Personalization via PHI Gateway

Personalization is where most outbound tools cut corners — a global LLM call with a templated prompt, hoping the recipient does not check where their data was processed. CogniLead cannot afford that posture, so PHI Gateway sits between the personalize worker and any LLM vendor and routes by recipient jurisdiction.

Routing rules

• Recipient in CH → Infomaniak-hosted Mistral, deployed in Switzerland.
• Recipient in EU → Mistral Large via EU-resident endpoints (Mistral La Plateforme, Paris region).
• Recipient in US → Anthropic Claude, US region.
• Recipient elsewhere → Anthropic Claude, US region, with a Chainlog note that no data residency commitment was met.

Strict JSON output

The personalize call returns structured JSON, not free text. The schema includes subject, body, technical_hook_verified, source_signal_refs, and jurisdiction_routed_to. We refuse to dispatch a draft that is not parseable as this schema — that gets a Chainlog event and the lead is dropped.

{
  "subject": "string ≤ 78 chars",
  "body": "string ≤ 800 chars",
  "technical_hook_verified": true,
  "source_signal_refs": ["sig_abc...", "sig_xyz..."],
  "jurisdiction_routed_to": "EU",
  "rubric_version": "outbound-gdpr@2026.06"
}

Hook verification = drop

The model is required to cite a specific source artifact in source_signal_refs. If it cannot — if it has hallucinated the hook — technical_hook_verified is false and the lead is dropped. This is the explicit policy that lets us claim we send fewer emails on purpose. Drop rates on the personalize stage typically run 20–35% on our internal corpus.