SMS Compliance Guide: What the Software Does and Does Not Do
Consent records, opt-out handling and local logs are built in. Legal compliance is still your organisation's responsibility, and this page separates the two.
This is operational guidance, not legal advice
Rules differ by country, by channel and by industry. Use this page to ask your counsel better questions, not to replace them. Reviewed 2026-11.
Where your data sits
The software is the only component in the message path, and it runs on your machine. That makes the data map unusually short.
| Data | Stored by | Location | Leaves your network? |
|---|---|---|---|
| Phone numbers | You | Local SQL database | No |
| Message text | You | Local SQL database | Only to the carrier as an SMS |
| Delivery reports | You | Local SQL database | No |
| License email | SMS Deliverer | Order records | Yes, for licensing only |
The one exception is the carrier: a text message necessarily passes through the mobile network that delivers it.
Consent and opt-out mechanics
Mechanisms the software enforces, independent of your policy.
STOP handling
Inbound STOP, STOPALL and UNSUBSCRIBE set a permanent opt-out flag. The flag survives imports and cannot be overwritten by a new list.
Record per contact
Opt-out time, source and the SIM that received the request are stored locally and exportable.
Identity in every message
Messages come from a real mobile number, so a recipient can identify the sender and reply.
Sender identity rules by country
A summary for planning, not a legal reference. Rules change; verify with your carrier and counsel as of 2026-11.
| Region | What usually applies | Practical implication |
|---|---|---|
| United States | TCPA consent rules; A2P registration for application-to-person traffic | A consumer SIM plan may not be suitable for bulk marketing; confirm with the carrier |
| European Union | GDPR for personal data; ePrivacy rules for marketing messages | Keep a lawful basis, honour opt-outs, minimise retention |
| Gulf states | Sender ID registration varies by operator | A real SIM number is often simpler than a rented sender ID |
| Asia-Pacific | Mixed regimes, from registration to content filtering | Check per country before a cross-border campaign |
Audit logs and retention
Every send, reply and delivery report is a local row. You decide how long it stays: a scheduled purge, a manual delete, or an export to your own archive.
Because the log is local, a data subject request is answered by your team, not by a vendor's support queue. That is the operational advantage of an on-premise design, and it is also why retention policy is your decision.
Retention checklist
- Set a purge period per data type
- Export before deleting
- Restrict who can open the database
- Encrypt backups
Checklist before your first campaign
Seven checks
- You can name the lawful basis for the list
- Every message identifies the sender
- STOP works and is tested from a real phone
- Opt-outs are imported into the blacklist
- Quiet hours follow local rules
- Retention is defined and enforced
- A named person owns complaints
Keep for the record
Store the consent source, the opt-out method, the campaign dates and the carrier you used. If a regulator or a customer asks, the answer should take minutes, not weeks.
OTP audit notes · Marketing consent · Clinic reminders · Privacy policy · Licence terms
Questions buyers ask
Is the software GDPR compliant?
The software supports workflows that help you meet GDPR obligations, such as local storage, export and deletion. Compliance is a property of your organisation's processes, not of an installer.
Does it handle TCPA consent?
It records and enforces opt-outs and keeps a local audit trail with timestamps. Capturing and proving consent remains your process.
Are STOP replies processed automatically?
Yes. STOP, STOPALL and UNSUBSCRIBE set a permanent opt-out flag, and the contact is skipped in future campaigns.
Can I delete all data for one person?
Yes. Delete by number in the local database, including message rows, and keep the export you need for your records.
Do you claim HIPAA compliance?
No. We describe the product as suitable for HIPAA-aligned workflows, because data stays on your network. Formal compliance depends on your policies, agreements and training.