Compliance

It drives five features that cannot be retrofitted. Each one is a schema decision or an enforcement point rather than a setting, because every one of them is unwindable only by migration.

Per-field provenance

Where each field on a contact came from, queryable per contact. Not a source label on the record — a source per field, because a contact assembled from a LinkedIn headline, an enrichment callback and an operator edit has three different answers to “where did this come from”.

Retention anchored to collection

retention_expires_at is computed from collected_at, never from last_updated_at. Anchoring to last-updated means a record that keeps getting touched never expires, which is the exact finding that cost Kaspr €240k. A daily purge job deletes what is past its window, in batches.

The pre-send gate

Jurisdiction × entity type × lawful basis, evaluated on every outbound message. It is the last thing before a send and the database agrees: a constraint refuses an outbound row reaching sent without a gate verdict and an unsubscribe URL. A bug in the launcher fails as a constraint violation rather than as a delivered email.

Suppression at two scopes

Workspace and platform. Platform scope survives every workspace, and both are exempt from every purge — a suppression list that could be deleted by a retention job would re-open contact with someone who asked not to be contacted.

Opt-out beats classification

The reply poller runs a keyword pass before it runs the model. A missed opt-out is a regulatory failure; a missed nuance is a wrong badge in the inbox. The two are not comparable, so the cheap deterministic check goes first.