Scope of Service
Define channel types (SMS, MMS, RCS), volume limits, permitted message categories (transactional vs marketing), and geographic targeting restrictions.
A written agreement reduces legal and operational risk by documenting consent, consent maintenance, opt-out flows, security controls, and responsibilities for message delivery and data protection under federal and state law.
Common parties include vendors that provide bulk or automated messaging platforms and businesses that send transactional, marketing, or appointment reminders via text.
The agreement should reflect each party’s role: who obtains consent, who stores opt‑out records, how message content is vetted, and who bears regulatory risk.
Define channel types (SMS, MMS, RCS), volume limits, permitted message categories (transactional vs marketing), and geographic targeting restrictions.
Specify how express written consent is obtained, how opt-outs are processed, and how records of consent are retained for TCPA defense.
Allocate responsibility for TCPA, CAN-SPAM, state telemarketing laws, and any industry-specific rules such as HIPAA.
State data encryption, access controls, breach notification timelines, and which party is data controller or processor.
Include message delivery SLAs, uptime commitments, delivery reporting, and remediation steps for outages or systemic failures.
Address indemnification for regulatory fines, third‑party claims, limits on consequential damages, and insurance requirements.
| Field | Configuration |
|---|---|
| Consent Source | Form, checkbox, or API capture with timestamp |
| Auth Method | SMS code or account authentication |
| Opt‑out Tagging | Global suppression list with immediate effect |
| Delivery Logging | Persistent logs with IP, timestamp, and message ID |
Define platform capabilities, integrations, and file formats required to operate safely and reliably.
Confirm integration points, API rate limits, and retained metadata fields before finalizing operational responsibilities.
Immediate suppression on receipt; confirm update within 24 hours
Initial notice typically within 72 hours, or per contractual term
Retention starts on effective date; minimums follow regulatory basis
Provider acknowledges incidents within 2 hours for critical outages
Specify escalation timeline and mediation/arbitration windows
| signNow | DocuSign | Adobe Sign | PandaDoc | HelloSign | |
|---|---|---|---|---|---|
| Starting Price | $8/user/mo | $15/user/mo | $14/user/mo | $19/user/mo | $15/user/mo |
| Free Trial | Yes, 7-day free trial | Varies by plan | Varies by plan | Varies by plan | Varies by plan |
| Bulk Send | Yes (Business Premium) | Yes | Yes | Yes | No |
| Audit Trail | Yes | Yes | Yes | Yes | Yes |
| HIPAA Compliant | Yes (BAA required) | Yes | Yes | No | No |
| Envelope Cap | No envelope cap | 100 envelopes/user/year cap | Varies by plan | Varies by plan | Varies by plan |
A clinic captures SMS consent during online booking using a checked consent box and timestamped record
A retailer runs promotional blasts to opted‑in customers and segments by preference