Consent capture and consent certificates

Prove what they saw, and that they agreed to it.

CapchaConsent captures the consent moment as evidence rather than as a database row: the exact disclosure the person was shown, the explicit opt-in boxes they ticked and when, the network origin the request actually came from, and a dual human screen proving a person — not a script — submitted it. All of it is hashed, sealed, and folded into a tamper-evident chain that a counterparty, an auditor, or opposing counsel can verify without your dashboard and without taking your word for anything.

Create a free account View a sample Evidence Record See sealing and live verification vs TrustedForm

6 credits per consent certificate (≈ $0.03), with five-year retention and bot screening included on every plan — not sold as add-ons. See pricing.

Documents, identity material, and supporting evidence organized into one reviewable record. Consent evidence
The moment, not the summary.Disclosure, grants, origin, and human-check verdict, sealed together under one hash.
Honesty, up front: a consent certificate is recordkeeping infrastructure designed to support a TCPA/TSR compliance program. It is not legal advice, not a compliance guarantee, and not a regulatory determination — and admissibility is always a court's call. We publish the full methodology so your counsel can evaluate it on its merits instead of on our adjectives.

The problem: “they consented” is a claim, not a record

When a consent dispute lands — a TCPA demand letter, a privacy complaint, a buyer auditing your lead source — the question is never whether you have a row saying consent: true. It is what exactly the person was shown, whether they took an affirmative action or merely failed to opt out, where the submission actually came from, whether a human submitted it at all, and whether any of that could have been edited afterwards.

A CRM row answers none of those. A screenshot answers none of them either, because a screenshot is something you made. CapchaConsent answers all of them from a single sealed artifact whose integrity a third party can check independently — and it screens the submitter before certifying, so you are recording a screened human's consent rather than certifying a bot-submitted lead.

How it works

  1. Drop the widget on your page. One tag renders a lead form with explicit opt-in checkboxes and a server-built disclosure paragraph — or, if you already have a form you like, point the widget at it and it wraps yours instead of replacing it.
  2. The person reads a disclosure built server-side. The consent language is generated by CapchaCloud, not pasted by whoever last edited the landing page: it names your company, links your terms and privacy policy, and states the autodialer, marketing-scope, “consent is not a condition of purchase,” message-rate and STOP elements in one paragraph.
  3. They tick real checkboxes. The consent boxes are explicit opt-in controls, not implied-by-submission acknowledgements, and the record captures their actual checked state plus the millisecond at which each one was checked or unchecked.
  4. Two independent human screens run. A managed human-verification challenge, plus an invisible proof-of-work the browser solves in the background before submit. Both are verified server-side. A missing challenge token is a 400 and a failed challenge is a 403 — not a warning written to a log — and the always-pass sandbox key is refused in production.
  5. The edge observes the origin, and the browser is not asked to be honest about it. IP, edge geolocation, network and TLS characteristics, and bot signals are read server-side. Any client-supplied risk block is deleted before evaluation, and the widget-provenance stamp is overwritten server-side so it cannot be spoofed.
  6. Six credits are drawn, then the certificate is sealed. The charge lands past every free validation, rate-limit, and daily-cap gate, right before the certificate is committed — so a rejected capture never costs you anything. The payload is hashed with SHA-256, stored under that hash, indexed, and written into the append-only audit chain.
  7. Anyone can check it afterwards. A hosted certificate page, a public no-PII verification endpoint, and a signed evidence bundle that verifies offline with no calls back to us.

What the consent record actually contains

One sealed payload, hashed with SHA-256, stored under that hash. Every field below is inside the hash, so altering any one of them changes the identifier the certificate is filed under.

