Products/Outreach
Cold email
Compliant cold email automation, where the guardrails are the product.
Outreach runs behind one gate. A workspace must have accepted the Acceptable Use Policy and not be paused before it can send at all; then every individual lead is checked against do-not-contact, unsubscribes, a durable suppression list and business-only targeting. Anything that fails is blocked and logged with its reason, not sent.
Business contacts only by default · One-click unsubscribe on every email · You are responsible for your lawful basis
What it does
A small number of emails, sent carefully.
This is not a list-blasting tool and it is not built to become one. It composes against what you already know about a lead, runs multi-step sequences that terminate themselves when a lead engages, and hands every inbound reply back to you before answering it.
Drafts grounded in the thread, not a mail merge
A message is composed against everything already recorded for that lead across email and calls — one timeline, not a spreadsheet row with a first-name token in it.
HOW · composeOutreach() reads the lead’s cross-channel timeline and the workspace persona, then meters one draft credit; the send path composes only when you did not supply a body.
Sequences that can stop themselves
A sequence is an ordered list of steps, each on a channel with a wait and a goal. A lead who replies, unsubscribes or is marked won or lost terminates their own enrollment.
HOW · a cron tick claims an enrollment by advancing its step BEFORE executing it, so an overlapping tick cannot double-send; the trade-off is at-most-once, which is the right default outbound.
Inbound replies are never auto-answered
When a lead writes back, the reply is recorded, the lead is marked engaged, a response is drafted — and then it waits for you, exactly like the social approval queue.
HOW · ingestInboundEmail() ends at enqueueOutreachApproval(); inbound text is untrusted, so nothing composed from it is ever dispatched without a human releasing it.
The gate
Ten filters, and what each one blocks.
Not a description of a compliance philosophy — the list itself. The first three are workspace-level and stop every send at once; the rest run per lead. The last column marks which are fixed and which are defaults you own, because that difference is the honest part.
| Filter | What it blocks | Enforced in | Setting |
|---|---|---|---|
| AUP acceptance | Every send and every call from a workspace that has not accepted the current policy version | aup.hasAcceptedCurrentAup() | Required |
| Payment on file | Sends from a workspace with no card, as an identity and accountability signal | billing.hasPaymentOnFile() | Required when billing is live |
| Compliance pause | Every send while the workspace is held, whether the kill switch or a human paused it | killswitch.isOutreachPaused() | Always |
| Do-not-contact | Any lead flagged dnc, on every channel, before any other lead-level check | consent.canEmail(), consentGate() | Always |
| Unsubscribed | Leads whose status is unsubscribed, or who carry an email opt-out from a bounce or a complaint | consent.canEmail() | Always |
| Suppression list | Any address in outreach_suppressions for that workspace — on the channel, or on all | suppression.isSuppressed() | Always |
| Business-only targeting | Cold leads with no company name on the record | eligibility.hasBusinessContext() | businessOnly, on by default |
| Free-domain block | Cold leads at any of 30 consumer mailbox domains — gmail.com, outlook.com, icloud.com, proton.me and the rest | eligibility.FREE_EMAIL_DOMAINS | Part of businessOnly |
| Mobile line block | Calls to numbers the telephony lookup returns as mobile or personal | eligibility.lineTypeGate() | blockMobile, on by default |
| Calling window | Dials outside 09:00–20:00 in the lead’s own timezone, and dials at the weekend | consent.withinCallingHours() | 9–20 local, weekends off |
A check marks a filter no workspace can switch off. A minus marks a default the workspace owns — turning business-only targeting off is a decision you make and remain responsible for.
How a send goes out
Four checks, in this order.
Email and voice share the workspace gate, so a paused workspace cannot route around it by switching channel. Below the workspace level, one function decides whether a given lead may be emailed at all — there is no second send path that skips it.
- 1
Step 1
The workspace is checked
workspaceMaySend() runs first: has this workspace accepted the current AUP, does it have a card on file where billing is live, and is it currently paused. A failure here stops every send, not one.
- 2
Step 2
The lead is checked
assertEmailable() is the single choke point: consent and do-not-contact, then the durable suppression list, then business-only targeting. A blocked lead is written to the audit log with the reason, not silently skipped.
- 3
Step 3
The email is built
A one-click unsubscribe token is minted into the List-Unsubscribe and List-Unsubscribe-Post headers, and a footer carrying the sending company, an AI-assistance disclosure and a visible unsubscribe link is appended to both the text and HTML parts.
