Global suppression list shared across campaigns

A per-campaign suppression list means an unsubscribe from Campaign A has no effect on Campaign B, C, or triggered automations. This is a direct CAN-SPAM § 5 violation: the law requires that opt-outs apply to all commercial email from the sender within 10 business days, not just the campaign the unsubscribe link appeared in. GDPR Art. 21 right to object similarly applies globally — an objection to marketing email must stop all marketing email, not one drip sequence. Per-campaign suppression is architecturally convenient (each campaign manages its own list) but legally and operationally incorrect.

Enforce a single global suppression table consulted before every send path — marketing, transactional, triggered, and drip:

async function isSuppressed(email: string): Promise<boolean> {
  const row = await db.suppression.findFirst({
    where: { email: email.toLowerCase().trim() }
  })
  return row !== null
}

// Apply in every dispatch path:
async function dispatchEmail(to: string, template: string, data: object) {
  if (await isSuppressed(to)) {
    await db.sendLog.create({ data: { to, template, outcome: 'suppressed' } })
    return
  }
  await esp.send({ to, template, data })
}

Audit every send path (campaign scheduler, transactional trigger, automation worker, drip sequence processor) and add the isSuppressed call if it is missing. Per-campaign exclusion lists can remain for content targeting, but the global suppression check must precede all of them.