Consent that stands up to an audit.
A sector-neutral privacy and consent platform for Data Fiduciaries. Consents, withdrawals, rights requests and staff actions are all recorded in a hash-linked ledger — so when a regulator asks, you can show the evidence rather than describe the process.
What it covers
Purpose-level consent, statutory rights handling and a record you can verify — each piece mapped to the provision it answers.
Purpose-level consent
Consent is captured per purpose and sub-purpose. Someone can switch one use off and keep the rest; turning off a parent purpose cascades to everything beneath it, and purposes the law treats as essential stay protected server-side.
Tamper-evident audit
Every event carries a SHA-256 hash of the one before it. Verification re-walks the chain, recomputes each link, and points to the first place it breaks.
Rights & grievances
Access, correction, erasure, nomination and complaint requests each run on a 30-day clock, with overdue flags and a recorded outcome for every one.
Breach & incident register
Classify severity and drive the two-part regulator notification — first alert, then root-cause report — while tracking the separate notice owed to the people affected.
Token vault & erasure
Sensitive fields are tokenized while keeping their format. Erasing a person destroys their key, so copies already sitting in downstream systems can no longer be read.
Children's data safeguards
Flag a minor, link a verified guardian, and keep the verification on record. Profiling and targeted advertising are refused at the gateway before any service sees the request.
Inside the console
The administrative surface, role-governed and available in light and dark themes.
Section 5
Notices
Every instrument carries its own version history, per language. Publishing creates a new version and keeps the old ones.
Select
Instrument and language
Instrument
Language
A tick marks a language this instrument has already been published in (7 of 23).
Currently in force · Version 3
Privacy Notice
We collect and process your personal data for account management and fraud detection, and — with your consent — for marketing and analytics.
- Personal data collected: name, contact details, account identifiers, transaction history.
- Retention: while your account is active, and after that as the law requires.
- Third-party disclosure: only to processors under contract, listed in our register.
- Withdrawal: you may withdraw consent for any non-essential purpose at any time.
Completeness
8 of 8 elements
- Purpose
- Personal data collected
- Retention period
- Withdrawal mechanism
- Consequence of refusal
- Third-party disclosure
- Grievance officer contact
- Rights available
A keyword check, not a legal review — it flags likely omissions so nothing obvious is missed.
Notice management
Notices that are versioned, not overwritten
Every publish adds a version — nothing gets overwritten.
- Versioned per instrument, per language
- Checks completeness before it goes live
Discovery & classification
See where personal data actually lives
Scan a source, see what it holds.
- Findings by sensitivity and data type
- Flags data with no recorded purpose
Discovery & classification
Where personal data lives
Register a source, scan it, then confirm or dismiss what the classifier found.
Registered sources
0
Findings
0
Not linked to RoPA
0
personal data with no recorded purpose
Marked redundant
0
candidates for deletion
Findings
By sensitivity
Findings
By data type
The self-service portal
A separate authenticated space where individuals see and control their own consent, in plain language, on an isolated login path.
Consent view
Every purpose shown in ordinary language with its live status — no internal codes.
Partial withdrawal
Turn off any single non-essential purpose or sub-purpose, whenever they want.
Personal RoPA extract
A copy of what is held about them, why, who else receives it and for how long — limited to their own record.
Requests & history
Open access, correction, erasure or grievance requests and watch them move.
Separate sign-in
OTP login for individuals on its own path, kept apart from staff access in both the code and the policy.
Provision coverage
Where each obligation under the Act and Rules is answered in the platform.
| Provision | Requirement | Where it is answered |
|---|---|---|
| Section 5 | Notice to the data principal | Versioned, multi-format notices in 22 languages, with delivery tracked. |
| Section 6 | Granular, withdrawable consent | Purpose and sub-purpose consent store with self-service withdrawal. |
| Sections 7–8 | Processor obligations flow-down | Contract register; ending a contract opens a tracked deletion task. |
| Section 8(6) | Breach notification | Two-stage notice to the Board plus a separate notice to individuals, each timestamped. |
| Section 9 | Children's personal data | Guardian linkage and verification; profiling blocked at the API gateway. |
| Sections 11–14 | Data principal rights | Access, correction, erasure, nomination and grievance, all SLA-tracked. |
| Section 10, 19(4) | Records of processing | RoPA register with maker and checker separated server-side. |
| Rule 6 | Tamper-evident audit trail | Per-event SHA-256 hash chain that can be verified on demand. |
| Localisation | In-country data residency | Runs on-premises or in a private cloud; no public-cloud requirement. |
Under the hood
Deployable on your own infrastructure, with the compliance-critical rules enforced by the API rather than left to convention.
Architecture & deployment
- Deployment models
- On-premises, private cloud or hybrid — built for places where data has to stay in-country.
- Orchestration
- Runs on Kubernetes / OpenShift-class platforms; every stateless service scales out horizontally.
- Database
- Any ANSI-SQL enterprise RDBMS (PostgreSQL, Oracle or SQL Server-class), partitioned by data principal via hashing.
- Event backbone
- A Kafka-compatible log carries consent, revocation and audit events, partitioned so each person’s events stay in order.
- Resilience
- Primary and DR sites, active-passive to start with a path to active-active, and no single point of failure.
- Ingestion channels
- Adapters for web, mobile, branch and paper, chat, core-system terminals, IVR, SMS/USSD, email, kiosk and third-party Consent Managers.
Security
- Encryption
- AES-256 at rest, TLS 1.3 in transit, with post-quantum algorithms under evaluation for a phased rollout.
- Key management
- Envelope encryption — the key manager wraps short-lived data keys rather than touching fields directly, so throughput is not capped by it. Works with FIPS 140-3 Level 3 HSMs over PKCS#11 or KMIP.
- Tokenization
- Surrogates keep the length and shape of the original value, so format checks downstream keep working untouched.
- Access control
- Role- and attribute-based access, with maker/checker on anything that affects compliance, enforced by the API.
- Audit
- A hash-linked event log; sensitive actions such as revealing a token are each recorded on their own.
Interfaces & export
- Administrative console
- Runs in the browser, governed by role, with light and dark themes and visual compliance reporting.
- Data principal portal
- A separate signed-in space that presents consent in plain language.
- API
- REST, with an OpenAPI spec served by the running system.
- Export formats
- CSV, JSON and XML for RoPA, contracts, consent, rights, breaches, discovery findings, assessments and the audit chain. Every export is itself logged, and identifiers leave as hashes.