Trust and enforcement

The ladder is published because an enforcement policy you cannot read before it happens to you is not a policy.

The rungs

1. Warn. Your standing changes and trust.warning fires. Nothing about your sending changes.
2. Pause. Sending stops. trust.paused fires. The owners are emailed with the metric, the value, the line, the window, the remediation checklist and the appeal route. Queued mail stays queued.

The ladder never enters a throttle rung. throttled remains in the API so existing clients keep working; existing throttled accounts are re-evaluated on the next sweep.

The rates each rung acts on are in Deliverability — bounce warn 2% / pause 4%, complaints warn 0.05% / pause 0.08%. No step until the window holds 100 delivered-or-bounced sends.

The sandbox

New accounts are scored when they are created. A sandboxed account may only send to addresses on domains it has verified here. Sends to anywhere else are refused.

Two things keep an account in the sandbox: a disposable signup address, or a signup whose domain cannot receive mail when the inbox has not already been proved. Signing in with an email code proves the inbox. A mail-exchanger lookup that does not complete does not sandbox the account. Gmail and other ordinary mailboxes are not a risk signal. Clean signups are approved in the same request. Existing accounts are not re-scored.

Ask for a review with POST /trust/appeal, or from Trust in the console. A person answers.

Scope is the narrowest thing that fixes it

A domain with a bad list is throttled at the domain, not at the account. A single key looping is paused at the key. An account-wide pause is for account-wide problems.

Reading your standing

GET /trust/standing returns the current rung, the reading that produced it, and when it will be reviewed again. GET /trust/thresholds returns the same numbers this page states — they come from one module, so a page that disagreed with the API would be a build failure rather than a disagreement.

Appeals

POST /trust/appeal opens an appeal with your account. It has an SLA clock attached and it is answered by a person. trust.appealed and trust.restored are on the event catalogue.

An appeal is the right move when the reading is wrong — a bounce spike from a test list, a complaint from a shared IP incident. It is not a way to raise a threshold.

What we will not do

• We will not enable unsolicited sending. There is no cold-outreach feature, no scraped-list import, and no plan for either.
• We will not pause you without writing the reason to the audit log you can read.
• We will not charge you for a send we refused.