GroupWhat is sealed
The disclosureThe verbatim disclosure HTML as it was rendered to the person, captured in the payload itself. If it ever exceeds the size cap, the record says so explicitly rather than silently shortening it.
The grantsPer-checkbox state from the real .checked values — which consents were affirmatively given, and which were left unticked.
Policy snapshotA separate immutable content hash binding the company name, website, privacy URL, terms URL, and the lead-program and disclosure version labels in force at that exact moment — so “which version of the terms was live?” has an answer.
Identity fieldsName, email, and phone as submitted, plus the campaign and form identifiers and the page URL and referrer.
Origin forensicsServer-observed at the edge: client IP, HTTP protocol, TLS version and cipher, and geolocation — country, EU flag, continent, region and region code, city, postal code, approximate latitude and longitude, time zone, metro code, edge location, ASN and AS organization.
Geo honesty labelsCoordinates are coarsened to roughly a kilometre before sealing and tagged with their provenance and precision, so the record cannot be read as GPS. Requesting more precision on an IP-derived coordinate is silently downgraded rather than sealing false precision.
Human-check verdictA versioned block recording the managed challenge result, each proof-of-work verdict with its provider and difficulty, and the list of methods that actually passed. Only methods this platform independently verified are ever recorded.
Risk signalsBot score, verified-bot and static-resource flags, proxy and mobile indicators, ASN, edge location, TLS cipher, and a derived risk level — all server-side. A passive bot score is deliberately not treated as proof of humanity on its own.
Engagement behaviourTime to first interaction, dwell time, scroll depth, pointer movement, per-field focus and blur events, per-field keystroke counts, and per-checkbox timestamps. It never records keystroke content or field values — that limit is written into the tracker itself.
Client contextBrowser-reported user agent, language, time zone, screen and viewport size — each one paired with the server-observed edge equivalent, so a mismatch is visible rather than hidden.
Visual recordA DOM snapshot of the page as rendered, and an optional linked video clip with its own id, type, duration and size.
JurisdictionDerived from the observed edge country, so an EU data subject gets EU treatment instead of a hard-coded default.
IdentifiersA record id, a certificate_id, the SHA-256 hash, a proof id, and ready-made certificate, proof, and verification URLs returned in the capture response.

The widget: replace your form, or keep it

Consent capture ships as an embeddable widget, delivered as a custom element from the edge. It runs in two modes, and the second one is the reason most teams can adopt it in an afternoon.

Mode 1 — render the form

The widget draws the lead fields, the consent checkboxes, and the disclosure, handles the human checks, and submits the capture itself. Your logo and colours; a discreet “Powered by CapchaCloud.”

Mode 2 — wrap the form you already have

Point the widget at a CSS selector and it injects the consent controls into your existing form, blocks submission until the required boxes are ticked, records the capture, and then lets your own form submit exactly as before. You keep your markup, your styling, and your existing back end.

One tag, mounted where you want it:

<script src="https://capchacloud.com/install.js"
        async
        data-capcha-client-id="YOUR_PUBLISHABLE_KEY"
        data-capcha-mount="body"></script>

Or place the element yourself and pass your company and policy links:

<script src="https://capchacloud.com/widget.js" async data-capcha-widget></script>
<capcha-auth
  data-capcha-client-id="YOUR_PUBLISHABLE_KEY"
  data-capcha-company="Your Company"
  data-capcha-privacy-url="https://example.com/privacy"
  data-capcha-terms-url="https://example.com/terms"
  data-capcha-campaign-id="spring-2026"></capcha-auth>

The capture API is public and documented, but the JSON route requires a verified human-check token — deliberately, because a capture with no human check is not consent evidence, and we would rather refuse it than seal a record that quietly proves less than it appears to. Writes accept an Idempotency-Key header, so a network retry never produces two certificates. Webhooks push a capture event to your endpoint, signed with HMAC-SHA256 over "{timestamp}.{rawBody}", with delivery logs and replay. Full contract: API reference · agent-readable integration guide.

How a stranger verifies it

curl -O https://capchacloud.com/verify-evidence-bundle.mjs
curl -o bundle.json "https://capchacloud.com/api/v1/public/evidence-bundle/<certificate_id>"
node verify-evidence-bundle.mjs bundle.json

Live chain tip and anchoring status: /api/v1/transparency · Method in full: evidence methodology · Algorithms and parameters: cryptographic inventory.

Retention, storage, and the consumer's side

Five years, floored in code

Every consent record carries a five-year retention floor — meeting the FTC Telemarketing Sales Rule recordkeeping window and outlasting the TCPA's four-year statute of limitations. The purge job will not delete a record younger than that regardless of a tenant's configured retention setting, the floor cannot be shortened by the account owner, and a legal hold suspends purging entirely. Evidence is billing-independent: lapsed billing never deletes it.

Storage, stated precisely

Evidence objects are content-addressed and hash-verified, and encrypted at rest with AES-256. Where the underlying storage bucket has a retention lock configured, the storage layer prevents modification, overwrite, or deletion before the lock expires; application retention controls still apply to ordinary records and can be audited separately. We do not treat a hash chain alone as operator-proof write-once hardware, and we will not tell you otherwise.

Consumers can revoke, themselves

ConsentWallet lets a person request a single-use, short-lived access link by email, see every consent record tied to that address, and revoke one or all of them. Revocation writes a suppression entry immediately, so outreach stops right away rather than at the next batch job. The wallet never reveals whether an email exists.

