Compliance you don't have to build.

Every call dispatch must include a consent_type. Unknown or missing values return 422 Unprocessable Entity before the call is queued. Valid values:

• prior_express_written — signed TCPA-compliant written consent on file.
• prior_express — oral or checkbox consent where state law allows.
• existing_business_relationship — EBR carve-out with attribution.
• transactional — transactional / informational (no marketing content).
• emergency — bona-fide emergency; bypasses call-hour enforcement with an audited event.

The enum is enforced at the request boundary, not at call-time — invalid requests never get a chance to bill or dial.

We derive the destination timezone from the E.164 number via the NANP area-code table (with a portability override when present). The 8 am–9 pm window is then evaluated against the callee's local clock, not yours.

Out-of-window calls with consent_type ≠ emergency are rejected at dispatch. An emergency bypass writes a dedicated audit-chain event with the operator identity and reason — useful under regulator inquiry.

Each compliance-relevant event (call dispatched, DNC hit, consent attached, flow published, admin action) writes a row whose hash is H(prev_hash ‖ row_payload). Any rewrite — by us or by anyone who reached our database — breaks the chain at that row.

OpenPhn operators run the verification internally and against external snapshots on a schedule. In an audit, subpoena, or incident-response scenario we produce a signed verification report covering your tenant's rows for the requested window. Email security@openphn.com to request one.

Publishing a flow writes an immutable flow_version_id. Every call logs the exact flow_version_idit ran against, so “what script did we run on that call?” has a single, unforgeable answer.

This is a deliberate inverse of auto-tuning approaches — see the compare pages for the tradeoff.

For every dispatch we check, in order:

1. Your organization's internal DNC list (propagation latency < 1 second).
2. The FTC federal DNC registry (synced daily from the official download).
3. Per-number rate caps.

Any match blocks dispatch and records an auditable event. Mid-call opt-outs captured by the agent write back to the customer DNC list automatically on call completion.

Every structured outcome returns a confidence score in [0, 1] per field, plus an ambiguity_flags[] array identifying fields the model was uncertain about. Webhooks include both.

This matters for compliance because it tells an auditor exactly where your downstream pipeline should gate on human review rather than blindly trusting the extraction.

Retention, encryption, and the full sub-processor list live on the /security page — we don't duplicate the tables here. The compliance-relevant highlights:

• Transcripts retained 90 days by default; configurable to 7 days on Scale.
• Recordings are opt-in and stored in isolated per-object-encrypted buckets.
• No training on customer call data. See /security#training.

Tier and gating:

• DPA: public at /legal/dpa.
• BAA: available on the Scale tier; email security@openphn.com.
• SOC 2 Type II report: on the roadmap. We'll publish a target date when the program kicks off — we'd rather not commit to a deadline we haven't resourced.

State regulation coverage: the matrix above lists the states whose AI-caller disclosure laws are enforced end-to-end by OpenPhn. Customers retain responsibility for state-by-state campaign review, including recording-consent and CCPA/CPRA opt-out routing into their own systems.