failure and a missed nuance is only a wrong badge in an inbox. The order of those two passes is a compliance position, not an implementation detail.

Because the buyers we want check. An agency signing a client, a founder selling into Europe, an enterprise security review. All of them eventually ask where the data came from and when it dies. A product that can answer per field, from day one, is the difference between a procurement question and a procurement problem.