Sign In Get Started
Identity & Release Records

Verified Identity.
Signed Release.
One API Call.

ProntoRelease combines KYC-verified identity with a sworn digital declaration and managed record custody — an identity and consent evidence layer for content platforms.

Request Access Read the Docs
KYC-verified identity
SHA-256 anchored PDF
7-year minimum retention
The Problem

KYC alone isn't
enough for content

Identity verification tells you who someone is. But for content platforms, you also need their authorisation — and proof you have it.

The § 2257 Gap

US federal law requires producers of sexually explicit content to keep age-verification records for every performer. KYC verifies the user but does not capture the sworn declaration, the authorisation, or the durable retention those records depend on.

No Authorisation Trail

A verified identity does not mean the user has authorised the platform to host their content. Without a signed release you have no contemporaneous record of what was authorised, by whom, and when — which is exactly the evidence you need when authorisation is later disputed.

Fragmented Compliance

Platforms cobble together KYC from one provider, release forms from another, and PDF storage from a third. The chain of custody is weak, records are scattered, and audits become painful. Our § 2257 guide for platforms maps what a complete record set requires.

How It Works

KYC + Release
in a single flow

One API call initiates the full journey. ProntoID handles every step — your user arrives at your platform with a signed, custodied record.

1
User selects their role
Your platform presents two paths: Verify as Model (self-posted content) or Verify as Photographer. The choice maps to release_type in the API call.
2
Your backend creates the session
Pass release_required: true, release_type, and optionally a community slug to create-kyc-verification. A single API call starts the whole flow.
3
User completes KYC
ProntoID guides the user through document capture, biometric liveness, and age verification on verify.prontoid.com. No raw document data touches your infrastructure.
4
Completion screen shows the release CTA
Instead of "Go to website", the user sees "Sign Release Form →". Identity data pre-fills the declaration — name, DOB, nationality — and is locked from editing.
5
User signs the declaration
The user reviews, adds stage names or a records address, types their legal name as a digital signature, and submits. A SHA-256-anchored PDF is generated instantly.
6
Records sealed and retained
The signed PDF, KYC session, and ID capture are linked by verification_token and retained by Brooks & Keitt Sàrl as designated records custodian. 28 C.F.R. § 75.4 sets a floor of seven years from creation or last amendment.
PHP · ProntoRelease 
// User selected "Verify as Model"
$result = $client->createVerification($userId, [
    'release_required' => true,
    'release_type'     => 'creator_model',
    'community'        => 'example-community',
]);

// After KYC → completion screen shows:
// "Identity Verified — One More Step"
// Button: "Sign Release Form →"

// User signs → record stored:
// prontoid-release-records
"release_token":   "ec5964ae-59bf…",
"document_hash":   "845276d5…",
"retain_until":    1997002300,  // 7 years
"status":          "signed"
Release Types

Two roles,
two declarations

Each release type generates a different document matched to the user's role in content production.

release_type: creator_model

Creator / Model Release

For users who are both the subject and the producer of their content — selfie-style posts, self-shot videos, solo creators. The declaration combines a performer sworn statement under 28 U.S.C. § 1746 with a producer identification clause.

  • Sworn statement of identity & age
  • Producer self-identification clause
  • Stage names / aliases field
  • Authorisation of content & distribution
  • § 2257 custodian clause (if enabled)
  • Limitation of liability & indemnification
Get Started
release_type: creator

Photographer / Videographer Release

For primary producers who photograph or film other performers. The declaration is producer-only and includes a structured records-keeping address and a model records warrant, in which the photographer warrants that they hold compliant releases for every performer in the content. ProntoID verifies the photographer only — performers appearing in the content are not verified by this flow. Use ProntoTag to verify them.

  • Primary producer identification
  • Structured records-keeping address
  • Mandatory model records warrant (§ 2257)
  • Grant of infrastructure rights & copyright
  • 48-hour record production obligation
  • Limitation of liability & indemnification
Get Started
Infrastructure

Built for
evidential strength

Every component of ProntoRelease is designed to produce a durable, tamper-evident record of who signed what, and when.

Digital Signature

The user types their full legal name as an electronic signature, backed by government-ID verification and biometric liveness. Timestamp, IP address, and user agent are captured server-side and sealed into the record.

SHA-256 Document Hash

The entire declaration content is deterministically hashed before the PDF is generated. The hash is embedded in both the PDF and the database record — any tampering is detectable.

AES-256 Encrypted Storage

Signed declaration PDFs are stored in S3 with AES-256 server-side encryption. Each record carries a verification_token cross-reference, so every declaration is traceable to the identity check behind it.

Retained by Brooks & Keitt Sàrl

Brooks & Keitt Sàrl retains the sealed record set at Place du Midi 30, 1950 Sion, Switzerland, and produces records through lawful channels only. Custodian designation arises only where a platform names it in a published 28 C.F.R. § 75.6 statement — and under § 75.2(h) that never relieves the producer of its own liability.

