An EU-first AI SDR, compliance as product

Status: accepted · 2026-09-25

ContextCopy Anchor Link

SignalDock already turns public Dutch publications into scored opportunities with enriched contacts and a CRM record. Outreach stopped at a stored draft.

The AI SDR market (11x Alice, AiSDR, Artisan, Coldreach, Saleshandy, Knock AI) converges on the same loop: find accounts, research them, write personalised multichannel sequences, send from connected mailboxes, answer replies, book meetings, and sync the CRM. Most of these products are US-first. They rely on their own contact databases and cold email norms that do not hold in Europe:

• Cold B2B email is allowed with an opt-out in the Netherlands and Belgium for legal persons, but a sole trader (eenmanszaak) is a natural person and needs consent. Germany (UWG § 7) and Austria (TKG § 174) are consent-only, B2B included.
• GDPR Art. 14 requires telling a person where their data came from on first contact. Every message needs an unsubscribe link and, for bulk senders, RFC 8058 one-click List-Unsubscribe.
• The EU AI Act (Art. 50) requires disclosing AI involvement to people who interact with an AI system.
• Buyers expect correct Dutch, Flemish, or German, and the right register (u / je, Sie / du).

Our advantage is the trigger: public, fresh, and specific signals (permits, tenders, zoning plans, KvK changes) instead of generic intent data.

DecisionCopy Anchor Link

1. Scope: a full AI SDR. SignalDock sends from the customer's own Gmail or Microsoft 365 mailboxes (OAuth), runs multi-step sequences, reads replies, answers or escalates them, books meetings, and writes everything back to the CRM. LinkedIn, phone, and letter steps are assisted tasks a human performs. There is no LinkedIn automation, warm-up network, own contact database, voice agent, or website chat.
2. Humans in the loop by default. Every campaign starts in review mode: each message waits in the approval inbox. A campaign can opt in to autopilot once the organization enables it; autopilot still routes a message to review when policy flags it, confidence is below the organization threshold, or the step is the first touch of a new sequence version.
3. Compliance is domain logic, not a checkbox. @signaldock/domain/compliance holds the per-country policy (NL, BE, DE, AT), recipient legal form, lawful basis, suppression matching, retention, footers, and List-Unsubscribe headers. It is pure and tested. The pipeline calls evaluateTouch before every touch; a blocked touch is never drafted.
4. Facts about people live in their own tables. lawful_basis_records (one per contact), suppressions (email, domain, or KvK), and an append-only audit_events log. A daily cron purges contacts past the organization retention window. DSAR export and erasure are API procedures; erasure keeps a suppression so the address is never re-imported.
5. Locale everywhere. locale and formality resolve contact → company → organization and are passed into every prospect-facing prompt.
6. Agents are workflows. Research, strategist, writer, and reply agents run inside Vercel Workflow steps with bounded tool loops. Only apps/api starts or resumes workflows. Each agent's output is grounded: research facts carry a source URL (unsourced facts are dropped), and every message stores its why (signal, facts, score reasons, compliance decision).
7. Data model. mailboxes → campaigns → versioned sequences → sequence_steps; enrollments pin a contact to a sequence version and are driven by one durable run each; threads and messages hold every draft, send, task, and reply; meetings records bookings.
8. EU residency. Compute runs in fra1, Supabase in an EU region, and AI calls go through AI Gateway with geoRegion: "eu". See Data residency.

ConsequencesCopy Anchor Link

• Germany and Austria get a LinkedIn / phone / letter first strategy until a contact has consented. Marketing must not promise cold email there.
• Review mode is slower than competitors' full autonomy. That is the point for EU buyers, and the approval data trains the learning loop.
• Customers own sender reputation. Caps ramp per mailbox and domain authentication (SPF, DKIM, DMARC) is checked before sending.
• More tables carry personal data, so every new table with contact data must cascade from contacts or be covered by DSAR export and erasure.
• Policy text summarises the law; it is not legal advice. Organizations record the lawful-basis assessment themselves.