Compliance

It drives four features that cannot be retrofitted. Each one is a schema decision or an enforcement point rather than a setting, because every one of them is unwindable only by migration.

Per-field provenance

Where each field on a contact came from, queryable per contact. Not a source label on the record — a source per field, because a contact assembled from a LinkedIn headline, an enrichment callback and an operator edit has three different answers to “where did this come from”.

Retention anchored to collection

retention_expires_at is computed from collected_at, never from last_updated_at. Anchoring to last-updated means a record that keeps getting touched never expires, which is the exact finding that cost Kaspr €240k. A daily purge job deletes what is past its window, in batches.

The pre-send clearance

Every outbound message checks the blocklist immediately before it leaves. That is the only thing that refuses a send: a contact’s country, entity type, lawful basis or recorded consent decide nothing. A qualified contact is contacted wherever they are. The verdict is recorded on the message, and the database agrees: a constraint refuses an outbound row reaching sent without one, and an email without an unsubscribe URL.

Suppression at two scopes

Workspace and platform. Platform scope survives every workspace, and both are exempt from every purge — a suppression list that could be deleted by a retention job would re-open contact with someone who asked not to be contacted.

Opt-out beats classification

The reply poller runs a keyword pass before it runs the model. A missed opt-out is a regulatory failure; a missed nuance is a wrong badge in the inbox. The two are not comparable, so the cheap deterministic check goes first.