Compliance
How SignalDock decides whether a touch is allowed, what it must carry, and how personal data is kept, exported, and erased.
SignalDock checks every outreach touch against a per-country policy before a
message is drafted. The policy lives in @signaldock/domain/compliance and is
the same code the pipeline, API, and app use.
Country policy
| Country | Cold email to a legal person | Sole trader / natural person | Preferred first touch |
|---|---|---|---|
| Netherlands | Allowed with opt-out | Consent required | Email, LinkedIn, phone |
| Belgium | Allowed with opt-out | Consent required | Email, LinkedIn, phone |
| Germany | Consent required | Consent required | LinkedIn, phone, letter |
| Austria | Consent required | Consent required | LinkedIn, phone, letter |
Phone calls to natural persons (and all B2B phone in Germany and Austria) are flagged for human review. Countries without a modelled policy are blocked.
What every email carries
- Sender identity: legal name and address from compliance settings.
- Unsubscribe link and RFC 8058
List-Unsubscribe/List-Unsubscribe-Postheaders. Unsubscribing adds a suppression and stops every enrollment. - GDPR Art. 14 notice on the first touch: where the contact's data came from, with a link to the privacy notice.
- AI disclosure (EU AI Act Art. 50) in the footer or signature, unless the organization turns it off for human-rewritten messages.
Footers are rendered in the contact's language (Dutch, French, German, or English).
Lawful basis
Each contact has one lawful-basis record: the GDPR basis (legitimate interest, consent, or contract), the recipient's legal form, the country, the data source, and the balancing note or consent evidence. Outreach refuses contacts without one.
Suppressions
A suppression blocks an email address, a whole domain, or a KvK number, on every channel. Suppressions come from unsubscribes, opt-out replies, bounces, complaints, erasure requests, or manual entry. Only owners and admins can lift one, and that is audited.
Retention, export, and erasure
- Contacts idle longer than the organization retention window (default 24 months) are purged by a daily job; each purge is audited.
- Export (Art. 15) returns every contact row, lawful-basis record, message, and suppression for an address.
- Erasure (Art. 17) deletes the contacts; messages and lawful basis cascade. A suppression remains so the address is never re-imported.
Audit trail
audit_events is append-only. Users, agents, and the system record approvals,
sends, suppressions, setting changes, DSAR requests, and purges. Owners can
export it from settings.
This page summarises the rules SignalDock enforces. It is not legal advice.
Last updated on