Every record answers one question. Who said yes?
DataSpine is a consent-provenance data platform. Every fact in it resolves to a consent event: the surface where a person agreed, the exact disclosure they saw, the scope they granted, the moment it happened, and how long it stays fresh. No consent event, no record. The database enforces that, not the application. This page is not a slide deck; every button below runs real SQL against the real schema and shows you what the database actually said.
One anchor for everything: the consent event.
Six fields, captured at the moment a person says yes. Attributes hang off events. Views serve only what consent still covers. Withdrawal tombstones every copy in one write. Read the same spine three ways and you get three products; read it from the person's side and you get a receipt.
Anatomy of a consent event
The wall is the database.
Application code has bugs. Constraints do not care. Each probe below attempts a real write. The rejections you see are PostgreSQL's own error text, verbatim.
Withdrawal is one write. Every copy obeys.
Ava consented on Northwind's checkout. Beacon Media, another co-op member, can resolve her record cross-context: value visible, source surface masked to a descriptor. Watch what one withdrawal does.
What Beacon Media Group sees of Ava
Raw storage (the co-op's own eyes)
Tombstoned rows are kept, never served: the audit trail survives the withdrawal, the data stops moving. New writes against a withdrawn event are refused by Rule 1.
Some things the schema refuses to hold.
Health data has no vocabulary
HIPAA and GINA data ride a separate regulated track. The controlled vocabularies simply have no health member, and a tripwire trigger rejects any future scope that mentions it. Live enum contents, straight from the catalog:
Compensation cannot coerce
A grant recorded as a condition of receiving service is not free consent. The column constraint requires the flag to be affirmatively false.
Built. Inert. Off until the law says otherwise.
Individual data licensing is fully built and hard-locked. There is no config toggle. The gate opens per jurisdiction only when counsel records a legal authorization with a statute cite, and the statute must be in force today: on the books is not enough. Run the whole lifecycle:
Same rows. Three businesses.
Quality pays. Volume without quality costs.
Brokered data pays per record regardless of accuracy; that economics is why bad data exists. The co-op inverts it: upheld corrections cost 50 against an 18-point credit, and a withdrawal spike claws contributions back.
Who brokers data, and who is registered nowhere.
The rails exist. The train does not run.
Grants can be drafted, reviewed, revoked. Nothing activates and no dollar accrues while the gate is closed for the grant's jurisdiction. That is Rule 4, demonstrated above, and it is the same rows the receipt below reads.
The locker keeps a receipt.
The consent locker is the person-side read of the spine, demoed as an Apple Wallet pass. The card is a receipt: control actions happen in the locker app, the card reflects state. Author, activate, or withdraw the grant in the gate demo above and regenerate; the card follows the database.
The QR on the installed pass carries the provenance token: event id, masked surface descriptor, capture date, currency window. Anyone the person shows it to can verify the claim against the spine without seeing the raw surface.