- 4
Step 4
The result feeds back
The send records a sent signal. A later bounce suppresses the address; a spam complaint unsubscribes the lead and suppresses them; an unsubscribe does both. Each of those re-evaluates the kill switch.
The kill switch
It stops before you notice.
Bounces, spam complaints and opt-outs are recorded as signals against the workspace, and every negative one re-evaluates the thresholds. When a threshold trips, outreach is paused and stays paused until a human lifts it — the send path checks that flag before anything else.
- Five spam complaints in the window trip it regardless of rate or volume.
- Past twenty sends, the complaint, bounce and opt-out rates each get their own ceiling.
- The pause is a workspace flag, so it blocks calls as well as email.
- Resuming is a human decision after review — nothing lifts it on a timer.
// lib/killswitch.ts
export const DEFAULT_THRESHOLDS: KillSwitchThresholds = {
windowHours: 24 * 7, // rolling 7-day window
minVolume: 20, // rate rules need volume first
maxComplaintsAbs: 5, // absolute — trips regardless of rate
maxComplaintRate: 0.005, // 0.5% of sends
maxBounceRate: 0.15, // 15% of sends
maxOptOutRate: 0.3, // 30% of sends
}What you accept
The policy is a gate, not a footer link.
Before a workspace can send anything, an owner or admin has to accept the Acceptable Use Policy and affirm three separate representations. A partial acceptance is rejected. The acceptance is stored with the user, their email, the policy version, the timestamp, the IP address and the user agent.
The three attestations
- 1I have a lawful basis and, where required, prior consent to contact each lead I add — and I will honor every opt-out and do-not-contact request.
- 2I am solely responsible for the legality of my outreach, including TCPA, CAN-SPAM, GDPR/ePrivacy and do-not-call rules. FounderReply’s filters are tools I use at my discretion, not legal advice or a guarantee of compliance.
- 3I understand that violating this policy — or generating excessive spam complaints, bounces or opt-outs — will result in my workspace being suspended or terminated.
What we will not tell you: an inbox-placement rate, a deliverability figure or a reply rate. Those depend on your domain, your sending history, your list and your copy — none of which this product can measure on your behalf, and any number printed here would be decoration.
FAQ
Before you import a list.
Who you may contact, what the filters do and do not promise, and what happens the moment somebody complains.
What makes this compliant cold email automation rather than a spam tool?
A gate that runs before the sender does. A workspace cannot send at all until an owner accepts the Acceptable Use Policy, and each individual send is checked against do-not-contact, unsubscribes, a durable suppression list and business-only targeting. Every email carries one-click unsubscribe headers and a visible opt-out.
Does FounderReply guarantee my outreach is legal?
No, and it says so in the policy you have to accept. The filters are tools you use at your discretion — not legal advice and not a guarantee of compliance. You are responsible for having a lawful basis to contact each lead under CAN-SPAM, GDPR, ePrivacy, TCPA and any do-not-call rules that apply to you. Read the Acceptable Use Policy before you start.
Can I email people at gmail.com or outlook.com?
Not on a cold send while business-only targeting is on, which is the default. Thirty consumer mailbox domains are treated as non-business and blocked along with any lead that has no company name. A lead marked warm — someone who gave you their address directly — bypasses that targeting rule, though consent and suppression still apply.
What happens when someone unsubscribes?
The lead is marked unsubscribed and their address is added to the workspace suppression list, which is stored separately from the lead. Deleting and re-importing that contact does not resurrect them: the next send scrubs against the address, not the record. The opt-out also counts toward the kill switch.
What stops one bad campaign from running for a week?
A rolling 7-day kill switch. Five spam complaints trip it outright, regardless of rate. Past twenty sends, a complaint rate over 0.5%, a bounce rate over 15% or an opt-out rate over 30% each pause the workspace, and every bounce, complaint and opt-out re-evaluates it immediately.
Do you tell recipients an AI wrote the email?
Every outreach email carries a footer naming the business responsible for the outreach, disclosing that the message is sent with AI assistance and that the recipient may be contacted by an automated assistant, and offering an opt-out. The workspace can supply its own wording; it cannot remove the footer.
What happens when a lead replies?
The reply is recorded on the lead’s timeline, the lead is marked engaged, and a response is drafted and placed in an approval queue. Inbound text is untrusted, so nothing composed from it is ever sent automatically — you release it, exactly as on the social side.
Get started
Send less. Send it properly.
Accept the policy, add a business contact, and watch the gate refuse the ones it should refuse. The filters run whether or not you read this page — that is the point of putting them in the send path instead of the marketing.
Free to start · No credit card required · You remain the sender of record