A stored form is not a defensible record

Most sites collect consent with a general form plugin. It saves a submission, but it does not prove what the person agreed to, and it does not show whether the record has been edited since. Change the consent wording on your site a year later and the old submissions say nothing about what those people actually saw. Edit a row in the database and nothing flags it.

For a health or wellness practice, a clinic, a gym, or anyone who might one day have to show a consent was genuinely given, that gap is the whole problem. Consent Ledger is built to close it.

What makes it different

A general form plugin

Stores a submission
Loses what wording the person saw when you edit the form
No signal if a record is edited or deleted
No signature, IP or device on the record
Often sends data to a third-party service

Consent Ledger

Records a sealed, verifiable consent
Pins the exact wording shown, forever, per record
One click flags edits and gaps in the chain; each signer’s receipt proves theirs is still on file
Typed signature, IP, device and UTC time captured
Zero external calls — everything stays on your server

SHA-256every record hash-sealed and chained

0external calls — no third-party service

GPLfree core, your data in your database

How the seal works

Each consent is fingerprinted

When someone submits the form, the plugin takes a SHA-256 hash of the record — the intake answers, the exact consent wording they saw, the signature, the time, the IP and the device.

Records are chained

Each record's hash also folds in the hash of the record before it, like numbered, initialled pages in a ledger. The records form a chain, not a loose pile.

Changes show

Edit a record, or delete or reorder one in the middle, and one click shows where the chain fails. Cutting the newest records leaves a chain that still checks out, so each signer’s receipt carries the record’s full seal, and Check a receipt confirms it is still on file, unchanged.

See it working

The front-end intake and consent form as a patient sees it — The intake and consent form, as a patient sees it

The admin records ledger after one click on Verify: two records checked, the newest seal, a note on what the check cannot see, and a box to check a receipt's seal — The records ledger: the one-click check, what it cannot see, and the receipt check

Details that matter

The wording is pinned

The consent text a person saw is stored with their record and hashed. Change the wording on your site later and old records still show what those people actually agreed to — not today's version.

The context is captured

Date and time in UTC, the connecting IP address, the device (user agent), and a typed signature are recorded with each consent. Not a bare "submitted at".

Nothing leaves your server

No third-party service, no external API call, no account. Every record stays in your own WordPress database. That is a deliberate design choice, and a privacy one.

You write the wording

Your intake questions, your consent language. The plugin records what a person agreed to; it does not put words in your mouth. An example form is included and clearly marked to be replaced.

Export any time

The full ledger, every field and every hash, exports to CSV, so your records are never locked in.

It pairs with what you use

Consent Ledger does not do booking or payments. Drop it beside whatever tools you already run; it handles the one thing they leave out.

What it is not — plainly

It is not legal advice, and it does not supply consent wording. Only you know what your practice and jurisdiction require.
"Defensible" means the record is tamper-evident, not that it is automatically legally sufficient. That depends on your wording and your obligations.
It is not proof against whoever controls the database. Someone with full access could rebuild the whole chain so it checks out. Only a seal kept off the site shows that: a signer’s receipt, or the newest seal noted somewhere else.
It is not, by itself, a HIPAA compliance program. It keeps a better record and stores it only on your server; it does not replace a signed BAA with your host or your own policies.

Not out yet — get the launch note

Consent Ledger is in development and heading to the WordPress.org plugin directory. Leave your email and I'll tell you the day it's available. No newsletter: one email, the day it ships.

Prefer to talk first? Get in touch.