Keep a copy of your proofs outside your site · Docs

Written for Cookie Rocks 2.11.0, checked on 6 November 2026. The current version is 2.11.2: some details may have changed.

This guide is for site owners who want their proofs of consent safe even if the site breaks, is hacked or is moved. Cookie Rocks Pro sends the new proofs, every day or every week, to a storage of yours.

You need: Cookie Rocks Pro, with Proof of consent set to Keep a trace of each choice (recommended) on the Proofs screen. The Audit has no register of proofs: see Prove consent if an authority asks.

The Proofs page of Cookie Rocks Pro, with the settings and the latest choices — Cookie Rocks 2.11.2 · Click to enlarge

Choose a destination

The Backup copy section of the Proof of consent page: Dropbox, WebDAV, a signed webhook or an e-mail address — Cookie Rocks 2.11.2 · Click to enlarge

Fill in each destination

With Cookie Rocks Pro

Dropbox: click Get a code from Dropbox. Dropbox opens in a new tab and asks you to allow Cookie Rocks to write in its own folder, then shows a code. Paste it in the field next to “Paste the code here and save.”, then click Save the destination. The account then shows Connected. The packages go into Apps/Cookie Rocks/, in a folder named after your site, one dated folder each.
WebDAV: in WebDAV address, give the address of a folder, starting with https, for example https://cloud.example.com/remote.php/dav/files/user/ on Nextcloud. Fill in User and Password. Create an application password in your storage, rather than using the password of the account. A dated folder is created in that folder for each package.
Webhook: in Webhook address, give the https address of the tool that receives the notices. After you save, the secret of the webhook is shown once: copy it into that tool. Each notice is a POST in JSON, with the manifest and a download address valid 24 hours, signed with the secret (HMAC SHA-256 of the body, header X-Cookie-Rocks-Signature).
E-mail: give the E-mail address. The package comes as a zip attachment, up to 10 MB. Beyond, the message says to download it from the Proofs screen. E-mail is the least protected destination: the file passes through your mail servers and stays in the mailbox.

Check that it works

If you see “Error”… the last package was not delivered, and the message gives the reason. The proofs stay safe in the register of your site, and the next try follows the schedule. Check the address, the account or the password, then click Save the destination again. Incomplete means a field of the destination is empty: nothing is sent yet.

Tip. Anyone can check a package without access to your site. manifest.json gives the SHA-256 fingerprint of each file: compute it with a SHA-256 tool, such as shasum -a 256 proofs.csv, and compare. Each manifest also gives, in its previous field, the fingerprint of the manifest of the previous package sent the same way, so a series of packages can be checked one after the other. README.txt explains each file.

More detail: Proof of consent.

Next step: Get ready for visitors from the United States

Cookie Rocks helps you find your way through cookie and privacy rules. It does not replace a lawyer’s advice.