Consent capture as a service
Under the DPDP Act every platform in India needs demonstrable consent. Most will build a checkbox in their own database, which proves nothing the moment it is disputed.
No subscription. You are charged per check, and only after the subject has consented.
Who this is for
Product and engineering teams in India who need to collect consent for processing personal data and be able to evidence it later.
The problem
A consent flag in your own database is a row you control and could have written at any time. If a user disputes ever agreeing, you have nothing independent to point at. Building a defensible consent record properly is several weeks of work that has nothing to do with your actual product.
How it works
- 1Your server creates a consent request through the API and receives a link.
- 2Your user opens it, sees the purpose you stated verbatim, and agrees or declines.
- 3You receive a webhook, signed so you can verify it genuinely came from us.
- 4You get a reference that anyone can check at a public URL, without an account and without asking you.
What is included
- REST API with bearer key authentication and a full test mode
- Email one-time code confirmation, so the record proves control of an address
- Signed webhooks on consent given and withdrawn, with retries
- A public verification endpoint returning a real 404 for a forged reference
- Certificates carrying a QR code and a permanent reference
What is not included
Said plainly, because a background check that quietly omits something is worse than one that names its limits.
- Aadhaar-based eSign, which is planned but not built. Nothing in the product claims otherwise.
- Consent for purposes we cannot describe accurately to the subject.
Common questions
Do I have to use VerifyBG for background checks to use this?
No. The consent API is usable on its own, for any processing you need consent for. It never returns verification findings, because consent and results are separate products and an integrator authorised for one is not thereby authorised for the other.
How does a third party verify a consent?
They open verifybg.in/verify/ followed by the reference, or call the same path under /api/verify/. It is public and unauthenticated, because a consent certificate only its issuer can verify does not solve the problem it exists to solve. A reference that was never issued returns a real 404, so an automated check cannot be fooled by a fabricated certificate.
Can I test without emailing real people or being charged?
Yes. Test keys never send email, never bill, and create records marked as tests on every surface including the public verification page. There is an endpoint to simulate a signature so you can close the loop in CI.
What does verification reveal?
That the consent is genuine, who signed it, when, its exact scope and how it was authenticated. Never the findings of any check.
Run your first check
Raise a request in under a minute. The subject consents on their own phone, and nothing is looked up until they do.
Related
Available across India
The consent framework and DPDP obligations apply nationwide, and the sources we check are national rather than state-specific.