Consent queryable by contact ID with an index
Why it matters
A consent table with no index on contact_id requires a sequential scan for every pre-send consent check. At 100,000 contacts with an average consent history of 3 records each, that is 300,000 rows scanned per recipient per campaign — multiplied across batch send volumes, this degrades send throughput and can cause pre-send checks to time out, forcing code paths that skip the check entirely to meet send deadlines. ISO 25010:2011 performance efficiency directly covers this: the system must perform the correct function (consent verification) within the required time under the stated load.
Severity rationale
Low because the operational impact (slow sends) is real but the compliance risk is indirect — the consent check still runs, it is just slow enough to become a reliability pressure that leads teams to skip it.
Remediation
Add the index in a migration. If you filter by both contact_id and scope at query time, a composite index is more efficient than two separate indexes:
-- Composite index covers (contact_id, scope, created_at) lookups
CREATE INDEX idx_consent_records_contact_scope
ON consent_records(contact_id, scope, created_at DESC);
Verify the index is used by running EXPLAIN ANALYZE on the consent lookup query in your staging database before deploying to production. Add this migration to supabase/migrations/ with a timestamp prefix.
DetectionPro
The detection method for this pattern is part of AuditBuffet Pro.
The full method (what to look for, pass and fail conditions, and how results get reported) ships inside the Compliance & Consent Engine Audit. The pattern definition, severity rationale, and remediation remain openly licensed under CC-BY-4.0.
External references
- iso-25010:2011 · performance-efficiency.time-behaviour — Time behaviour — response time at scale
Taxons
History
- 2026-04-18·v1.0.0·Initial import from compliance-consent-engine·automated