Revocation is honoured, and recorded

A scheduled job reconciles revocations against stored records and marks each one honoured with a timestamp. A legal hold always wins over a revocation-driven purge — the record is retained under hold rather than quietly destroyed, and that is stated to the consumer rather than hidden from them.

Getting the evidence out

Evidence you cannot export is evidence you do not really have. Four export paths, all versioned.

ExportWhat you get
Tenant JSONA versioned envelope with your tenant profile and consent records, plus a certificate manifest on the current schema version.
Tenant ZIPThe same data as files, with a manifest.json listing a SHA-256 for every member — so the archive proves its own integrity offline.
Chain-of-custody bundlePer consent record: the consent record, risk signals, edge observation, DOM snapshot and its metadata, and the certificate — with an index, a per-file SHA-256 manifest, and an integrity file. Optionally HMAC-signed over the manifest.
Consumer exportThe person's own data as versioned JSON — their records and revocations — with a does_not_prove list travelling inside the export, and vendor identities reduced to a one-way hash.

Pricing

Priced in credits, not per seat and not per certificate tier. Credits come from your plan and pool across every CapchaCloud product — one subscription, one bill. Plan credits are spent first; prepaid pack credits never expire and are spent only after that. There is no metered overage and nothing is invoiced after the fact.

Consent certificate

6 credits
≈ $0.03 each — charged once, only when a certificate is actually committed

Included

$0
bot screening, five-year retention, hosted certificate, public verification, and the offline verifier — on every plan, including Free

Free plan

500 / mo
no card required; Pro includes 18,000 credits a month across every product — see plans

Pair it with CapchaID at 1 credit per auth session and every new account arrives with a consent certificate already attached. Full catalog and plan comparison: pricing · side by side with the incumbent: CapchaCloud vs TrustedForm.

What this does not prove

Every signed evidence bundle carries its own does_not_prove list — inside the record, not merely on a marketing page. Here is what a consent certificate does not establish:

Questions

What exactly costs six credits?

One committed consent certificate. The charge lands past every free validation, rate-limit, and daily-cap gate, immediately before the certificate is written — so a rejected capture, a failed human check, or a malformed request costs nothing. If your balance is short, the capture returns a 402 rather than silently issuing an unbilled record.

Do I have to use your form?

No. Point the widget at a CSS selector for the form you already have and it injects the consent controls, blocks submission until the required boxes are ticked, records the capture, and then lets your own form submit exactly as it did before. You keep your markup, your styling, and your existing back end — the widget just makes the consent moment provable.

What stops someone forging the origin data?

It is observed server-side at the edge, not reported by the browser. Any client-supplied risk block is deleted before evaluation, the widget-provenance stamp is overwritten server-side, and the consent timestamp is taken from server time at the edge rather than from anything the page sends. The browser's own reported user agent, language, time zone, and viewport are kept too — but stored alongside the server-observed equivalents, so a contradiction between them shows up in the record instead of being smoothed over.

Is a CAPTCHA pass really enough to say a human consented?

On its own, no — which is why there are two independent screens: the managed challenge and an invisible proof-of-work the browser solves before submit. Both are verified server-side, and only methods actually verified are recorded. A passive bot score is explicitly not treated as proof of humanity, and a signup that ran no interactive challenge seals “no methods passed” rather than a fabricated pass.

Is the disclosure wording hashed separately?

The verbatim disclosure HTML is sealed inside the payload, so it is covered by the payload's SHA-256 — change a word and the certificate's identifier changes. Separately, a policy snapshot binds an immutable content hash of the company, website, privacy URL, terms URL, and version labels in force at that moment. There is no third, standalone hash of the disclosure text on its own.

What happens when a consumer asks you to delete their data?

Outreach is suppressed immediately and the revocation is recorded. The underlying record is retained for the legally required minimum — five years under the FTC rule — and purged after that unless it is under legal hold. That is stated plainly to the consumer in the wallet rather than buried; see data retention and deletion.

Where does this run, and where is the evidence stored?

Capture executes at the network edge, close to the visitor, rather than in a single application region — which is also what makes the origin observation server-side rather than browser-reported. Where evidence objects live, and which storage regions are used by default, is documented on data residency; third-party roles are listed in the subprocessors policy.

How does this compare to TrustedForm?

Side by side, including where TrustedForm is the better pick: CapchaCloud vs TrustedForm.

Start certifying consent properly

500 credits a month on the free plan, no card. One tag on your page, or one POST from your server.

Create a free account View a sample Evidence Record Run a live demo Talk to us

Related

CapchaCloud vs TrustedForm · CapchaID · ConsentWallet · Pricing · Evidence methodology · Trust Center