What a record does and does not prove
Every record page shows a label, one sentence, and five checks. The label is computed from the checks when the page is shown, under the policy version listed at the bottom of the page. Nothing a device reports about itself counts on its own; only what the server measured or an outside party signed.
The five checks
| Original held | The server has the file, re-read it after storage and got the same fingerprint. A sender's hash that disagrees disqualifies; a missing one does not. |
| Immutable archive | The stored bytes are under a compliance-mode lock that has not expired. Nobody, including us, can remove them before it does. A governance lock is shown but not counted. |
| Independent timestamp | A public Time Stamp Authority signed the fingerprint, and the server verified that signature against the Mozilla root store. Their clock, not ours. |
| Camera origin | A verified attestation that the file came from a camera sensor: our app on an attested device, or a platform-signed native photo. Not yet available. |
| Live capture window | A one-time challenge issued by the server shortly before the shutter came back with the file, so the capture happened inside a window measured on server time, 60 seconds or less. |
The labels
| Registered | Original held. The file has existed unchanged since the recorded time. Where it came from is not verified. |
| Verified Original | Original held, immutable, timestamped, camera origin. Taken with a live camera; timing device-reported. |
| Live Verified | All five. Taken with a live camera inside a server-timed window. |
| Rejected | The bytes received did not match the hash the sender reported. Kept as evidence. |
| Deleted | The owner destroyed the original's key. The fingerprint and times remain; the image is gone. |
What no label claims
That the scene was real. A photograph of a screen or a print is a real photograph. Metadata inside a file ("taken with iPhone") is written by software and is shown as the file's claim, never as evidence. A mark on a shared copy can be cropped or copied; the record, not the mark, is the proof.
Policy versions
Rules can only get stricter. When they do, the version changes and older records may lose a label; the page always shows which version it was judged under.
| 2026.09-dev1 (current) | since 2026-09-05. Initial rules. E1 original held (mismatching sender hash disqualifies; a missing one does not); E2 unexpired compliance lock only; E3 server-verified RFC 3161 token; E4 verified attestation of an app or platform camera; E5 challenge window of 60 s or less on server time. Labels: Registered (E1), Verified Original (E1-E4), Live Verified (E1-E5), Rejected (hash mismatch), Deleted (key destroyed). |