Nothing sends until the account turns notifications on

A new account hears nothing — no bell, no email, no text — until somebody there deliberately switches notifications on for themselves.

What it is

A single account-level timestamp checked at every dispatch entry point. Until it is set, the dispatcher logs and sends nothing. A failed read counts as not enabled.

Also called: opt in to notifications · stop all emails · notifications are off by default

See it
Nothing sends until the account turns notifications on
Area
Platform & Admin
Group
Notifications
System
Notifications
Solves
2 named problems
01orgNotificationsEnabled reads organizations.notifications_enabled_at and fails closed on any error.
02It is checked once per dispatch rather than inside the per-recipient path, so it does not become one query per person notified.
03Once on, an event with no preference row falls back to the registry defaults, which the account can then dial back per event.
The account-level banner at the top of Settings → Notifications, off, with its explanation. NotificationsTab.tsx. Sample data — no customer information appears here.
How it works
  1. 1orgNotificationsEnabled reads organizations.notifications_enabled_at and fails closed on any error.
  2. 2It is checked once per dispatch rather than inside the per-recipient path, so it does not become one query per person notified.
  3. 3Once on, an event with no preference row falls back to the registry defaults, which the account can then dial back per event.
Why we built it

Migration 149 quotes the owner directly (2026-): “we want to make sure that the users don't get notifications from our system until they've said and enabled the notifications for themselves… If they enable them, then they will own the responsibility for receiving them.” The failure it replaced is spelled out: absence of configuration meant NOTIFY, not silence, and because the preferences table was unwritable until migration 134, 'every tenant has always been on "admin gets everything by email" without anyone choosing it. A new sub-account therefore started emailing its owner and its homeowners from the first completed stage. That is how a sending domain earns a junk-folder reputation before anyone has decided the product is useful.' Fail-closed is deliberate: 'missing one notification is recoverable, and mailing a tenant's customers during a database blip is not.'

The problem
  • Default-on notification behaviour nobody chose
  • Outbound mail to homeowners from a brand-new account
Sound familiar?
What you get
A quiet account until you say otherwise
Sending reputation protected

See it on your own jobs

Twenty minutes, your numbers, no slide deck. We’ll build one of your real buildings in front of you and send you the estimate link at the end — yours to keep either way.

or keep browsing features →