Compliance Rules
A rule engine that decides what's allowed to send, per jurisdiction and purpose — and shows you what it blocked.
Compliance rules turn regulations into enforcement. You define rules scoped to a jurisdiction, purpose, and channel; the engine evaluates them before every send and records what it blocked.
Rules
Each rule matches on jurisdiction, purpose, and channel (leave any blank to act as a wildcard), and applies an action:
- Block send — stop the message outright
- Require opt-in — demand affirmative consent
- Require double opt-in — demand confirmed consent
- Suppress — add the recipient to the suppression list
- Flag — allow the send but log it for review
Rules have a priority — the lowest number wins, and the first matching rule decides. Supported jurisdictions are GDPR, CCPA, CASL, PIPL, LGPD, PIPEDA, and a catch-all Other.
HIPAA is not a current toggle
Pact's compliance engine covers the privacy regimes listed above. There is no HIPAA-specific rule set today — don't rely on Pact for PHI handling until it ships.
How evaluation works
When a send is attempted, the engine finds the highest-priority matching rule and returns a decision. If consent is missing and a rule requires it, the send is blocked and recorded with status blocked_consent. You can replay recent evaluations from the rules page to see exactly how a given send was judged.
Blocked sends
The Blocked sends view is your triage queue. Every blocked message is bucketed by reason:
| Bucket | Meaning |
|---|---|
jurisdiction_mismatch | A compliance rule blocked it |
unsubscribe | Recipient unsubscribed, suppressed, or expired |
frequency_cap | A send-frequency cap was exceeded |
purpose_missing | No consent for that channel + purpose |
other | An unmapped gate reason |
Each bucket shows counts over 24-hour, 7-day, and 30-day windows with a sparkline, and the recent blocked sends list shows the recipient, channel, sequence, reason, and last error — so you can fix the root cause, not just the symptom.
Compliance and consent work together
Consent records what each person allows; compliance rules decide what your workspace permits by jurisdiction. A send must satisfy both.