# Compliance

Werkmail is built for European senders. Compliance is enforced in the product, not only described in a policy.

## Double opt-in

Newsletter subscribers start as `pending` with a confirm token unless you explicitly import them as `active` (you must already have lawful consent). Public confirm:

```
GET https://werkmail.eu/api/public/confirm?token=…
```

The confirm URL is emailed, never returned from the public subscribe API.

## Consent ledger

Each grant stores channel, legal basis, IP, user-agent, the wording the person saw, and timestamps. Channel preferences (`termin`, `recall`, `newsletter`, `transactional`) can be updated from the preference centre.

## Impressum gate

Broadcast / newsletter sends require street, city, and a privacy URL on the tenant. Werkmail injects a legal footer when those fields are set. Incomplete Impressum → send rejected with a hint.

`PATCH /api/practices/{id}/compliance` updates the stored legal block.

## Unsubscribe

When the public origin is HTTPS:

- Signed `GET|POST /api/public/unsub` (one-click)
- `List-Unsubscribe` + `List-Unsubscribe-Post` on the MIME
- Footer link on **every** send, including transactional

`POST /api/public/unsubscribe` is retired (410). Use the signed `/unsub` URL from the message.

Unsubscribe from a broadcast message suppresses at **route** scope when the message had a route. “Unsubscribe from all from this sender” is tenant-wide.

## Reputation guardrails

Own counters (not the provider account list) pause a tenant when:

- Bounce rate ≥ **5%** and at least **20** messages, or
- Complaint rate ≥ **0.1%** and at least **20** messages

Paused tenants can be resumed by an owner after they fix the list. Abuse autopilot also opens tickets on complaint spikes.

## Abuse

- Public form: [https://werkmail.eu/abuse](https://werkmail.eu/abuse)
- API: `POST /api/public/abuse` (JSON or multipart)
- Mailbox: `abuse@werkmail.eu`

Reporters get an acknowledgment and stage mail as the ticket moves **open → investigating → closed**. Operators reply from Settings → Abuse reports.

## Data-subject requests

Owners can export or erase workspace data from settings (DSAR export / redaction). Production mail and data stay in the EU (Frankfurt).

## Acceptable use

Do not send unsolicited marketing, purchased lists, or phishing. Transactional routes may not carry newsletters. Werkmail may pause or close tenants that harm the shared outbound reputation.