Skip to main content

Record keeping

How to Keep Testimonial Consent Records

A customer said yes to being quoted. Two years later someone asks where that yes is written down, and for which channels. Audit one published testimonial with the scorecard below, then set up a record your whole team keeps the same way.

  • Audit the paper trail behind one live quote
  • Seven fields every permission log needs
  • A fix for each gap the audit finds
Use the free toolStart my testimonial library (opens in a new tab)
Score: Consent record
  • You can open the customer’s actual yesYesPartlyNo
  • The date of consent is recordedYesPartlyNo
  • The allowed channels are written downYesPartlyNo
  • The agreed attribution is notedYesPartlyNo

7 checks. Each one you miss comes with a fix.

Free tool, no sign-upTry it below

The problem, solved

Where permission evidence goes missing, and how StoryProof keeps it attached

Each of these starts as a small shortcut and turns into an afternoon of digging through old inboxes.

  • The yes is buried in someone’s inbox

    Permission given in a reply to a sales rep leaves with that rep. When the question comes, nobody else can open the thread.

  • Quotes went live before anyone checked

    If a testimonial reaches the site first and the paperwork is chased later, the record starts with a gap that can never be closed.

  • Website only, but now it is in an ad

    The customer agreed to the homepage. A year later the same quote is pulled into a paid campaign because nothing said it could not be.

  • Everyone edits the log under one login

    With a shared password there is no telling who marked a quote as cleared, which weakens the record when it matters.

  • Old consent is too vague to rely on

    “Sure, use it” in a two-word email does not say where, for how long, or with which name.

Flip the switch to see how StoryProof handles each one.

What one consent record holds

Keep these fields for every testimonial, wherever your team stores them. The tool you use matters less than everyone filling in the same fields.

Placeholders in braces stand for your own data.
FieldExample entryWhy it is there
Customer and contact{customer name}, {email}So you can reach them to reconfirm or remove
EvidenceForm entry or saved email, with a linkThe yes itself, not a summary of it
Date given{date}Shows the consent came before publication
ChannelsWebsite and email, not adsStops a quote drifting into uses nobody agreed to
AttributionFirst name and companyKeeps the display matching what was approved
Logged by{teammate}Somebody answers for the record
StatusActive, reconfirm, withdrawnTells a publisher at a glance whether it can be used

In StoryProof

Keep the record inside your StoryProof routine

  • You will need
  • A StoryProof workspace with your testimonials in it
  • An agreed list of channel and status tags
  1. 1

    Agree the tag set once

    Decide on a short list such as “consent: website”, “consent: ads”, “reconfirm” and “withdrawn”. Tags are available on every plan, including Free.

  2. 2

    Log consent at the moment of approval

    Submissions wait in the queue until approved. The reviewer tags the consent status before approving, so no quote is cleared without one.

  3. 3

    Store the evidence where the team can reach it

    Keep the saved email or form export in a shared folder, named with the customer and date, and link to it from your consent log.

  4. 4

    Check tags before every new placement

    Whoever builds a widget picks its testimonials one by one. Make checking the channel tag part of that pick.

  5. 5

    Log withdrawals the same day

    Remove the quote from every widget, change its tag to “withdrawn”, and note the date and who did it.

What happens next: Run the audit scorecard on three random live quotes each quarter. If any score low, the routine is slipping somewhere.

Before you start

What this routine does not cover

  • Not legal advice

    How long to keep records and what consent must say vary by country and sector. A lawyer can tell you what applies to you.

  • Tags are labels, not signatures

    A tag says what your team believes. The evidence itself still has to be saved somewhere you can open it.

  • Old testimonials may have no record

    For quotes collected before you started logging, the only fix is asking the customer again.

  • Regulated fields add their own rules

    Healthcare, finance and legal services often require extra wording or a retention period. Check those separately.

  • Copies outside your site

    Removing a quote from your widgets does not remove screenshots in old decks or social posts. Keep a list of where it was used.

FAQ

Questions people ask

Short answers to what usually comes up next.

Is a reply email enough proof of consent?

It can be, if it shows the customer agreeing to a specific use. Save the whole email with its date rather than copying the line into a note, and file it where the team can open it.

How long should we keep consent records?

At least as long as the testimonial is in use, plus whatever period your sector or country requires afterwards. Some organisations set a fixed retention period in their policy; check what applies to you.

What if a customer withdraws consent?

Remove the quote from every place you used it, mark the record withdrawn with the date, and keep the record itself so you can show when and how you acted.

Do we need a new record if we shorten the quote?

Note the edit next to the original wording. If the trim changes what the customer meant, or puts it somewhere new, ask them to approve the new version.

Who should own the consent log?

One named person, usually whoever approves testimonials. Others can add entries, but one owner keeps the fields consistent and answers questions about them.

Still have a question? Ask the StoryProof team or book a demo.

Keep consent next to the quote

Approve testimonials in one queue and tag their permission status as you go.

Start my testimonial library (opens in a new tab)

Last updated 2026-11-05.