Certified consent explained
A consent certificate is a tamper-evident record of exactly what a person agreed to on your form — designed for compliance teams, not engineers.
What each certificate contains
Section titled “What each certificate contains”- The disclosure, verbatim. The consent language exactly as it was displayed at the moment of submission, plus a cryptographic hash of it.
- The entity list. Every organization named as receiving the data — bound into the fingerprint, not just displayed. Consent is evidence only for the entities the person actually saw, so adding a recipient afterwards produces a different hash rather than a quiet edit. Some regulated flows require this explicitly; buyers and carriers increasingly ask for it regardless.
- Purpose, page, and time. What the data will be used for, the exact page URL, and a timestamp, alongside technical evidence (IP address, browser).
- The subject’s details, sealed. The submitted fields are encrypted; the public record
shows only a masked identifier (like
j***@e***.com). - A fingerprint. A cryptographic digest binding all of the above together and anchored in PRYVC’s hash-chained audit log — any tampering with any historical record is detectable.
The terms as of the opt-in
Section titled “The terms as of the opt-in”Each certificate also pins your privacy policy and terms as they read at that moment: PRYVC snapshots the text, hashes it, and links the snapshot to the certificate. If a dispute surfaces two years later, you can show not just what the person agreed to, but the exact policy wording that was in force when they did.
Verifying a certificate
Section titled “Verifying a certificate”Anyone — a carrier, an auditor, a regulator, the consumer — can check a certificate without an account by opening its verification page:
https://verify.pryvc.com/c/<certificate-id>Every open of that page is itself recorded as evidence — when it was checked, from where,
and on what device — and the count is visible to you in the portal. (Systems can use the
JSON endpoint at api.pryvc.com/v1/certs/<id>/verify instead.)
The page shows the business, entity list, disclosure, purpose, status, and fingerprint, with the subject masked. Your own team sees full records under Consent certs in the portal, and systems can pull them via the certificate API (see the developer docs).
Withdrawal and the 10-day clock
Section titled “Withdrawal and the 10-day clock”How someone withdraws. The person who filled your form has no PRYVC account — that is the point of accountless capture — so they withdraw from the certificate’s own public verification page. They enter the email address recorded on the certificate, receive a six-digit code at that address, and confirm. Proving control of the address is what authorizes the withdrawal; nothing else is required of them.
Because certificate ids are public, the page answers identically whether or not an address matches. Nobody holding a certificate link can use it to discover whose address is on it.
What happens on your side. The certificate moves to revoked with the moment
timestamped, a 10-business-day deadline to cease contact begins, certificate.revoked
is appended to the audit chain, and the owner on your account is emailed with the
certificate id and the deadline. An obligation you don’t know about isn’t one you can meet.
Nothing is deleted. The record, the verbatim disclosure, the named recipients and every hash remain exactly as issued. The public page simply reads Consent revoked with the date. That matters in both directions: it is evidence of the original agreement and of its withdrawal, so honoring an opt-out you can prove you received on a specific date is a far better position than arguing about whether you received it.
Per-recipient decisions
Section titled “Per-recipient decisions”If your form offers a choice per recipient, the certificate records who was accepted and who was declined, and binds both sets into the fingerprint.
The distinction is exact and deliberate: a certificate where the visitor was never offered a choice is not the same as one where they were asked and declined nobody. Those two hash differently, so a later reader can tell which happened. Where a regulator requires per-recipient consent — CMS does, for Medicare marketing — that difference is the whole question.
If your form offers no such choice, nothing changes: the certificate names every recipient, as it always has.
Try it
Section titled “Try it”The live demo issues real certificates against a demo tenant — submit the form and follow the verification link yourself.