The enforcement scorecard
Nine questions your outbound has to survive.
Most outbound audits grade intentions. This one grades what your system refuses to do on its own, on the worst day, when nobody is watching. Score yourself honestly: for each dimension, are you at the broken signal or the benchmark? No email required, nothing gated, and the answers are public because the specification is worth more than the lead.
Gate integrity
Can anything leave your building without a named human saying yes?
Approval is a setting. Someone can switch it off on a Friday, and a vendor's success team has probably suggested it.
Zero sends without a recorded human decision, and the block survives someone trying to remove it.
How we enforce it Our database refuses to write a send whose approval is missing, rejected, or recorded by anything other than a named person. Our own code cannot bypass it.
Evidence per message
Could the approver explain, in ten seconds, why this person is being contacted?
The reviewer sees a draft and a name. Approving is a rubber stamp because there is nothing to check.
Every draft carries its matched signals and a verified source link for each one.
How we enforce it Drafts are written with their reasoning trace attached, and the queue shows the evidence chips before the buttons.
Consent basis
For any contact you mailed last quarter, can you produce the lawful basis?
The legitimate interests assessment is a document nobody has opened, and the source of the record is folklore.
A documented basis per tenant, source disclosure in first contact, and a privacy notice the recipient can actually reach.
How we enforce it Every draft carries its Article 14 source disclosure and privacy link, and a config that claims disclosure without a privacy URL refuses to load.
Entity screening
How do you know the company you mailed is a corporate subscriber?
The list said Ltd. Under PECR, sole traders and partnerships are consumers, and 'the list said so' is not a defence.
Registry-verified entity type before a message is drafted, with unverified companies held rather than mailed.
How we enforce it We check Companies House with rotating keys; anything we cannot verify is held for operator judgement, and the refusal is logged.
Suppression coverage
If someone opted out this morning, can a message still reach them this afternoon?
Suppression is checked when the list is built, then never again. Approved drafts sit in a queue for days.
Suppression checked at build, and re-checked at send time, against email, domain and account.
How we enforce it The wave query itself excludes suppressed recipients, so an opt-out arriving after approval still kills the message.
Volume discipline
What stops a keen operator sending three times the safe volume on a new account?
The limit is a number in a help article. Mailbox providers and LinkedIn enforce theirs with rejections and restrictions.
Daily and weekly caps per channel, with a warm-up ramp on new accounts, enforced by the system.
How we enforce it Caps are tenant config the pipeline executes. A wave that would breach one is refused and the refusal is a logged row.
Reply ownership
Who works the replies, and how long do they sit?
Replies land in an inbox. The good ones get answered late, the negative ones never suppress anything, and nobody counts either.
Every reply classified, negatives suppressed automatically, positives worked into a next action within a day.
How we enforce it Replies are rows with a classification and a next action; rejections suppress instantly, and follow-ups go back through the same approval gate.
Retention hygiene
How long do you keep the details of people who never engaged?
Forever, because deleting is work and nobody asked. The suppression list, meanwhile, gets cleaned by accident.
Contact data purged on a schedule; suppression records kept indefinitely, deliberately.
How we enforce it A purge command enforces the configured retention window and never touches suppressions, ledger or approvals.
Handover readiness
If you ended the relationship on Friday, what is running on Monday?
Nothing. The sequences, the inboxes and the data live in someone else's account, and the exit is an export at best.
A dated exit where the working system, its configuration, its suppression lists and its ledger become yours.
How we enforce it Contractual handover, written in from day one, of a machine that keeps running without us.
Who the email says it is from
Does the address it arrives from trace back to a company that legally exists, or to a lookalike domain and an invented first name?
The standard practice in cold outbound is a throwaway domain one character off your real one, sending as a persona who does not work anywhere. That is done on purpose, so nothing traces back. In the UK it is also unlawful: PECR regulation 23 bars marketing email where the identity of the person it was sent on behalf of has been disguised or concealed, and unlike the consent rules that one applies to business-to-business email too.
Mail leaves only from domains you have declared, under a real named person or your actual trading name, carrying the legal entity that is writing.
How we enforce it The wave refuses to run at all if the sending identity is not disclosed. An undeclared lookalike domain, a persona from-name, or a footer that never names the entity each stop the send before a single message is written, and the refusal is recorded.
Questions about the scorecard.
A checklist records an intention. Every dimension here asks whether a system refuses the wrong action on its own, because that is the only version that survives an audit or a bad Friday.
No. If you are about to start, this is the specification to build against. If you already run it, it is the shortest honest audit of what would happen under scrutiny.
Restricted sending accounts, burned domains, an ICO complaint you cannot answer with a log, and the quieter cost: a pipeline you cannot reproduce because nothing was recorded.
We operate the machine that enforces all nine, and we hand it over on a dated exit. But the specification is public because a company that scores well without us is still better off than one that does not.
Score badly on three or more?
That is the normal result, and it is not a character flaw: nobody sells the enforcement layer, so almost nobody has one. The first cohort gets all ten enforced by the system we build and run, and hand over on a dated exit.
Join the cohort