# Archive linked documents

Consent language often points at a privacy policy, terms of sale, or arbitration clause instead of repeating it on the page. The CDR visual record proves the link was there when the person submitted. Tag the link and we also store what was on the other side of it.

## Tag the link

Put `data-ec-supporting-document` on the anchor, with a name for the document.

```html
<a
  href="https://example.com/privacy"
  data-ec-supporting-document="privacy-policy"
>
  Privacy Policy
</a>
```

The name is yours to choose and it identifies the document on the record. It has to be 1 to 64 characters of lowercase letters, numbers, hyphens, or underscores, starting with a letter or a number. Capitals are lowercased for you. Anything else is skipped, with a warning in the browser console.

The attribute works on an `<a>` element that has an `href`, and nowhere else. Relative URLs are resolved against the page, and a `#fragment` is dropped. If two links on the page use the same name, the first one is recorded and the second is skipped. A record holds ten supporting documents; once ten are recorded, later tagged links are skipped.

The link's text is stored as the document's label, and that is what you see beside it later. A link with no text falls back to its `aria-label`, then its `title`, then the name you gave it. Only the first 200 characters are kept.

## What happens after the capture

We make one request per link, without cookies and without a browser. Static HTML is reduced to a reader document: headings, paragraphs, lists, tables, and link targets survive, while scripts, forms, images, and site styling do not. PDFs are stored byte for byte. Each stored document carries the time we retrieved it and a SHA-256 of its contents.

## What the destination has to be

- **Reachable over HTTPS from the public internet**, with no sign-in. The request carries no cookies, so a document behind a session is a document we cannot read.
- **Server-rendered.** The legal text has to be in the first HTTP response, because we do not run JavaScript. A page that paints its text client-side cannot be archived.
- **HTML or PDF**, up to 2 MiB of HTML or 20 MiB of PDF, answered within ten seconds and after at most five redirects.

When a document cannot be retrieved, the dashboard shows a reason code beside it. [Troubleshooting](https://app.expressconsent.com/docs/troubleshooting) lists what each one means.

> **Warning: Never put personal data in a supporting-document URL**
>
> The full URL is stored with the record and kept for five years, so a lead ID
> or an email address in a query string is retained with it. Link to the
> document, not to a per-consumer copy of it.

## Where the archived documents appear

On the record in the dashboard, once your organization has [collected](https://app.expressconsent.com/docs/concepts/access) it, and on a share page once the receiving organization has collected it too. Each document shows its label, its source URL, and a status: **Archived** or **PDF** once it is stored, **Archiving** while retrieval is in flight, and **Unavailable** when it could not be retrieved.

Supporting documents are not in the [API](https://app.expressconsent.com/docs/reference/api/cdrs) response, the [`cdr.completed`](https://app.expressconsent.com/docs/webhooks/cdr-completed) payload, or the PDF export of a share. Read them in the dashboard or on a share page.

## What the archived copy is evidence of

That we retrieved this document from this URL at that time. It is not evidence that the person opened the link or read what was on the other side — only the visual record speaks to what they saw.

It is also not a picture of the destination. Layout and images are dropped and the wording is preserved, so the archived copy reads like the document rather than looking like the page. Where the appearance of a linked page matters as much as its wording, capture that page as a CDR of its own.

## Next

- [captureCDR()](https://app.expressconsent.com/docs/reference/capture-cdr): Capture a CDR, attach metadata, and generate a share URL.
- [Access and collection](https://app.expressconsent.com/docs/concepts/access): Which organization can download a CDR, which one is charged for it, and how access moves when evidence is shared.