logicspike/docs

Communication

The AWS request: text and field-by-field instructions

Do not paste this until every gate in readiness-checklist.md is green. Resolve every bracketed tag below, or delete its sentence. A request that still contains a bracket, or a claim that is not live that day, repeats the mistake of the earlier drafts.

Console fields

SES console → Account dashboard → Request production access (region Asia Pacific (Mumbai) ap-south-1). The form changes over time; treat these as the intent for whatever fields it shows.

Field Value
Mail type Transactional. This request contains no marketing mail.
Website URL https://vlozi.app
Use case description The text in the next section
Additional contact addresses ops@vlozi.app, only after its mailbox exists and an outside test mail has arrived in it (R4). It is the private vendor-contact address from contact-addresses.md; never name it publicly.
Preferred contact language English
Acknowledgement The account's recipients are people who signed up, people a workspace owner invited, and the owner of the workspace an alert concerns. Tick it only if you are comfortable that this meets "recipients who requested it".

Use case description (v5)

Hello,
 
I am Dipanshu Vishwakarma, the operator of Vlozi (https://vlozi.app), a small web platform for
publishing and growth tools. I am requesting production access in ap-south-1 for one purpose:
the system emails Vlozi sends to its own users. This account will not be used for marketing or
bulk mail. My earlier requests described a broader platform; this one covers only what is needed
now.
 
OPERATOR AND CONTACT
Dipanshu Vishwakarma, trading as Vlozi, Devgaon, Azamgarh, Uttar Pradesh 276201, India.
Our policies are published at:
  https://vlozi.app/terms
  https://vlozi.app/privacy
  https://vlozi.app/acceptable-use
  https://vlozi.app/anti-spam
  https://vlozi.app/abuse
  https://vlozi.app/sub-processors
Abuse and postmaster reports go to abuse@vlozi.app and postmaster@vlozi.app, which are
monitored; I acknowledge reports within one business day. [only if R4 is green]
 
WHAT WE SEND (THE COMPLETE LIST)
1. One-time login and verification codes, sent to the address the user entered.
2. Password-reset messages.
3. Workspace team invitations, sent only when an existing user invites a specific address.
4. Account messages: a welcome message after sign-up, and a confirmation when a user creates
   an additional workspace.
5. Billing and credit notices: a past-due reminder, a trial ending, a plan automatically
   downgraded, and a resource paused because credits ran out.
6. Alerts to the verified account email of a workspace's owner: a chat conversation waiting
   beyond its response target, credits running out so that chat replies pause, a scheduled
   newsletter campaign that was not sent, and a sending-health warning.
No promotional content is sent from this account.
 
WHO RECEIVES IT
People who sign up with their own address (the code goes to the address typed at sign-up, and
the account stays unverified until the code is entered); people an existing workspace owner
invited by typing that specific address; and the verified account email of the owner of a
workspace, for alerts. Recipients of this account's mail are never taken from an uploaded,
purchased or rented list. Sign-up is limited to 5 attempts per IP address per 15 minutes,
verification-code resends to 10 per IP address per 15 minutes with a cooldown per address, and
invitations to 5 per recipient per day. [only if R7 is verified]
 
OPT-OUT
These are service messages tied to an account, so there is no marketing unsubscribe. A user who
no longer wants them can delete their account in Settings, after handing over or deleting any
workspace they own. Anyone who receives an invitation they did not want can ignore it or write
to abuse@vlozi.app. [only if R4 is green]
 
VOLUME
The platform is early-stage and has a small number of workspaces. I expect fewer than 500
messages a day over the next 90 days. I am asking for headroom to 2,000 a day at 5 messages a
second, and I will accept a smaller quota.
 
AUTHENTICATION
vlozi.app is verified in SES with DKIM. [only if the console shows SUCCESS] A custom MAIL FROM
domain (bounce.vlozi.app) provides SPF alignment. [only if R3's MAIL FROM status is SUCCESS]
DMARC is published as [exactly what the DNS lookup shows that day], with aggregate reports.
 
BOUNCES AND COMPLAINTS
SES events are published to Amazon SNS and delivered to our webhook, which verifies the SNS
signature before trusting a message. A complaint suppresses the address permanently. A hard
bounce suppresses it for 180 days, and permanently if it bounces again. [The SES account-level
suppression list is enabled. only if get-account shows BOUNCE and COMPLAINT] I monitor the SES
reputation metrics with CloudWatch alarms at [4% bounce / 0.1% complaint]. [only if R9 is green]
 
If anything in this request does not meet your requirements, please tell me what, and I will
fix it.
 
Thank you,
Dipanshu Vishwakarma

Tags to resolve

Tag Resolve with If you cannot
[only if R4 is green] (two sentences) Delete the bracket if R4 is green Delete the sentence
[only if R7 is verified] Delete the bracket once the 429 checks in R7 have passed Delete the sentence
[only if the console shows SUCCESS] Delete the bracket if DKIM status is SUCCESS Delete the sentence
[only if R3's MAIL FROM status is SUCCESS] Delete the bracket if the MAIL FROM check passes Delete the sentence
[exactly what the DNS lookup shows that day] Write the policy from Resolve-DnsName _dmarc.vlozi.app -Type TXT (for example p=none) Delete the DMARC sentence
[The SES account-level suppression list ... only if get-account shows BOUNCE and COMPLAINT] aws sesv2 get-account --region ap-south-1 --query "SuppressionAttributes" Delete the sentence
[4% bounce / 0.1% complaint] and [only if R9 is green] The real alarm thresholds from R9 (set 2026-10-26: 4% and 0.1%; the console cannot hold 0.08%) Delete the sentence

The operator name and address are copied from apps/website/lib/legal.ts (spelling confirmed 2026-10-07). Check that the AWS account's contact details carry the identical name and address (R2). The six URLs must return 200 and match this text on the day you submit (R8).

Must not appear unless verified live that day

DMARC quarantine; abuse or postmaster monitored; any rate limit; any alarm; "platform-wide unsubscribe"; Turnstile on sign-up; booking or confirmation mail; automatic pausing of sending (it is off in production, gap-log G68); anything about tenants' newsletters, mailboxes or custom domains; any volume you have no basis for.

After you submit: copy the case ID and the exact text into case-log.md the same day, then follow README phases 5 and 6.

Communication