The proof of consent

When someone accepts, we don't save a ticked box: we build a document. Inside it is the exact text that person read, the date and time, the channel they arrived from, the network address of the request, and the confirmation of the code we sent them. It is all of these together that make proof. A ticked box, on its own, proves nothing about what anyone saw.

Of the form the person read we keep a fingerprint: a code that changes if even a comma changes. You can rewrite the form tomorrow, change the offer, rebuild the site: the consent collected yesterday stays tied to yesterday's text, and it shows. That is the difference between saying “they accepted” and showing what they accepted.

The date of a consent is the first thing to be contested, and a time written by the supplier is worth exactly the supplier's word. We record the exact time of signing, to the second. And every day a European third party stamps the whole set of signatures with a qualified timestamp: from that moment they can no longer be altered, not even by us who do hold the keys.

Every consent has a public verification page. Whoever calls you to account (a customer, a lawyer, an authority) opens the address and sees whether the proof holds, with no account and without asking you for anything. We also publish the tool to redo the check independently, outside our systems: proof that can only be verified by asking us is not proof, it is a promise.

Anyone who subscribes can leave whenever they want, from a link or by replying STOP, and receives a receipt at that same moment. That exit enters the register just like the entry: with the date, the method and the receipt. The day someone says “I had revoked”, the answer is a document, not a memory.