How to Verify a TrustedForm Certificate (and How It Compares to Jornaya LeadiD)

What a TrustedForm certificate is, and what it proves

TrustedForm is ActiveProspect's consent-documentation product. When a consumer visits a lead form running the TrustedForm script, it issues a certificate: a unique record of that visit stored on TrustedForm's servers and reached through a certificate URL. According to ActiveProspect's support documentation, each certificate includes:

• The URL of the page hosting the form, plus the parent page URL when the form sits inside an iframe.
• The date and time the form was loaded, and timestamps for the consumer's interactions.
• The consumer's public IP address, browser version and operating system.
• A full snapshot of the page as the consumer saw it, including HTML, images and CSS.
• An event log of clicks, keystrokes and scrolling, which powers a session replay. The replay is rebuilt from the page and the logged events, not a video recording.
• A unique alphanumeric certificate ID.

Why buyers verify certificates instead of trusting the vendor

Under the FCC's TCPA rules, the burden of proof sits with the seller, not the lead vendor. When the FCC adopted the prior express written consent requirement in 2012, it said that "should any question about the consent arise, the seller will bear the burden of demonstrating that a clear and conspicuous disclosure was provided and that unambiguous consent was obtained" (FCC 12-21, published in the Federal Register June 11, 2012).

A certificate is independent evidence of what happened on the form. It only protects you if you can retrieve it, it belongs to the same person you're calling, and the page shows consent language that covers your company. Private TCPA claims generally have a four-year limitations period under 28 U.S.C. 1658, as the Second Circuit held in Giovanniello v. ALM Media (2013), so the record has to outlast the claim window.

How do you verify a TrustedForm certificate? Step by step

These steps follow ActiveProspect's developer and support documentation. Most buyers automate them in their lead-intake platform (LeadConduit, Phonexa, a CRM webhook) so every lead is checked before it reaches a dialer.

• Check the format. The certificate URL must start with https://cert.trustedform.com/ and carry no extra paths or fragments.
• Check that it's valid. A GET request to https://cert.trustedform.com/{cert_id}/validate, authenticated with your API key, returns "success" for a valid ID and "failure" for an invalid one or a certificate more than 90 days old.
• Retain it with lead matching. Send a POST to the certificate URL (HTTP Basic Auth, username "API", your API key as the password, plus the api-version header) with the lead's phone and/or email. ActiveProspect says that when you retain a certificate you must also run match_lead, so the lead you received matches the data captured on the certificate. Retain requires a Self-Service plan or higher.
• Read the outcome. "Success" means the certificate was retained with no consent warnings. "Failure" means it was retained but generated warnings: no fingerprints matched, a required phrase was missing, or a forbidden phrase was found. "Error" means it wasn't retained (for example, expired or not found) and the request needs review.
• Scan the page for your consent language. Page scans check the snapshot for required text (your company name, the TCPA disclosure) and forbidden text. A missing required phrase returns "string not found in snapshot".
• Look at the snapshot or session replay yourself on a sample of leads, especially from a new source. Confirm the disclosure was visible, named you, and that the consumer checked or clicked the consent step rather than it being pre-filled.
• Store the certificate URL with the lead record. If you missed the original response, a GET to the same certificate URL returns the retain result again.

What each TrustedForm result means and what to do

How long do you have to retain a certificate?

The clock starts when the form is loaded. ActiveProspect's troubleshooting guide says a certificate must be retained within 72 hours by default, extended to 90 days if a form submission was detected. Once retained, it's stored for your account's retention setting, which defaults to five years. Its Insights data also reports an expires_at timestamp, so you can reject leads whose certificates can no longer be retained.

Five years by default is longer than the four-year federal limitations period for private TCPA claims, but check your own retention policy against any state laws and contracts that apply to you.

Which TrustedForm Insights help spot bad leads?

If your plan includes TrustedForm Insights, the certificate also returns data you can filter on before you call. ActiveProspect lists, among others:

• Age: seconds since the consumer's last interaction on the page, a stand-in for lead freshness.
• Bot detected: a flag for likely automated activity.
• Form input method: whether fields were typed, pasted, autofilled or pre-populated. A form filled only by pasting can be a fraud signal.
• Time on page, approximate location from the IP address, and whether the device was mobile.
• Confirmed owner: the verified owner of the domain or site where the lead was generated.

TrustedForm vs Jornaya LeadiD: how do they compare?

Jornaya, which was called LeadiD until 2016, does a similar job with a different model. Verisk announced an agreement to acquire Jornaya on December 15, 2020. A Jornaya script on the form issues a LeadiD token for each lead event. The buyer then calls Jornaya's TCPA Guardian in real time with that token to check whether the token is authentic, whether consent was given actively or was pre-filled, and whether the disclosure matches the one in the buyer's audit profile. It also stores visual proof of consent.

What a certificate can't prove

A certificate shows what happened on the form. It doesn't make weak consent language strong. If the disclosure didn't name your company, buried the consent in a long partner list, or made consent a condition of the service, a valid certificate just documents the problem. The FCC's one-to-one consent rule was vacated in January 2025, but autodialed or prerecorded telemarketing calls still require a signed written agreement with a clear and conspicuous disclosure (see our post on the one-to-one consent rule status).

For inbound pay-per-call, the certificate covers the web form that led to the call, not the phone conversation. Any callback, text or dialer follow-up from that record still needs consent you can prove.

Questions to ask a lead vendor about certificates

Before you sign, get written answers to these:

• Is a TrustedForm certificate or Jornaya LeadiD attached to every lead, and is it generated fresh for each submission rather than reused?
• Can we claim and retain the certificate ourselves, within the retention window?
• Are certificates masked? If so, what can we see?
• Does the consent language name our company, and can we review the live form?
• What happens to a lead whose certificate fails matching or page scans: is it credited or replaced?

How MGM ScaleCraft delivers certificates

A TrustedForm certificate or a Jornaya LeadiD token is attached to every lead we deliver, so you can verify consent with the source of record yourself. Certificates are pulled fresh at submission, not reused, and they come through in every delivery format we support: Ringba, Everflow, direct webhook, CSV and buyer portal. Consent scope is buyer-specific, not blanket.

Review your verification setup

If you're tightening lead intake before the TCPA revocation changes take effect on November 25, 2026, book a partner briefing and we'll walk through how our certificates and consent flow fit your checks. For the consent rules themselves, see our post on the one-to-one consent rule. For what calls cost by vertical, see Cost Per Call in 2026.

FAQs