LeadProof FAQ

LeadProof captures and cryptographically seals a record of a consumer's consent at the moment it's given — the exact consent language they saw, the disclosures it linked to, and behavioral/fraud signals — so you can prove, years later, that a specific person agreed to be contacted under specific terms. It's built for TCPA and similar consent-based regimes, and it does not rely on session-replay recording.

A certificate is one sealed consent record. It holds the consent markup and text, the page URL and timestamp, the archived disclosure documents the consent linked to, the trust/fraud signals, and an integrity hash that binds all of it together. Change any sealed field later and the hash no longer reproduces — that's what makes tampering detectable.

The integrity hash is a SHA-256 digest computed over the consent content plus the content hash of every linked disclosure — so tampering with even a referenced document is detectable from the certificate alone. That hash is then sent to an independent RFC-3161 timestamp authority (DigiCert), which returns a signed token binding the hash to a time asserted by a third party. LeadProof also cryptographically verifies that token.

You add a small capture <script> to your consent page (see Setup). When a consumer submits, it collects the consent element's HTML and text, the disclosure links, a bot-challenge result, and behavioral signals, and sends them to LeadProof, which seals the certificate server-side. It fails open — a capture hiccup never blocks your form.

Disclosures are the documents your consent links to (Terms of Use, Privacy Policy, SMS policy). LeadProof independently re-fetches and hashes each one — and then follows the links inside them, archiving a bounded chain (up to 3 fetched layers, same-site, with a citation-only outer layer). Consent often depends on documents that aren't on the consent page itself, so the whole chain is preserved, not just the top page.

A 0–100 score summarizing how human and legitimate the submission looked, from the bot challenge, time-to-fill, pointer movement, keyboard interaction, and IP fraud risk. It maps to a tier: Certified (85+), Verified (70+),Standard (55+), or Flagged. A failed bot challenge caps the score low regardless of the rest.

Free and public. Confirms a certificate's seal is genuine and untampered. The public tool at /verify requires both the certificate ID and its hash, so only someone with those details can look it up.

Confirms whether a given phone or email matches a certificate — by comparing hashed identifiers, so no personal data is revealed. It works before you claim, so a prospective buyer can confirm a match and see trust signals before paying. Charged only when there's data on file to compare.

Claiming locks a certificate to your account, sets how long the sealed evidence is retained (5 or 7 years), and unlocks the full record plus Confirm, Drift, and evidence exports. Claiming is what gates access to the underlying content.

Runs AI compliance checks against the sealed consent — a preset checklist (e.g. autodialer disclosure, clear-and-conspicuous consent) and/or a custom question. It reasons over the raw captured markup, so structural facts like checkbox ordering are preserved. Each check returns a Yes / No / Unclear verdict with an explanation.

Re-fetches the consent page and its archived disclosures and compares them to what was sealed at capture. Unchanged documents are confirmed by hash alone (no AI); changed ones — and the consent page always — get an AI materiality read that ignores cosmetic differences. Tells you if the disclosures a consumer relied on have since changed.

Evidence package is a court-ready sealed PDF bundling the certificate, disclosures, and your verification/compliance history, under a compound package hash. Attestation adds an Ed25519 digital signature and a first-person, dated re-verification statement. Attestations are human-reviewed before release, and refunded if not approved.

5 years covers the FTC TSR recordkeeping baseline; 7 years is the longer option for stricter internal or state requirements. You choose at claim time.

A certificate not claimed within 90 days of capture is archived out of your active list. Claim the ones you intend to rely on before the deadline shown on My Certificates.

A rule that automatically claims certificates captured on a given domain, at capture time, with the retention you set — so leads you generate are locked in without a manual step.

A saved compliance rule that fires automatically, once, the moment a matching certificate is claimed (individually, in bulk, or via Auto-Claim). It applies prospectively and never blocks a claim — if you're short on credits, that one analysis is simply skipped and the rule stays active.

Automatically buys more credits when your balance drops below a threshold you set (requires a card on file). Keeps automations running without manual top-ups.

Everything runs on prepaid credits. See LeadProof Pricing for rates and bundles, and the Credits & billing page for your balance and transaction journal.

In Setup, add and verify your domain (a DNS TXT record), then install the capture script with your widget token. The widget token is public and only mints certificates; your API key is secret and spends credits — never mix them.

Yes. Invite them from Team; they sign in with the invited email (no password required, though they can set one under Security). Each teammate's permissions are controlled per capability — Setup, Check, Claim, Confirm/Drift/Automations, Evidence, Billing, API access, and Support.

Open a ticket from the Support tab — our team replies right there, and you'll get an email when we do.