Compliance built into the routing layer

Guardrails that live in a campaign checklist get skipped on a busy Friday. Ours sit in the platform between your API call and the carrier, so a message that should not be sent is stopped rather than reported on afterwards.

Talk to compliance

What the platform enforces for you

Six controls that are on for every account from the first send. None of them are a paid add-on and none of them can be switched off inside a campaign.

Licence-aware routing

You tell us the markets you are licensed in. Anything addressed outside them is rejected at the routing layer, before it can leave the platform or reach a regulator's attention.

Consent ledger

Every number carries the source, timestamp and exact wording of its opt-in. Exportable in full whenever a regulator or a player asks.

Quiet hours

Local quiet-hours windows are enforced per market and per player timezone. A scheduled send simply waits for morning rather than going out at 3am.

STOP and HELP

Opt-out and help keywords are handled in the local language on every route, and suppression propagates across all your campaigns within seconds.

Responsible messaging

Self-excluded and cooling-off players are suppressed automatically from your file, and cadence caps stop any individual being over-contacted.

Data residency

EU traffic and player data stay inside the EU. A signed Article 28 processing agreement is in place from day one.

Licence-aware routing, explained

The single control operators ask about first. Traffic addressed to a market where you hold no licence is refused at the routing layer, before it can leave the platform.

It is a hard gate rather than a warning. There is no override flag, no support ticket that unlocks a market for one campaign, and no fallback route that quietly picks up the rejected traffic. The only way a market opens is a verified licence on your file.

Your licence file

Licence number, regulator and expiry date for every market you operate in. Nothing is provisioned until each entry is checked against the regulator's public register, and a licence inside thirty days of expiry raises a flag on your account.

Number resolution

Every destination number is resolved to its live home network at submit time, not guessed from the country prefix. A ported number keeps its real market, so a Brazilian handset on an inherited prefix is still classified as Brazil.

Match or reject

The resolved market is tested against your licence file. No match means the message is rejected before it touches a carrier bind. It is not queued, not retried on another route, and not quietly discarded.

Written to the audit log

Each rejection records the resolved market, the campaign, the sender identity and the licence set it was tested against. The log exports in full, which is usually what a regulator wants to see rather than a policy document.

A rejected send, as your logs record it

POST /v2/messages
{
  "to": "+55 11 9xxxx xxxx",
  "campaign": "reactivation-weekend",
  "sender": "AURUMBET"
}

422 Unprocessable
{
  "error": "jurisdiction_not_licensed",
  "resolved_market": "BR",
  "resolved_network": "Vivo",
  "licences_on_file": ["MT", "SE", "ON", "MX"],
  "dispatched": false,
  "billed": false
}

The number resolved to Brazil, Brazil is not on the licence file, and the message stopped there. Nothing was dispatched and nothing was billed. The same record is what an auditor reads when they ask how you keep traffic inside your permissions.

Rejections are returned synchronously, so your own system knows immediately
Blocked messages are never charged and never counted against your volume
An expired licence drains that market automatically rather than waiting for a review

Handled market by market

Rules differ by country, not by continent, so the table below is the shape of what we run rather than the whole rulebook. Your onboarding pack lists every market you are live in individually.

Consent basis, sender registration, quiet hours and opt-out keywords handled by SMSPro in each region
Region	Consent basis	Sender registration	Quiet hours	Opt-out keywords
EU and UKMalta, Sweden, Denmark, Netherlands, Germany, Ireland, United Kingdom	Prior opt-in under GDPR Art. 6(1)(a) and PECR reg. 22, with the source URL, timestamp and exact wording stored against the number.	Alphanumeric sender ID pre-registered per country, typically 3 to 10 days. UK volumes above 100k a month move to a registered short code.	21:00 to 09:00 recipient local time. Germany and the Netherlands add a Sunday and public-holiday block by default.	STOP, STOPP, STOPPA, HALT, HELP, HILFE, INFO
LATAMBrazil, Mexico, Colombia, Peru, Chile, Argentina	Documented opt-in with a second confirmation step for Brazil under the LGPD, plus REPEP register screening before every Mexican send.	Brazil requires a local entity and a registered short code, which takes 10 to 15 days. Mexico and Colombia run on registered long codes.	20:00 to 09:00 recipient local time, with no Sunday marketing traffic in Brazil.	SAIR, PARAR, CANCELAR, BAJA, ALTO, AYUDA, AJUDA
CanadaOntario, British Columbia, Alberta, Quebec	Express CASL consent only. Proof of collection is retained for three years and implied consent is never accepted as a basis for a gaming send.	Short code programme brief filed through the common short code administrator, 6 to 8 weeks, with Ontario campaigns reviewed against iGO advertising standards.	21:00 to 09:00 in the recipient province, applied per timezone rather than per account.	STOP, ARRET, DESABONNER, HELP, AIDE
Asia-PacificAustralia, New Zealand, Japan, Singapore, Philippines	Spam Act 2003 opt-in for Australia, PDPA opt-in with Do Not Call register screening for Singapore, written consent held per brand in Japan.	Registered sender ID plus content template filing per market. Japan requires a carrier-approved header and a pre-cleared message body.	20:00 to 09:00 recipient local time, with an extended blackout across Japanese national holidays.	STOP, UNSUB, END, QUIT, HELP, plus local-script stop words

Quiet hours

Applied on the recipient's own timezone, not your account's. A scheduled send waits for local morning.

Opt-out keywords

Matched in the local language on every route, with suppression propagated across all your campaigns.

Sender registration

Filed and renewed by us. We tell you which markets are slow before you commit to a launch date.

What we ask of you

The platform carries the enforcement. The controller obligations stay with you, and the programme only holds up if four of them are met.

You are the data controller

SMSPro processes on your written instruction under an Article 28 agreement signed before the first send. The legal basis for contacting each number is yours to hold and yours to evidence.

Send the consent with the list

Opt-in source, timestamp and wording travel with every upload. Numbers that arrive without a consent record are held in quarantine rather than sent, and we will tell you how many.

Keep the licence file current

A new market, a renewal, a surrendered licence or a fresh condition from a regulator goes on the file the same week it happens, because every routing decision is made from it.

Own the message content

We enforce sender identity, footer, cadence and quiet hours. What the message actually says, including bonus terms, age statements and any wording your regulator mandates, is signed off by your compliance team.

Four housekeeping items

None of these are difficult, and all four are the things that go wrong when a programme is handed between teams. Reports filed through our abuse policy are investigated against the consent ledger entry for the number involved, so a missing record becomes a problem at exactly the wrong moment.

What SMSPro does with the data you send us, how long we keep it and where it is stored is set out in our privacy policy. EU traffic and EU player data stay inside the EU on every plan.

Push opt-outs, self-exclusion and cooling-off flags back into your own CRM, so the next list upload cannot undo a suppression we already applied.
Route player access, deletion and objection requests to your team as controller, with our processor-side answer available on request.
Name a compliance contact who can authorise a market being switched on or off, and who receives the monthly guardrail report.
Keep the sender identities you registered with us in use, because an unregistered identity is the fastest way to lose a route in a market.

Have your compliance team ask us the hard questions

Bring the licence file, the markets you want next and the objections your regulator raised last time. We will show you exactly which of them the platform settles and which one is still yours.

Talk to compliance See pricing