What are TrustedForm and Jornaya, and why are they on the form I filled out?

If you’ve ever read a privacy policy closely or looked at a quote form’s page source, you may have hit two names: TrustedForm and Jornaya LeadiD. Both are nearly universal in lead generation. Neither has ever introduced itself to you.

Their job is to prove you said yes.

What They Watch

The moment you land on a page carrying one of these scripts, the session is under observation. The certificate they produce typically captures:

The page URL and when you arrived. How you interacted—keystroke timing, mouse movement, which fields you focused and in what order, how long you took, whether you scrolled past the disclosure. A record of the page as rendered, including the exact consent language shown to you.

And in TrustedForm’s case, a session replay a reviewer can sit down and watch. Worth being precise about what that is, because “video” overstates it. Per ActiveProspect’s own support documentation, the replay is built from a snapshot of the page’s DOM plus timestamped event data—mouse movement, clicks, keystrokes, page changes—reconstructed moment by moment. Not a camera pointed at your screen. A faithful rebuild of it.

That certificate attaches to your lead and travels with it to whoever buys you, and ActiveProspect retains it for five years by default.

Who The Evidence Is For

Sit with this one.

The TCPA carries statutory damages of up to $500 per call, trebled to $1,500 for willful violations, with no cap on the total. Call a thousand people who didn’t consent and the arithmetic gets existential fast—which is why there’s a well-developed plaintiff’s bar that knows exactly how to find you. A consent certificate is the buyer’s insurance policy. When somebody sues over unwanted calls, the buyer produces the certificate and says: here is proof this person agreed, on this page, at this second, with this language on screen.

It’s genuinely good evidence. I’m not knocking the technology—it’s careful, it’s rigorous, and it does what it claims.

It’s also entirely one-directional.

You never receive a copy. You’re never told a certificate was created. You can’t retrieve it later to see what it says about you. The single most detailed record of a decision you made is held exclusively by the people who bought the result.

One Owner, Both Certificates

For years these were competitors. They aren’t anymore.

TrustedForm has always been a product of ActiveProspect. Jornaya took a longer road: founded as LeadiD, acquired by Verisk in 2020, then folded together with Infutor into a division called Verisk Marketing Solutions.

On December 31, 2025, Verisk sold that entire business to ActiveProspect for $80 million, announced the following January and since rebranded InfutorData.

Read that again. The two dominant consent-certification services in American lead generation now answer to the same company.

I’m not alleging anything improper—this is an ordinary acquisition between willing parties, and ActiveProspect built a genuinely good product. But it’s worth saying plainly what the structure now is: the evidentiary record for whether millions of people consented to being called is produced, stored, and adjudicated by a single private vendor, whose customers are the companies being defended.

That’s a lot of trust to place in one party’s database. Especially one you can’t query.

The Gap

Here’s what these services prove: that you interacted with a page containing certain language, at a certain moment.

Here’s what they don’t do: watch what happens to that language afterward.

A company can show you one disclosure the day you sign up and quietly rewrite its privacy policy a month later. The certificate still shows your session under the old text. Nothing is monitoring whether the terms you actually live under have changed. Nothing notifies you when they do.

The evidence is frozen. The obligations aren’t. And only one party is positioned to notice the difference.

The Same Rigor, Pointed The Other Way

That asymmetry is the entire reason PRYVC exists.

Same evidentiary seriousness—canonical fingerprints, a hash-chained audit log, device and network details captured at submission, and a public ledger anyone can verify rather than a database you’re asked to trust. The difference is who gets the receipt: both sides. The policies get re-checked daily. And the consumer holds a revoke button with a formal cease notice and a tracked deadline behind it.

One honest trade-off, because I’d rather say it than have you find it: PRYVC doesn’t do session replay video. TrustedForm does, and some buyers specifically want it. What PRYVC captures instead is the disclosure text and the site’s full privacy policy and terms as they read that day—a different artifact, stronger in a lot of disputes, and unlike a replay, one you actually hold.