certified consent
When a buyer, a carrier, or a regulator asks what someone agreed to, most teams can produce a database row and a page that has since changed. PRYVC seals the verbatim disclosure, every named recipient, the purpose, and the moment — into a record anyone can verify without taking your word for it, or ours.
Ninety seconds, with your own email: issue a real certificate, verify it on a page we don't control, then withdraw it and watch the record change. Nothing about it is mocked.
All of it is hashed into one fingerprint at the moment of submission. Change any part afterwards and the fingerprint no longer matches — which is the point.
The verbatim disclosure
The exact words shown, plus their SHA-256 — not a template that may have changed since.
Every named recipient
Sorted and hashed in, so presentation order cannot alter the commitment.
Who they accepted, and who they declined
When your form offers a choice per recipient, both sets are bound in — and "asked, declined none" is recorded differently from "never asked".
Purpose and duration
What it was for, and for how long.
The moment and the origin
Timestamp, page URL, and a domain you verified by DNS.
Device and network
Recorded as corroboration — never part of the fingerprint.
An external anchor
The chain head is checkpointed to a separately operated ledger every 15 minutes, and published.
Regulation names the requirement most explicitly in Medicare, but the underlying problem — proving what a person agreed to, months later, to someone who was not there — is the same in every market where leads change hands.
Medicare & health
CMS requires each recipient to be named on the disclosure. Carriers and FMOs audit for it.
Mortgage & lending
Buyers want proof a borrower agreed to be contacted, not a screenshot of a page.
Solar & home services
High-ticket, high-complaint. Evidence settles disputes before they escalate.
Legal & mass tort
Intake volume plus plaintiff scrutiny makes an unprovable opt-in expensive.
Education
Enrollment leads change hands repeatedly; consent has to travel with them.
Insurance (P&C, life)
Quote comparison means many recipients. Naming them is the whole ballgame.
A note on scope, because the internet is full of stale advice: the FCC's one-to-one consent rule was vacated in January 2025 and is not in force. CMS's requirement for Medicare marketing is, and is unaffected by that ruling. Outside Medicare, naming every recipient is a buyer expectation and an evidence advantage — not a federal mandate. Treat anyone telling you otherwise with suspicion.
It attaches to the form you already have. Your visitor needs no account, and PRYVC never ticks the consent box for them — they tick it themselves, which is precisely what makes the record worth having.
<script
src="https://cdn.pryvc.com/v1/pryvc.js"
data-client-id="pc_your_client_id"
data-mode="consent"
data-purpose="Discuss coverage options"
data-entities="Your Agency|Your Partner LLC"
data-checkbox-selector="#agree"
data-disclosure-selector="#disclosure"
></script>Capture is fail-open: if anything goes wrong on our side, the visitor's submission still goes through. A lost lead is worse than a lost certificate.
Any person can withdraw consent from the certificate's own verification page by proving control of the email address on it — no account with us, because they never had one. The certificate is never deleted — it moves to revoked, with both the original agreement and the withdrawal timestamped in the chain, and a ten-business-day deadline to cease contact starts. You are told the moment it happens.
That record protects you as much as them. Honoring an opt-out you can prove you received on a specific date is a far better position than arguing about whether you received it.
A record only you can vouch for is worth very little in a dispute, so none of this depends on our word — or our uptime.
Public verification, no account
Anyone with the certificate URL can check it. No login, no API key, no relationship with us.
An independent verifier
sp1verify is an open-source Python tool written from the specification rather than ported from our code. It agrees with us on every published vector.
Portable evidence packs
Export a self-contained record that verifies offline. It keeps working if we are unavailable — or gone.
Externally anchored
The chain head is checkpointed to a separately operated ledger on a fixed cadence and published, so anyone who records a checkpoint can later prove whether the history behind it changed.
A published protocol
SP/1 is open, with normative test vectors and a machine-readable description of the hub surface. Anyone may implement it.
An append-only chain
Every issuance and withdrawal is hash-linked. Removing one entry breaks every entry after it.
Specification and vectors at shareprotocol.org; the hub API description at /hub-api.
what's coming
People are already handing errands to AI assistants, and requesting a quote is exactly the kind of errand they hand over. The lead is real — someone genuinely wants the quote — but the evidence underneath it quietly stops working.
Consent tooling built on session replay and behavioral signals assumes a human at a browser: mouse movement, keystroke timing, time on page. An agent produces none of it. The session either looks like a bot and gets scored as fraud, or it looks clean and proves nothing — and you cannot tell which from the outside.
A person still ticks the box
Our agent surface offers no tool that can grant consent — by design. Agents read, update and revoke; agreeing needs a human at a consent screen.
Evidence a machine can check
A fingerprint over canonical facts is verifiable by software against a published spec. A recording is something only a person can watch and only a vendor can vouch for.
Already built, not planned
The agent surface is live today with realm-scoped tokens and published documentation, so an agent can find it without asking us.
We are not claiming to know when this becomes most of your traffic. The point is narrower: evidence you collect today should still answer a carrier's question when it does, and a record built to be recomputed survives the shift where a record built to be watched does not.
$1,999/year for certified consent: the accountless widget, the certificate API, public verification pages, portable evidence packs, and revocation handling. No per-lead fee, so the cost of doing the right thing does not rise with volume.