confirmtus

Confirmtus is a hypothetical protocol and accompanying reference implementation designed to standardize the collection, representation, and verification of user confirmations in digital services. It is described in privacy engineering discussions as a model for interoperable consent records and authorization proofs across organizational boundaries.

Concepts: At its core, a Confirmation object encodes the action being confirmed, the subject (user or device), the scope (data types, purposes), a timestamp, a validity period, and an attested signature. Confirmtus emphasizes verifiable proofs, allowing external auditors or services to confirm that a consent occurred without exposing unnecessary personal data.

Architecture: The envisioned stack includes a client library to generate confirmations, a server API to persist and query records, and an optional signer service to issue cryptographic receipts. The data model supports reconciliation and revocation, and can employ privacy-preserving techniques such as pseudonymous identifiers and selective disclosure.

Workflow: A service issues a confirmation request; a user approves via a trusted interface; a signed Confirmation is created, stored, and optionally shared with relying services. Verifiers check the signature, timestamp, and expiry to validate the record.

Applications and limitations: Potential use cases include data-sharing consents, policy acceptances, and opt-ins for communications. Critics note that adding an extra layer of logging could raise privacy concerns and implementation complexity; practical deployment depends on governance and cryptographic trust anchors.

Status: Confirmtus remains a conceptual framework referenced in theoretical discussions and standardization efforts, with no official universal adoption.

See also: consent management, data protection, verifiable credentials, digital signatures.