Tokens are generated with a cryptographic random source and stored as a hash. Ownership is rechecked every 30 days; monitoring suspends if verification lapses rather than continuing on stale consent.