POPIA wants you to demonstrate, not assert. An auditor asking "show me the moment this contact opted in" is the gold standard. A platform that changes the consent flag in place cannot pass that test.
Append-only by design
Every change to a contact's opt-in state writes a new entry to the record. Source: import, inbound STOP, agent action. Timestamped, signed, never edited.
What this catches
- STOP messages that arrived at 03:00 and were never acted on: caught by the broadcast filter
- Imports that re-introduced an opted-out contact: flagged before the send
- Agent edits that look benign but change a consent flag: visible in the audit