Event forms

Event forms are hosted capture pages for tradeshows and events. PRYVC renders the form, runs abuse protection, generates the consent disclosure, anchors every submission to the public ledger, and delivers the lead to you. There is nothing to embed and no SDK involved — you configure a form in the portal (Events) and receive submissions server-to-server. For a visual of each template and its consent language, see the template gallery in the user docs.

The delivery payload

Each submission POSTs once to the form’s webhook URL as pryvc.form_submission. Because PRYVC purges the submission data after delivery, this payload is your only copy — it carries every field plus the compliance evidence:

{
  "kind": "pryvc.form_submission",
  "registrant_id": "e9491215-cabd-421c-a887-0e5382c3a432",
  "form": {
    "uid": "XCMAfF-P1O8GuP7o",
    "template": "event_lead_capture",
    "name": "Booth lead capture",
    "event": "Fall Expo 2026"
  },
  "submitted_at": "2026-09-12T18:04:11Z",
  "fields": {
    "name": "Dana Whitfield",
    "email": "dana@example.com",
    "phone": "+15125550143"
  },
  "compliance": {
    "consent_text_hash": "sha256:ab12…",
    "consent_text_version": "lead/1.0",
    "recipients": ["Acme Insurance Group LLC"],
    "channels": ["call", "sms"],
    "submission_hash": "sha256:0069c478…",
    "ledger_url": "https://verify.pryvc.com/ledger/hash/77fe…"
  }
}

• consent_text_hash / consent_text_version — SHA-256 and version of the exact disclosure the consumer saw. Disclosure copy is versioned; it never changes under a version.
• submission_hash — SHA-256 over the canonical JSON of fields. The registrants grid in the portal shows the same hash, so you can match rows to your records after PRYVC has purged the data.
• ledger_url — the public, tamper-evident ledger entry for this consent. It contains no personal data.

Signing

Deliveries are signed exactly like webhook events: verify the Pryvc-Signature header (t=<unix>,v1=<hmac>, HMAC-SHA256 over "{t}.{raw_body}", 5-minute replay window) with the per-form secret shown once when the form is created or its webhook URL changes. One verifier serves both surfaces.

Retries and the encrypted backup

Failed deliveries retry with backoff — 1m, 5m, 30m, 2h. If all five attempts fail (or the form has no webhook URL), submissions queue for a daily backup email: an AES-256 encrypted zip with one JSON record per file, grouped by event and form. The zip password is random per digest and retrievable only in the portal (Events → Backups, views are access-logged) — the email itself carries only ciphertext. Note that Windows Explorer cannot open AES zips; use 7-Zip or WinRAR.

Either path counts as delivery: once you have your copy, PRYVC destroys the encrypted submission and keeps only metadata, hashes, and delivery history.

Lifecycle rules

• Forms are draft → live → paused/expired; live forms auto-expire when the event’s end date passes.
• Event details (name, venue, dates) lock once a form is live or a submission exists; PATCH returns 409 conflict after that.
• Events with recorded submissions cannot be deleted — registrant metadata is the durable consent trail.

Abuse protection

Public form pages are rate-limited per IP and per form, honeypotted, and require a minimum human fill time. Rejected submissions are never recorded.