How it works
The record, step by step
It is built from what was stored, not written afterward
Each line comes from something recorded at the moment it happened — the sentence the writer checked, the date, the reading, the reward — so there is nothing to compose and nothing to exaggerate.
It says who gave the permission
A testimonial written on your form carries the writer's own agreement. One you imported or added through the API carries your statement that you hold their permission — a weaker record, and it is printed as a weaker record.
A video added later carries its own permission
When the writer recorded a video version at your request, the record says when it was added and prints the sentence they agreed to for the video, word for word and with its date, beside the one they agreed to for their words.
Your own release, under the permission
Where your form carried a release of yours, the record prints it under the permission as "The business's own release, which they also agreed to": its words as the writer checked them, the date and the version, with a line saying you wrote it and that it changes nothing about where the words may appear.
What it shows about who sent it, and no more
Each record says which of four things is true, from what was stored when it arrived: you imported it; it was sent on your form and nothing about the sender was checked; it was sent from a personal request link Hazelsong emailed to an address you gave, which your dashboard holds too, so it does not show who used it; or the same, for a request an order from your store or server made. Identity is always "Not checked": Hazelsong does not check who wrote a testimonial, never confirms a writer's address apart from that link, and never sees a payment.
A fingerprint of what was agreed
When a testimonial arrives, Hazelsong takes a SHA-256 of the exact version agreed: the words as sent, the permission sentence, the places it named, whether a reward was disclosed and its description, and your release's version. The record prints it and says how to compute it again, so a change to any of those would show. While a part of the words is removed it is not printed, because it covers the removed words too.
Whether a second person reviewed it
When a business publishes only after two people approve, the record of a testimonial a second person signed says so: "Reviewed by a second person before publication." It names nobody; who reviewed it is the team's own record.
It is on our address, not yours
A record a business can host is a record a business can dress up. The page is plain, unbranded, and the same for every customer.
It travels with the words
The link is on the wall, in the API and in what an assistant reads, so whoever republishes your testimonial can carry the proof with it.
Safe by design
The rule that makes it safe to have
Clear boundaries
What it will not do
Every capability page ends with this list. It is the part that says what you are actually buying.
- It is not a score, a rating of you, or a mark we sell. Nothing on that page can be bought.
- It is not proof that what the person wrote is true — only of how their words were collected, kept and published.
- Hazelsong does not verify that what a testimonial says is true, who wrote it, or that they bought anything, beyond what its record shows: how it arrived (the business's collection page, an import, the API or a feed), its permission and when it was given, whether a reward was attached, and whether a second person approved it. Publishing through it is not an endorsement of any testimonial.
- It will not show what the risk reading found, or anybody's email address.
- It will not name who approved or reviewed a testimonial, and it says nothing about a second person unless one signed what is published now.
- It will not exist for a testimonial that is unpublished or whose writer kept it off websites: that address answers exactly as one that was never written.
- It does not vouch for your release. It prints what the writer agreed to; whether those words do what you need them to is not something the record claims.
- It will not show a level stronger than the record holds: no "verified", no "confirmed email", no "verified purchase" and no identity check, because none of those happens here.
- A testimonial that arrived before October 18, 2026 has no fingerprint, and its record shows the lowest level its source allows.
Where it lives in the code: lib/provenance.ts · app/v/[id]/page.tsx · components/WallBody.tsx · lib/api-auth.ts · lib/approval-rules.ts
This is running now
Open a project and use it. Nothing on this page is a roadmap.