Global Regulation Compliance
GDPR, KVKK, CCPA and more — apply the consent policy you configure for each region, selected by visitor location via GeoIP.
Automatic GeoIP Detection
The visitor's country is estimated from the IP address and the consent policy you configured for that region is shown. GeoIP is an estimate; you remain responsible for the policy settings.
Tenant database region: TR or EU (US planned)
Choose the region where your tenant database is hosted. Queues, logs and platform metadata are processed on the platform. Enterprise plans can use their own PostgreSQL (BYOD).
GDPR
European Union
- Cookie consent before tracking
- Right to withdraw consent
- Data processing records
- Cross-border transfers
KVKK
Turkey
- Explicit consent requirement
- Data controller obligations
- Turkish language mandate
- Local storage requirements
CCPA
California, USA
- Do Not Sell My Data
- Consumer privacy rights
- Opt-out mechanisms
- Disclosure requirements
ePrivacy
European Union
- Cookie directive compliance
- Electronic communications
- Marketing consent
- Metadata protection
UK GDPR
United Kingdom
- Post-Brexit data protection
- DUAA 2025 analytics exemptions
- ICO regulatory framework
- Adequate country transfers
LGPD
Brazil
- GDPR-similar opt-in model
- Data subject rights
- Legal basis requirements
- ANPD enforcement
How Cryptographic Proof Works
Every consent goes through a 4-step pipeline that produces integrity and time evidence you can verify independently.
1. Consent Capture
The choice is recorded with its context: timestamp, user agent, IP address (masked by default; configurable) and the visitor ID your site supplies. A device-fingerprint hash is stored only if you enable it.
2. SHA-256 Hashing
The consent data is serialized as canonical JSON (sorted keys) and hashed with SHA-256, producing a digest that changes if the record changes.
3. Timestamp Authority
Where timestamping is enabled, the digest is sent to an RFC 3161 Timestamp Authority. The legal weight of the timestamp depends on the authority selected and on the jurisdiction.
4. Storage & Export
The record is stored with its digest and timestamp token. Any later change is detectable, and exported evidence bundles can be verified independently, even offline.
Supported Timestamp Authorities
HashEntry can request RFC 3161 timestamps from the providers below. Whether a timestamp counts as qualified or accredited depends on the provider and on your jurisdiction; free public providers are intended for testing.
Compliance Support Checklist
Capabilities that support your compliance work under major privacy regulations. Compliance itself depends on how you configure and use them.
Strengthen Your Compliance Evidence Today
Start with the free plan. No credit card required.