Xovra
Compliance

Guardrails built intoevery outbound attempt.

Xovra checks suppression, calling hours, and attempt limits on the server before any call or text goes out. Here is exactly what exists, and what is still your responsibility.

Not legal advice. This page describes product features and general background. It does not tell you what is legal for your business. Laws vary by state and situation, so consult a qualified attorney.

What Xovra enforces

These are the compliance features that exist in the product today.

Suppression lists

Numbers that opt out are recorded in an append-only suppression list and are never contacted again.

  • Append-only JSONL log, so entries are added and not quietly edited away
  • Opt-out detection on inbound texts for keywords such as STOP and UNSUBSCRIBE
  • Checked before every outbound call and text

Calling window enforcement

Outbound contact is blocked outside allowed hours. The default window is 8am to 9pm, and the timezone is configurable.

  • Default window of 8am to 9pm
  • Configurable timezone
  • Enforced on the server, not just hidden in the interface

Attempt caps per contact

Limit how many times any one contact can be tried. The default cap is 6, and you can change it.

  • Default of 6 attempts per contact
  • Configurable to match your own policy
  • Stops over-calling the same person by accident

AI disclosure on every AI call

AI qualifier calls state that the caller is an AI in the first sentence.

  • Disclosure is part of the opening, not buried later
  • Applies to calls placed by the Telnyx AI assistant
  • Supports the transparency expected under TCPA guidance on artificial voices

Server-side enforcement

Suppression, calling window, and attempt cap are all checked on the server before any outbound call or text goes out.

  • All three checks run on every outbound attempt
  • A tampered browser cannot skip them
  • A blocked attempt is stopped before any money is spent

Rate limits on spending routes

Routes that cost money are rate limited, which caps how quickly a mistake or a runaway script can spend.

  • AI calls: 20 per 60 seconds
  • SMS: 60 per 60 seconds
  • Usage recorded per event in a ledger

What happens before a call goes out

Every outbound attempt passes through the same checks on the server.

  1. 1Is the number on the suppression list?If yes, blocked
  2. 2Is it inside the calling window?If no, blocked
  3. 3Has the attempt cap been reached?If yes, blocked
  4. 4Is the rate limit exceeded?If yes, blocked
  5. 5All clearCall or text goes out

TCPA background

General context only, to help you ask better questions of your lawyer.

The law in brief

The Telephone Consumer Protection Act (TCPA) restricts certain automated calls and texts, and the FCC has stated that AI-generated voices count as artificial voices under it. Rules differ depending on who you contact, how, and whether you have consent.

Penalties can be significant

TCPA violations can carry statutory damages per call or message, which add up fast across a list. Many states also have their own telemarketing laws, some stricter than federal rules.

Consent depends on the contact

Rules for business-to-business calls, existing relationships, and consumer numbers are not the same. Whether you need prior written consent for a given contact is a question for your counsel.

Registries are your job

National and state Do Not Call registries may apply to your list. Xovra does not check those registries for you, so scrub your lists before you import them.

Text messaging

10DLC: required, and handled by you at Telnyx

What it is

10DLC (10-digit long code) is the system US carriers use to vet businesses that send application-to-person text messages from standard local numbers.

Who does it

You do. Registration is done directly with Telnyx under your own brand and campaign. Xovra does not handle it and has no registration wizard.

When you need it

Before sending SMS to US numbers at any scale. Unregistered traffic is likely to be filtered or blocked by carriers.

Does it affect calls?

No. 10DLC is about text messages. Voice calling does not use it.

Who is responsible for what

A tool can enforce limits. It cannot decide whether you have the right to contact someone.

Xovra

  • Enforces suppression, calling window, and attempt cap on the server
  • Detects STOP and UNSUBSCRIBE replies and suppresses the number
  • Has the AI state it is an AI at the start of every AI call
  • Rate limits AI calls and SMS

You

  • Have a lawful basis and any required consent to contact each person
  • Scrub your lists against Do Not Call registries
  • Register your brand and campaign for 10DLC with Telnyx
  • Write truthful scripts and set sensible window and cap values
  • Get your own legal advice for your situation

What Xovra does not provide

Listed plainly so you can plan around it.

  • Do Not Call registry lookups
  • STIR/SHAKEN attestation controls
  • SOC 2, HIPAA, or GDPR certification
  • Call recording, transcripts, or consent playback
  • A 10DLC registration wizard
  • Answering machine detection

Compliance questions

No tool can do that on its own. Xovra enforces some guardrails, namely suppression, calling windows, and attempt caps, and has AI calls disclose themselves. Whether your outreach is lawful also depends on your lists, your consent, and your content. Talk to a lawyer about your situation.

Calling with guardrails on

Get early access and see the suppression, window, and cap checks working on your own campaigns.