Compare: certified consent today
The incumbent model for lead-flow consent certification — TrustedForm (which now also owns Jornaya) — records a session replay and a certificate URL, held in the vendor’s custody. It answers “did they consent?” with “we saw it, trust us.” That model has real value, but it has a structural ceiling: the evidence is only as good as the custodian’s word and continued existence.
The structural difference
Section titled “The structural difference”| Question an auditor asks | Custody model | SP/1 |
|---|---|---|
| Could the vendor alter a record after the fact? | Unfalsifiable — you have their word | Detectable: fingerprint + hash chain + external anchors break |
| Can I verify without the vendor’s cooperation? | No — certificate lookup requires the vendor | Yes — recompute hashes from the spec; verify Merkle proofs against a pinned key |
| What exactly was disclosed, verbatim? | Session replay (pixels; requires playback trust) | Disclosure text + SHA-256, committed into the fingerprint |
| Were the named recipients bound in? (one-to-one) | Depends on what the page showed; not a commitment | entities list is sorted and hashed into the fingerprint |
| Which terms were in force at opt-in? | Not captured | Policy snapshots, content-hash-deduplicated |
| What happened after consent — revocation, cease? | Out of scope | First-class lifecycle with obligation clocks; silence is evidence |
| Can the consumer see and control their record? | No | The subject holds, monitors, revokes — it’s their grant |
| If the vendor disappears, does the evidence survive? | Effectively no | Anchored commitments survive in an independent ledger; verifiers need only the spec |
What this is not
Section titled “What this is not”SP/1 is not a claim that custody models are useless — replay artifacts are persuasive and familiar. The claim is narrower and stronger: evidence whose integrity depends on trusting one company is weaker than evidence anyone can recompute. A market with a single certification vendor is exactly the market that should demand operator-independent verification.
For TPMO / Medicare flows specifically
Section titled “For TPMO / Medicare flows specifically”CMS one-to-one consent requires that the consumer agreed to sharing with the specific named entities. In SP/1 the entity list is not a screenshot detail — it is a sorted, hashed component of the certificate fingerprint. Adding an entity after the fact is not “hard to notice”; it is a different hash.
Try it live: the demo issues real certificates with public verification pages.