Compliance email

Every org names a compliance contact address: the inbox Seismic uses for compliance correspondence. It's a required field on POST /orgs and can be changed afterwards from the endpoints below. Setting it kicks off an ownership check: if the address already belongs to a verified member of the org, it's marked verified immediately. Otherwise Seismic emails a confirmation link and the address stays unverified until the recipient clicks it.

The current value and its verification state surface as compliance_email and compliance_email_verified on the Org record.

Endpoints

• PUT /org/compliance-email, set or change the address (owner/admin).
• POST /org/compliance-email/resend, re-send the pending verification link (owner/admin).
• POST /orgs/compliance-email/verify, consume a verification token (public; the link is its own credential).