Duplicate Submission Guard

The submit Lambda checks the verification_token-index GSI before writing. One verification session can only produce one release record — returning the existing token gracefully on retry.

Seven-Year Retention Floor

28 C.F.R. § 75.4 requires each record to be kept for seven years from its creation or last amendment or addition. The retain_until Unix timestamp records that floor and is recalculated whenever a record is amended.

1 API Call
To trigger full KYC + release flow
7 Years
Minimum retention, reset on amendment
2 Release Types
Creator/Model and Photographer
SHA-256
Anchored document hash per declaration
Who It's For

Built for platforms
that carry the risk

Creator platforms

Subscription and creator-economy sites where the uploader is also the performer. The Creator/Model declaration binds identity, age and authorisation to a single verified session.

Content marketplaces

Sites accepting third-party produced content. The Photographer declaration captures primary-producer identification and a records-keeping address for the 28 C.F.R. § 75.2(b) route.

Regulated payment flows

Acquirers and card schemes increasingly require documented age and consent verification for every person depicted, plus an auditable takedown trail. ProntoRelease produces both.

FAQ

Common
questions

Everything you need to know about ProntoRelease. Can't find the answer? Contact us.

No, and we do not claim it is. ProntoRelease is an account-level identity, age and authorisation record. 28 C.F.R. § 75.2 requires records per depiction — a copy of each depiction, its URL, and indexing by title — which remain with the producer. Under § 75.2(h) engaging a third party never transfers that liability. Use ProntoRelease for the identity and authorisation layer, and ProntoTag where specific content or third-party performers are involved. Our guide to § 2257 for platforms walks through what a complete record set requires, element by element. Your counsel should review the implementation for your jurisdiction and content type.
The producer — always. 28 C.F.R. § 75.2(h) is explicit that contracting with a non-employee custodian does not relieve the producer of liability under the Part. Any vendor telling you otherwise is describing something the regulation does not permit. What a custodian arrangement does is centralise the records, make them retrievable, and give you a third-party-sealed record rather than a self-held one.
It produces a sworn declaration under 28 U.S.C. § 1746 covering identity, age and content authorisation, bound to a KYC-verified identity and cryptographically sealed. Whether that replaces a bespoke model release depends on your jurisdiction, your content, and the rights you need to acquire. The documents are supplied as templates for your counsel to approve — we make no representation as to their legal sufficiency.
Yes. Consent to publish is revocable, and a prior signature is not a defence to a valid removal request — including under the TAKE IT DOWN Act, whose 48-hour notice-and-removal obligations became enforceable on 19 May 2026. The sealed record evidences what was authorised at the time of signing; it does not freeze that authorisation permanently. Withdrawal handling is agreed during onboarding.
The release form is a step in the post-KYC flow when release_required is true. If the user closes the browser without signing, no release_token is created. Your platform should check for a completed release before granting upload access — query prontoid-release-records by verification_token.
Yes. A single KYC service (identified by kyc_service_id) can have multiple community records in prontoid-release-services — one per community slug. Each community gets its own branded declaration, post-signing redirect URL, and release service ID. New communities can be onboarded without any code changes.
Brooks & Keitt Sàrl is established at Place du Midi 30, 1950 Sion, Switzerland. The custodian designation and the exact wording of your 28 C.F.R. § 75.6 statement — including which entity is named and at which address records are made available for inspection — are settled during onboarding together with your counsel.
Not in the current version — the release_token and document_hash are returned in the API response on the completion screen and the signed declaration is stored in prontoid-release-records. Webhook delivery for release events is on the roadmap.
Related Services

Part of the ProntoID ecosystem

KYC Verification

The identity verification layer that powers ProntoRelease. Document capture, biometric liveness, and age verification in a single API call.

Learn More

ProntoTag

Third-party model release management. A photographer tags a performer in content and they digitally approve. Complements ProntoRelease for multi-party content.

Learn More

ProntoSigned

Identity-verified digital contracts for any document type — NDAs, service agreements, partnership deeds — with the same KYC anchor as ProntoRelease.

Learn More

§ 2257 for Platforms

What the regulation actually requires, where platforms most often fall short, and an honest account of which parts we can help with and which stay with you.

Learn More

Ready to close the
evidence gap?

ProntoRelease is available to platforms on the ProntoID enterprise plan. Contact us to discuss your use case and onboard your first community.

Request Access Read the Docs

Brooks & Keitt Sàrl  ·  Place du Midi 30, 1950 Sion, Switzerland  ·  Identity & Release Records
ProntoID and Brooks & Keitt Sàrl are not law firms and do not provide legal advice. Release documents are supplied as templates for review and approval by your own counsel, and no representation is made as to their legal sufficiency in any jurisdiction.