The crack
Regulated industries send a lot of critical messages: outage alerts, billing notices, emergency notifications. Each one carries rules, including consent to contact, quiet-hours windows, and a record a regulator can inspect. A single careless blast to opted-out numbers, or at the wrong local hour, turns a helpful notification into a TCPA liability.
Why it persists
Consent and quiet hours usually live in a policy document, not in the send path. The code that actually dispatches messages often trusts that the upstream list was already filtered, and the audit trail, where it exists at all, is scattered across logs that were never meant to be evidence.
The fix on Cloudflare
Enforce the rules at send time, in the code path, not in a document. For each recipient, check the consent ledger and compute the recipient’s local quiet hours, then suppress anything non-compliant. Write every decision, whether sent, blocked, or held, to an append-only audit trail you could hand a regulator.
Because the logic runs at the edge with the data close by, the same single dispatch lands at different local times for different recipients, and each one is judged correctly.
How I built the demo
This is a proof-of-concept in the regulated-comms problem space, built on Cloudflare Pages Functions and D1. A consent ledger and an append-only audit table self-create on first use. You set a dispatch time, toggle who has consented, and send, and the page shows the per-recipient decision plus the immutable audit log growing.
It is the same instinct behind every demo here: prove the compliant path and the failure path, not just the happy one. This one maps directly to the compliance-in-the-workflow problem that regulated-industry platforms exist to solve.