Trust mirror
Give every contact a signed, token-gated page that shows exactly what data you hold on them, with provenance, an audit excerpt, corrections, and one-click DSAR.
Trust mirror
Trust Mirror is Pact's consent-native flagship: every contact in every tenant
gets a signed URL at /me/<token> that shows them exactly what data Pact holds
on them — the same view the admin sees — with per-attribute provenance, a
time-travel scrubber, an audit excerpt, correction submission, and one-click
DSAR. The backend is core.trust_mirror; the contact-facing page lives at
web/src/app/me/[token]/.
Live
Real, enforced backend. Tokens are HMAC-signed and stored as sha256 hashes;
every public read is scoped to exactly one contact. The public routes live under
/me/{token} and the admin routes under /v1/trust-mirror, gated by the
consent module.
Two surfaces
Public, token-gated (no Authorization header — the token is the
authorization):
| Method & path | Purpose |
|---|---|
GET /me/{token}/profile | The contact's assembled view |
GET /me/{token}/audit | Audit excerpt relevant to them |
GET /me/{token}/timeline?as_of=<ISO ts> | Time-travel to a past state |
GET /me/{token}/corrections | Their pending corrections |
POST /me/{token}/correct | Submit a correction |
POST /me/{token}/dsar | Open a DSAR |
GET /me/{token}/dsar/{request_id}/receipt | Verifiable consent-receipt PDF |
POST /me/{token}/refresh | Refresh the token |
Admin (authenticated, tenant-scoped):
| Method & path | Purpose |
|---|---|
POST /v1/trust-mirror/issue | Mint a token and email it to a contact |
GET /v1/trust-mirror/contacts/{cid} | Mirror status + pending corrections |
GET /v1/trust-mirror/corrections | Pending-corrections inbox |
POST /v1/trust-mirror/corrections/{id}/approve | Approve a correction |
POST /v1/trust-mirror/corrections/{id}/reject | Reject a correction |
GET /v1/trust-mirror/overview | Tenant-level dashboard |
The public endpoints are rate-limited hard per IP — an anonymous, token-gated surface is a DoS target, and legitimate contacts hit each endpoint only a handful of times per visit.
What the mirror assembles
profile_view assembles one contact's view: profile fields + identity graph +
per-attribute provenance + recent sends + the consent matrix — all scoped to that
single contact. The audit excerpt (audit_excerpt) is the contact-relevant slice
of the tenant's audit chain: consent changes, sends to them, and profile-attribute
updates affecting them.
Corrections and DSAR
Corrections submitted from the public page are handled by corrections:
allow-listed fields auto-apply, everything else queues for admin review. Identity
fields — email, phone, external ID — are never auto-applied; they route
through DSAR-rectify. When a DSAR completes, receipt_pdf generates a verifiable
consent receipt.
Privacy guarantees enforced in code
- A token resolves to exactly one contact. Tampering, replay, and
cross-contact reads are caught at verify time and return 404
(
InvalidMirrorToken). - The mirror view never includes tenant-aggregate or other-contact data.
- Identity-field corrections never auto-apply.
- The token string lives only in the URL — never in an analytics event, referrer header, or log line.