Skip to content
- Scan to share: on a laptop, the consent screen now offers a QR code. The consumer
scans it with their phone, approves there, and the form on the laptop fills — the one-scan
feel of paying by phone, with contact details instead of a card and no charge. Transport
only: the share code binds to the originating window’s PKCE challenge, redeems through the
unchanged
/v1/share/redeem, and carries the same fingerprint and ledger record. The phone
is shown the requesting device before approval as a relay defense. On by default for every
Share button; data-handoff="off" disables it. See SDK reference.
- Step-up on approve: when a consumer’s account holds a passkey, approving a scan-to-share
on the phone requires a fresh, user-verified assertion (Face ID / Touch ID / screen lock) —
server-enforced (
step_up_required otherwise), scoped to that one handoff, two-minute proof.
A one-time emailed code is the fallback when the passkey lives on another device. The audit
row records step_up: passkey | otp | none.
- Passkeys on app.pryvc.com and portal.pryvc.com (WebAuthn, discoverable credentials,
user verification required). Consumers are offered one right after their phone approves a
scan-to-share; portal users add one under Team. A passkey replaces password + emailed code on
the portal in a single step. Additive: existing sign-in methods remain. Only public keys are
stored.
@pryvc/sdk 1.2.0: handoff option ('auto' | 'off'). No other API change.- Handoffs carry a reserved
kind for a future wallet-based identity/age verification path
(Apple Wallet, Google Wallet). Not shipped; the SDK surface will not change for it.
- Contact form honeypot on pryvc.com: a hidden field bots fill; tripped submissions are
silently dropped with a fake success.
- Certificate withdrawal: the subject of a certificate — who has no account with anyone —
withdraws from its public verification page by proving control of the recorded email. Status
moves to
revoked, a 10-business-day cease deadline opens, and the issuing business is
emailed. Nothing is deleted: the record and every hash remain, with the withdrawal
timestamped. Emitted as certificate.revoked on the events feed and to webhooks,
carrying cert_id.
- Per-recipient consent: mark a checkbox per recipient with
data-sp1-entity and the
certificate binds entities_accepted and entities_rejected into the fingerprint. Omitting
the checkboxes leaves the fingerprint byte-identical to before this change, so existing
integrations are unaffected. An empty rejected list (“asked, declined nobody”) deliberately
hashes differently from omission (“never asked”).
@pryvc/sdk 1.1.0 on npm: per-recipient collection, and sandbox refusals now emit
error rather than surfacing as closed, which previously made a server refusal
indistinguishable from the visitor canceling.- Published hub API description: OpenAPI 3.1 at
sp1-hub.openapi.json, checked against the
running route table on every build so it cannot drift.
- Share Protocol v1: consent screen, single-use PKCE-bound codes (60s), one-time redemption.
- pryvc.js v1: declarative + programmatic embed, field-mapping heuristics, sandbox mode.
- Business API: shares, cursor-based events, per-share current values, webhooks with
Pryvc-Signature signing and replay.
- Consumer portal: dashboard, share management, broadcast updates, hash-chained audit with
CSV/JSON/DSAR export, account deletion.
- White Glove: automated removal notices, deadline tracking, affidavit packages.
- Billing: $299/yr business, $29/yr White Glove via Stripe.
