Compliance guide

PRYVC’s core artifact is the share fingerprint — a SHA-256 over the canonical facts of a consent:

share_id · client_id · consumer_id · fields · purpose ·
granted_at · expires_at · origin_domain · terms_version

It’s shown to both parties, embedded in confirmation emails, and stored under a database uniqueness constraint.

What you can prove

Question	Answer source
Did this person consent?	The share record + fingerprint, timestamped at grant
To what, exactly?	The field list and purpose frozen into the fingerprint
For how long?	expires_at — after which events stop and use must cease
Was consent withdrawn?	share.revoked + your cease-contact acknowledgement, both audited
Has the history been altered?	No — every audit row hash-chains to its predecessor

The audit chain

Each audit entry stores row_hash = SHA-256(prev_row_hash ‖ canonical_json(event)). Rewriting any historical entry breaks every subsequent hash — tampering is mathematically evident. The table is append-only at the database-grant level and protected by a trigger.

These mechanics aren’t proprietary: PRYVC implements the open Share Protocol (SP/1), whose specification and test vectors let your auditors verify our evidence independently — no PRYVC cooperation required.

Anchored outside PRYVC

The chain doesn’t only live with us. Every grant, revocation, cease acknowledgement, and consent certificate is also anchored — as hashes and timestamps only, never personal data — into Engrave, a separately operated append-only ledger with cryptographically signed history. The chain head is additionally checkpointed there every 15 minutes. In practice: altering a PRYVC record after the fact would require rewriting two separate systems in perfect agreement, and the mismatch would be provable. Certificate verification pages show the anchor receipt on every certificate.

Your obligations as a business

1. Use shared data only for the stated purpose, within the consent window.
2. On share.expired: stop using the data; you stop receiving updates automatically.
3. On share.revoked: cease contact within 10 business days and acknowledge (portal or POST /v1/shares/:id/cease-ack). Non-response is recorded and surfaced to the consumer — including in affidavit packages they can file with regulators.

Data minimization by design

PRYVC only ever releases the fields a consumer approved, encrypted per-share, decryptable only while the share is active. There is no bulk export, no cross-share query, and no way for a leaked API key to reach another business’s data.