Why every consent receipt we issue can be verified by anyone

A Consent Manager sits between people and companies, and both sides need to trust what it records. A person needs to know their withdrawal was logged. A company needs to show an auditor that consent was given. Saying “trust us” is not good enough, so we built myconsentapp so that nobody has to.

The problem with ordinary records

Most consent records are rows in a database. Whoever controls the database can change a row, delete it or backdate it, and nobody outside would know. In a dispute, the record is only as trustworthy as the company that holds it.

What we do instead

Every consent event, whether a notice served, a grant, a change or a withdrawal, goes through three steps:

1. Canonicalise. The event is converted to a standard JSON form (RFC 8785), so the same event always produces exactly the same bytes.
2. Chain. We hash the event with SHA-256, together with the hash of the event before it. Changing any past event would change every hash after it, so tampering shows.
3. Sign. The result is signed with an ECDSA P-256 key held in a hardware security module. The private key never leaves it, not even for us.

You receive a signed receipt for each decision. It contains what you agreed to, when, and the signature that proves it.

Anyone can check it

Because the public key is published, anyone can check a receipt: you, the company, an auditor or a court. Verification runs in the browser or on your phone, even offline. It shows whether the signature is valid and where the event sits in the chain, without revealing anyone’s personal data.

That means:

• a person can prove they withdrew consent, and when;
• a company can prove consent was given for a specific purpose;
• an auditor can check records without access to our systems.

Privacy, not just integrity

Verifiable does not mean public. Receipts identify people through pseudonyms scoped to each company, and the chain contains hashes, not personal data. Phone numbers are encrypted and never appear in a receipt.

Try it

Every receipt in your dashboard has a Verify button, and the mobile app checks receipts on the device itself. You can read more about our approach on the trust page.