A message needs a gate.

A message can look harmless in a preview. It has a different weight when it reaches someone's phone. The words represent the client, the timing interrupts a real day, and a mistake can continue to spread if the pipeline has no place to stop. We design outbound around that responsibility.

Separate preparation from delivery

Drafting copy, choosing a recipient, scheduling a send, and delivering it are separate actions. They should stay separate in the system. A controlled pipeline creates a place to inspect the message before it leaves, and a safe development gate gives the team a way to test without reaching a real recipient. The gate is useful because a rendered message can differ from its template once client data is inserted.

Our security and trust commitments state that outbound moves through a controlled pipeline with a safe or development gate. They also state that nothing goes live to customers without human sign-off. These are operating commitments for the work we host and run; the exact workflow is shaped with each client before go-live.

Keep the client's identity and data in its own space

Isolation is part of message safety. A sending identity belongs to the client's provisioned infrastructure, as does its database. That keeps one client's messages and customers away from another's workspace. It also gives the people responsible for an account a clearer boundary when they inspect a draft or decide whether a campaign is ready.

Opt-outs need a durable place in that boundary. Our approved operating commitment is that unsubscribe and permanent-stop are honored across client workspaces, and an opt-out stays permanent. A contact who has asked to stop should not reappear just because a new sequence or a new screen was added.

Make approval a real decision

A review step should show the message as a recipient would see it, the intended audience, and the action that will make delivery live. The point is to give the client a meaningful choice before production. If the draft changes, the review has to cover the changed version. The team that operates the system remains accountable after that first approval.

These practices are a way to run a service with care. They are not a claim that every possible campaign is safe by default, or a promise of a compliance certification. Our trust page separates confirmed practices from the formal work still in progress.