How the platform keeps its numbers trusted

A spam label comes from behaviour, and not from intent. This page mixes what runs today with what is planned: the protections that the platform already applies, the steps that a person performs by hand, the proposals, and the open questions. Every item below carries its status.

The scoring companies read behaviour, not intent

The scoring companies grade a caller from what the caller does. No business can tell those companies that it is not a spammer. The page on who decides a call is spam states where that decision happens.

The platform calls people who gave consent and who expect contact. Two signals follow from that fact, and no caller can falsify them:

People answer the call.
People stay in the call, and do not end it early.

The protection work therefore divides into three jobs:

Do not repeat the calling structure of a spam operation.
Make the honest identity clear to the networks.
Find the damage early.

Each item on the rest of this page carries one status marker:

(built) — the platform does this today, and it does it automatically.
(a person does this today) — the platform does not do this. An operator does it by hand.
(proposed) — a plan only. Nothing of this runs today.
(open question) — the platform does not have the answer yet.

Each client must be its own caller

The platform places the calls, but each call belongs to one client. The protection is to keep each client a separate and honest caller.

The separation has five parts. One part is an open question:

Each client has its own phone numbers. The platform refuses to add a number to a second real client's pool at all. Only a demo or test organization's number can be shared, and only after a staff member confirms it; when that happens, the platform treats the number's daily limit and its health as one shared fact, not a separate copy for each holder — a label on it protects, and removes, the number for every holder at once. Real clients otherwise never share a number. (built)
The consent record of a number is stored at import: the source of the consent, and its date. Consent is a property of the number, and not of the lead. (built)
The safety controls that stop calling watch each client separately. A reputation problem in one client's pool stops that client, and not the others. (built)
Telnyx reports each client's numbers to the scoring companies under the client's own business name. The score then belongs to the client. (a person does this today)
The tag inside each signed call must also separate the clients. The carrier chooses what the tag identifies, and the platform has asked the carrier which meaning it uses. (open question)

One honest limit: the separation inside the platform is complete. Outside the platform, the separation depends on the answer to that open question, and on the registry entries.

The diagram shows two clients, Client A and Client B, side by side on one platform. A vertical line between them is marked 'nothing is shared'. Each client holds the same four things of its own: its business name on the phone screen, its own phone numbers, its own consent records with a source and a date, and its own score, which is the result of the three above. A band below both clients states that the platform places the calls on behalf of each client. A separate note in amber holds the one open question: the carrier puts a tag inside each signed call, that tag must also keep the two clients apart, and the platform has asked its carrier which meaning the tag has. — Notice that each client carries its own score. The platform's job is to keep that separation real everywhere, and not only inside its own database.

Make the honest identity clear

A network trusts a caller that it can identify. Six items make each client's identity clear to the networks. Two of them are proposals:

The top signing grade for every number. The grade means that the carrier verified who the caller is, and verified the right to use the number. A person arranges the grade with the carrier. (a person does this today)
The top grade is possible for the numbers that the carrier assigned. It is also possible for numbers brought from another carrier, when documents prove the right to use them. A person supplies those documents. (a person does this today)
The platform is built and connected to record the risk Telnyx reports for each number, but the read is switched off everywhere, because each fresh reading is billed and the owner has not yet decided how often to pay for one. (open question)
An operator reads the Telnyx report, and asks for a review of a wrong label. (a person does this today)
Branded calling puts the client's name on the phone screen. It increases the effect of a good score, and it never repairs a bad one. The calling behaviour comes first, and the name on the screen comes second. (proposed)
A check of a number's history before the platform buys the number. A number keeps the score of its previous owner. Today the platform does not screen a number before use. (proposed)

Keep the calling behaviour steady

Steady and moderate use is the behaviour of an honest business. Seven items keep the calling steady. Two of them are proposals:

