Specification

The record, in detail.

What CX3 captures, how it seals, what the seal proves and what it does not. Written for the person who has to sign off the vendor.

Download a sample minute (PDF)

This is a real sealed record from our demo firm. Its chain position and SHA-256 hash are printed at the foot. The people and firm are fictional.

Attendance note - SRA Code of Conduct, MLR 2017

Who was met: Priya Nair, Harlow Freight Ltd
Who met them: James Okafor, Partner, Corporate
Where: Fenwick & Holt, London
When: 3 September 2026, 15:20 BST
Who approached whom: Harlow Freight Ltd approached Fenwick & Holt
Identified by: Card tap

What was discussed

Freight and logistics dispute - contested demurrage claim, counterparty in Rotterdam. She approached us. Sending the charterparty and the correspondence over. Scoping an early view. No advice given.

Consent wording shown

By submitting, you agree that your name, phone and email will be shared directly with the person whose card you tapped, for the purpose of following up with you. We also record an approximate location (city and country, derived from your IP address) at the time of submission. Your details are not shared with anyone else, and are automatically deleted after 24 months. You can request deletion sooner at cx3.uk/privacy/delete-my-data.

Chain position: 1,284
Previous hash: e41fbbb510…bbb0af6384
This record: 5a08f0c7b2…9f7571ea66
Sealed: 10 September 2026

Sealed - verifies

01Capture

From tap to contact.

Trigger	NFC tap, or QR code where a phone won’t tap.
Visitor software	None; the profile opens in the browser.
Leavers	Card reassigned from the dashboard with immediate effect.
Finishes	PVC; brushed stainless steel; black brushed stainless steel.

02Cards and passes

From the box to the pocket.

Wallet pass	Apple Wallet and Google Wallet. The QR code encodes the profile URL. The pass updates when the profile changes.
vCard	On every profile, and in every card email.
Claiming	On the first tap: to the work email on file, or any address at one of the firm’s verified domains. A link by email, then one confirmation.
Card lifecycle	Requested, ordered, shipped, unclaimed, active. A leaver’s card returns to unclaimed and locked.
Registrations	FCA, SRA, Companies House, ICO, VAT, ISO 27001, Cyber Essentials and professional memberships. Each is verified by CX3 before it is shown, and links to its register where there is a public one.

03Consent

The sentence, not a flag.

Stored	The exact wording shown to the visitor, verbatim, with their contact.
Delivered	Included in every CRM delivery.

04Write-up

By reply.

Method	Reply to an email.
Contents	What was discussed; who approached whom; where.
Reminder	Day 6 if no write-up.
Digest	Every Friday, for conversations with no card tap.

05Seal

Hashed and chained.

Timing	7 days after the conversation.
Hash	SHA-256.
Chaining	Each record’s hash incorporates the hash of the record before it.
Sealed fields	21, including the consent wording shown and whether the visitor identified themselves by tap.
Identification	Recorded either as the visitor identifying themselves by tap, or as asserted by the colleague.
Model	Append-only. Each record prints as a standalone minute carrying its chain position and hash.

06What the seal proves

Detection, not prevention.

Proves	That a record has not changed since it sealed, and its position in the sequence.
Does not prove	That the write-up is accurate; it is the colleague’s account.
Does not prevent	Alteration by someone with direct database access; it makes that alteration detectable, because the record and every later record stop verifying.[1]

07Retention and erasure

Your schedule, enforced.

Retention	Set per firm, separately for contacts and meeting records.
Enforcement	Nightly.
Erasure	Reaches every copy, including meeting records.
Chain integrity	One person’s erasure does not break verification for other records.

08Delivery

Signed, with retries.

Method	Signed outbound webhook.
Systems	HubSpot, Salesforce, Microsoft Dynamics, Clio, through Zapier or Make.[5]
Events	The contact as soon as it is captured; the write-up when your colleague replies, marked as unsealed; the sealed record on day seven.
Payload	Contact, write-up, consent wording, seal hash.
Failure	Durable retry queue.

09Administration

Who can see what.

Dashboard	People, cards, leads, meetings, conflicts, audit log, settings.
Two-factor	Required for every admin, after a 14-day grace period from their first sign-in. Always required for CX3 staff.
Audit log	Every change to a profile, setting or card, and every admin action: who, what and when. Kept separately from the chain.
Corrections and voids	A correction is an addendum linked to the sealed record and sealed in turn. A record can be voided with a reason before it seals, never after.
Export fields	Every sealed field, the chain position, the previous hash and the record’s own: enough to recompute each hash.
Conflicts search	By name, email or company domain, across all captured contacts.
Profiles	FCA (SYSC 10A.1.16R, retained under SYSC 10A.1.14R); legal (SRA Code of Conduct, MLR 2017); general (no citation, by design).

13Conversations (30d)

92%With a note12 of 13

85%Who started it recorded11 of 13

85%Sealed11 of 13

Export evidence

When	Who they met	Who here	Record
19 Sep	Priya NairHarlow Freight LtdTapped a card	James Okafor	OpenSealed #1,2851 missing
17 Sep	Tom AshworthHarlow Freight LtdLogged by rep - not verified	Ruth Castellan	Sealed #12
13 Sep	Nadia HaddadHaddad RetailTapped a card	Ama Boateng	Sealed #11
04 Sep	Grace KimKim AdvisoryTapped a card	Priya Osei	Sealed #9
31 Aug	Oliver MarshMarsh PartnersTapped a card	James Okafor	Sealed #7

10What we don’t claim

We make the record. You make the judgement.

CX3 does not make a firm compliant, and no software can. We build records designed to hold up as evidence: dated, attributed, sealed and chained. Whether those records satisfy your firm’s obligations is your firm’s judgement, not our claim. CX3 Digital Ltd is registered with the ICO. It is not regulated by the FCA or the SRA.

11Demo

See it on your own cards.

Half an hour. Bring your head of BD and your compliance lead to the same call if you can. It is the same product for both.