Strengthen SMS content compliance guardrails

[connorscarolyns]

Follow up on the SMS compliance incident by closing the immediate gaps identified during the audit and adding stronger guardrails to reduce the likelihood of recurrence.

This feature brings together the remediation, product guidance, validation, and internal controls needed to make SMS content requirements easier to understand and more consistently enforced.

Outcome

GC Notify reduces the risk of sending SMS messages that do not meet applicable telecommunications content requirements, particularly for messages containing links.

Scope

This feature includes:

• Remediate existing SMS templates identified through the audit
• Improve sender-facing guidance and validation for SMS content requirements
• Add validation at send time for requirements that can be reliably detected
• Add equivalent guidance and validation to ADMIN template creation and editing
• Look into AWS documentation around risks of not having a data disclosure when there are links in SMS messages sent via short code.
• Look into telecom compliance policies for SMS content, both short and long code

Success criteria

• Known non-compliant templates are remediated
• Senders receive clear guidance before creating or editing affected templates
• Detectable compliance issues are caught before or at send time
• Guidance and validation are consistent across sending pathways
• Incident risk owners confirm the identified gaps have been addressed

References

• Incident Slack channel: https://gcdigital.slack.com/archives/C0BSDQD86PR
• Post-mortem: https://docs.google.com/document/d/1G1YGz72iwJC9h1BVWXpPFHDoHduvQr38j0AxvDXyp1g/edit?tab=t.0
• Audit / identified template list: https://docs.google.com/spreadsheets/d/1L1KJvi-ylzjsZ30ArnSx0i-DSXrJcqgvFSLwxO8Yydw/edit?usp=sharing
• Communication template: https://docs.google.com/document/d/1G1YGz72iwJC9h1BVWXpPFHDoHduvQr38j0AxvDXyp1g/edit?tab=t.6m2neq5s5lxx

[schancase]

hi @connorscarolyns, I have parented this to other work this Quarter-Q3 Epic. Feel free to re-parent if another parent is better.