Core concepts

Share

The unit of consent. A share is a grant from a subject to one recipient, committing to:

• fields — the exact registry keys released (nothing else is ever visible to the recipient);
• purpose — a human-readable statement of use, bound into the fingerprint;
• duration — an explicit expiry; grants are never open-ended;
• origin — the domain where consent was captured, pinned and verified.

A share moves through a defined lifecycle: active → revoked | expired | ceased. Each transition emits an event and an audit row.

Consent certificate

The accountless variant for form capture. A certificate proves what a visitor agreed to at submission time without requiring them to hold an account: the verbatim disclosure text (and its hash), the one-to-one entity list of named recipients, the purpose, page, timestamp, technical evidence, the policy text in force at opt-in, and a masked subject. Certificates are publicly verifiable at a URL and via JSON. Specification →

The evidence stack

Four layers, each independently checkable:

Layer	Mechanism	Detects
1. Fingerprint	SHA-256 over canonical JSON of the grant facts	Alteration of any committed fact
2. Audit chain	row_hash = SHA-256(prev_row_hash ‖ canonical_json(event))	Insertion, deletion, or rewrite of history
3. External anchor	Per-event entries + chain-head checkpoints in an independent Merkle ledger with signed tree heads	Coordinated rewrite by the hub
4. Public verification	Certificate URLs; every open recorded as evidence	— (makes 1–3 accessible to non-technical verifiers)

Policy snapshot

Consent is only as meaningful as the terms it was given under. At capture time the hub snapshots the origin domain’s privacy policy and terms text, hashes it, and binds the snapshot to the certificate — “the terms as of the opt-in.” Snapshots are deduplicated by content hash: unchanged text is one immutable record; any edit creates a new one. Details →

Cease obligation

Revocation is not a soft delete. When a subject revokes, the recipient enters a tracked obligation window (10 business days in SP/1) to acknowledge and cease contact. Acknowledgement, and equally non-acknowledgement, become permanent audit rows. Lifecycle →

Terminology

The key words MUST, MUST NOT, SHOULD, SHOULD NOT, and MAY in the specification pages are to be interpreted as described in RFC 2119.