Compliance — how this works

In the app: /settings/compliance

How it works

The same suppression store, screening data, and DSAR export the founder's Compliance Center reads — just filtered to your workspace: Suppression/Lead/AuditLog are all tenant-owned tables, so every query here runs through a tenant-scoped Prisma client (src/lib/tenant/tenantScope.ts) that AND-s your tenant id into every read and stamps it onto every write. Nothing here is a second suppression path — the manual-add form calls the SAME addSuppressionManual() the founder console does. Unsubscribe links your leads receive already theme automatically off their brand's kit; there is nothing to configure. The consent-ledger export runs the SAME exportSubjectData() (GDPR Art 15) real DSAR requests use.

Data source

src/lib/compliance/complianceRepo.ts + src/lib/compliance/suppression.ts (both unmodified, driven off a scoped client), src/lib/comply/dsar.ts, src/lib/tenant/tenantScope.ts.

Troubleshooting

An export shows lead: null? Either that lead ID doesn't exist, or it belongs to a different tenant — a cross-tenant ID always returns an empty export, by construction, never an error. A suppression you just added not showing up? The list is scoped and paginated — clear any active search filter first.

Who can see this: admin