Each number makes at most 75 calls each day. A new number follows a ramp of real calls across ten working days. A reserve number is a sizing label that a person sets; the claim rule ignores it, so a reserve number dials like a working one, and nothing changes a number's role on its own. The life cycle of a number gives the limit at each stage. (built) The carrier gives its own guidance: keep each number under 100 calls a day. The carrier also states that no phone network publishes the exact limit that causes a label. Thus 75 keeps a margin of one quarter under the only figure a carrier has stated.
The platform must not make bursts of calls. The next version plans the whole term on day zero, and it spreads the start of the leads across two days. (proposed)
The same person hears from the same number across all of that person's calls. Today the platform does not promise this. The rule removes two harms at the same time: people who see many different numbers complain more, and a shared calling pattern is one of the ways that the scoring companies connect numbers. (proposed)
When a person answers, the agent must speak at once. Silence after the first word is a known cause of early hang-ups, and early hang-ups are the behaviour signature that the platform watches on each number. The platform measures those early hang-ups, and it tests the agent's quality before a change reaches live callers. (built)
When a machine answers a call, the platform ends the call. The platform never leaves silence on a voicemail. (built)
The platform suppresses a person who says stop. The suppression happens immediately, and before any next call. It is one of the checks before each dial. (built)
The platform screens each number with the scrub service before its first call, not at import, and it screens the number again after 21 working days or 31 days, whichever comes first. A number the service reports as invalid is not dialled. With no scrub service set, nothing is checked. A call to a disconnected number is itself a spam signal. (built)

Let the person expect the call

Recognition raises answers, and answers are the only thing that raises the score. Three items make the person expect the call. Two of them are proposals:

The consent record of each number holds the source of the consent and its date. The import stage writes that record. (built)
A message before the first call, so that the person recognises the client's name when the phone rings. Recognition raises answers. (proposed)
When a person shows interest in a web form, or in a reply, the platform calls back at once, before the other waiting leads. Today only the restart after an automatic stop puts a lead at the front this way; no web form or reply does. (proposed)

Find the damage early, and repair it honestly

Nine items describe the detection and the repair. A daily job is built and connected to watch the labels directly, but is switched off everywhere today:

A daily job is built and connected to read each number's own risk report from Telnyx, weekly for every number and daily for any number not already judged low-risk, and to take a marked number out of service the same day. The job is switched off everywhere today, because each fresh reading is billed per number and the owner has not yet decided how often to pay for one; a deployment with it off reads nothing, rather than a false all-clear. Number reputation has the detail. (open question)
The platform also reacts inside the call itself, the moment it ends: if the calling service's own reason for ending the call says the carrier blocked it outright, or the carrier has refused most of a number's recent calls, the platform throttles that number or takes it out of service at once, without waiting for the next daily job. This check now looks only at the last seven days of calls, and it counts one call back for each person dialled more than once in that time, so calling one dead number several times cannot, on its own, read as a pattern in the platform's own number. (built)
Before the platform acts on one number, it looks at the whole pool of that client. If at least 4 of the client's numbers ended their latest call within ten minutes, and more than half of them failed the same way, the fault is almost certainly in the phone provider or the line, and not in the numbers. The platform then pauses calling for that client, and it shows the client a message in plain words. It does not throttle any number and it does not take any number out of service, so the pool is whole when the fault ends. The pause does not lift on its own, and no button lifts it yet: an engineer clears it in the database after the fault is gone. (open question) One number that fails alone, while the others are fine, is still throttled or taken out of service as before. (built)
The platform also measures the size of each pool. It counts the numbers that can call now, the reserve numbers, and the share of numbers taken out of service in the last seven days. The team gets an alert when the working pool is smaller than the reserve, and when more than one number in ten went out of service in a week, for a pool of ten numbers or more. (built)
The platform also watches behaviour, as a second signature: the answers fall, and the short calls rise. This rule is decided but the daily job does not yet compare a number against the rest of the pool, so it does not move a number on its own today. (open gap)
Separate the network's rejection codes in the records. One code means “unwanted”. (proposed)
A throttled number gets a fixed trial at its lower daily limit before anything moves it again. It returns on its own once twenty-four hours have passed, at the next daily run, so the trial lasts one to two days. Refusals during the trial do not move it; a block spoken plainly by the network still takes it out of service at any time. A number that had finished its ramp returns to full service; any other returns to warm-up. Before this, the very next refused call could already pull it out of service, which gave the lower limit no real chance to work. (built)
A quarantined number rests, and then returns to service through warm-up, never straight back to full speed. The rest is fourteen days today. The industry guidance is two to four weeks, and the platform holds the near edge of that range until a firmer figure is set. An operator can also end the rest early by hand, when there is a reason not to wait — a confirmed carrier fix, for instance. (built)
A caller can dispute a wrong label. The stored consent record is the evidence that makes the dispute credible. Today an operator reads the Telnyx report and starts that dispute by hand; the platform does not request a review on its own. (a person does this today)

Who decides a call is spam gives the full state of both detection signals, direct and behavioural.