HonkIOHonkIO

Compliance

Compliance built in, not bolted on

HonkIO enforces Canadian anti-spam and privacy law at the API level, for text messages and email alike. You cannot accidentally send a non-compliant message.

01

CASL: Canada's Anti-Spam Legislation

S.C. 2010, c. 23 · In force since July 1, 2014

Enforced

CASL requires that every commercial electronic message (CEM) sent to a Canadian recipient must have the recipient's express or implied consent. Violations can result in administrative monetary penalties up to $10 million per violation for organizations. HonkIO enforces CASL requirements programmatically.

Express Consent

  • Recorded with timestamp, source IP, and description
  • Stored immutably in audit log
  • Never expires unless revoked by the recipient
  • Required for cold outreach / new contacts

Implied Consent

  • Applies to existing business relationships
  • Auto-expires after 2 years (CASL §10(9))
  • Expiry date tracked and enforced by API
  • Ineligible for telemarketing messages

Email falls under the same law. A receipt, a password reset or an account notice is transactional, and CASL does not ask for consent before it. A promotion is a commercial electronic message, and it does. HonkIO sends email as transactional unless you mark it commercial, and checks consent for the address when you do.

Commercial email

  • Consent recorded per email address, through the same consent API as phone numbers
  • No consent on file for the address: refused with HTTP 451, not charged
  • An unsubscribe footer and a one-click unsubscribe header (RFC 8058) on every commercial email
  • An unsubscribe stops commercial email at once; receipts and resets still arrive

Suppression and reputation

  • A hard bounce or a spam complaint suppresses the address for every email
  • Refusals name their reason: EMAIL_NO_CONSENT, EMAIL_OPT_OUT_BLOCKED or EMAIL_SUPPRESSED
  • Live email pauses for 24 hours when bounces or complaints run high, with a webhook and an email saying why
  • Unsubscribes and complaints arrive as signed webhooks, like SMS opt-outs
SMS: STOP / UNSTOP keyword handling: When a recipient replies with STOP, STOPALL, UNSUBSCRIBE, QUIT, END, CANCEL, or the French ARRET (ARRÊT), HonkIO automatically opts them out within seconds, not the 10 business days allowed by law. START and UNSTOP keywords re-instate consent. Your webhook is notified of all opt-out events.

Pre-send gate

The API rejects any text to an opted-out number, and any commercial email to an address without consent or that unsubscribed, with HTTP 451 Unavailable For Legal Reasons. There is no way to override this from the API. Every blocked text, and every commercial email sent, is written to the audit log.

451Unavailable For Legal Reasons$0
{ "code": "NO_CONSENT",
  "message": "Message blocked: no valid CASL consent on record for this recipient.",
  "messageFr": "Message bloqué : aucun consentement LCSPC valide enregistré pour ce destinataire." }
02

CRTC Do Not Call List (DNCL)

Telecommunications Act · CRTC Rules on Unsolicited Telecommunications

Coming soon

The National DNCL prohibits telemarketing contacts (including SMS) to registered numbers. HonkIO will query the DNCL before sending any message tagged as telemarketing. Automated DNCL checking is coming soon.

Existing Business Relationship
Customer made a purchase or inquiry within 18 months
Registered Charity
CRA-registered charitable organizations
Political Party / Candidate
Federal/provincial political communications
Survey / Research
Non-commercial surveys and market research
Newspaper Subscription
Soliciting newspaper subscriptions
Personal Relationship
Personal or family relationship with the recipient

HonkIO records the exemption reason with each message for audit purposes.

The DNCL lists telephone numbers only. Email is not on it; CASL consent and unsubscribes govern email instead.

03

PIPEDA / Privacy Act

Personal Information Protection and Electronic Documents Act · S.C. 2000, c. 5

In place

Canadian Data Residency

  • All data stored in Canada
  • Database & cache hosted in ca-central-1 (Montréal)
  • PostgreSQL & Redis storage in ca-central-1 (Montréal)
  • Canada-only carrier messaging profile
  • Sent and received email, with its attachments, stored in ca-central-1 (Montréal)

Data Minimization & Retention

  • Text and email bodies purged after 90 days by default
  • A received email's raw message and attachments deleted after 40 days
  • Configurable retention period per account
  • Audit logs retained separately (immutable)
  • Right-to-erasure API endpoint included
04

Quebec Law 25 (Loi 25)

An Act respecting the protection of personal information in the private sector · In full force since September 2023

In place

Quebec Law 25 (Bill 64) imposes GDPR-like obligations on organizations handling personal information of Quebec residents. HonkIO's architecture supports these requirements.

  • Privacy impact assessment (PIA) documented for data flows
  • Right to access personal information via API
  • Right to erasure endpoint wipes all PII for a number
  • Data portability: export all consent and message records
  • Privacy officer contact in all error communications
  • Incident notification procedures in place

Data stored in Canada

Your text messages, sent and received email, phone numbers, email addresses, consent records and audit logs are stored in Canada, in Montréal (ca-central-1). When a customer or regulator asks where their data lives, the answer is one line.

Build compliance into your SMS and email

Get started free

HonkIO checks CASL consent on both channels by default. Create a free account and start building. Read the compliance docs →