About Captilo
Captilo is an evidence camera for smartphones, made by Validag Solutions Ltd. It turns a photo into a record anyone can check: the time, place and device it records, and that nothing has changed since.
What Captilo is
Captilo is a privacy-first mobile evidence camera and verification platform. Every photo is cryptographically fingerprinted, anchored to the Sonic blockchain (EVM, sub-second finality), and stamped with an EU-qualified eIDAS timestamp.
This website verifies Captilo PDF certificates by recalculating their cryptographic fingerprints and checking them against the blockchain, without keeping the certificate.
Verification runs on our server against the public blockchain, so a certificate can’t be made to pass by editing it in the browser, and no account is needed.
How verification works
Captilo uses split hashing on the Sonic blockchain: two independent hashes stored under the same proof ID, so photo integrity and metadata integrity are checked separately.
- 1
Upload a PDF certificate
The file is sent to our server, held only while it is checked, and deleted as soon as the check finishes.
- 2
pictureHash: photo integrity
The server extracts the embedded photo and recalculates the SHA-256 hash of its bytes. A single changed pixel produces a completely different hash, which defeats image swapping.
- 3
metadataHash: context integrity
Independently, the server re-hashes the exact metadata record embedded in the certificate: RFC 8785 canonical JSON covering 21 fields, including username, GPS location, device, capture time, biometric commitment, fraud-screening result and nonce.
- 4
Sonic blockchain lookup
Both hashes are looked up in the CaptiloProofRegistryV2 contract on Sonic. If both match the on-chain record under the same event ID, the certificate is verified, and the transaction and block are shown with the result.
- 5
Deletion
The uploaded file is deleted when the check finishes. Only its file name appears in our server log.
The Captilo app
When a photo is captured:
- The camera opens only after device authentication: an enrolled fingerprint or face, or the device PIN
- The photo is hashed (SHA-256) and a separate metadata fingerprint is calculated from 21 fields
- Both hashes are signed with a secp256k1 key derived from the user’s 12-word recovery phrase
- The signed proof is anchored on the Sonic blockchain and an EU-qualified eIDAS timestamp is attached
- Integrity checks reject swapped or injected photos and flag likely screen or print re-photography for human review
- A PDF certificate can be created with the full proof record, free of charge
Why anchor it on a blockchain
- Immutable
- Once a proof is anchored, the record cannot be altered or deleted, by Captilo or anyone else.
- Tamper-evident
- Any change to a certificate changes its fingerprint, so tampering is detectable immediately.
- No single authority
- Verification doesn’t depend on Captilo’s word. The public ledger holds the record anyone can check.
Content Credentials (C2PA)
When you publish a verified photo online, Captilo embeds C2PA Content Credentials: the open standard for carrying provenance information inside the image file itself.
- Two independent layers
- Anyone can check the Sonic anchor against the public ledger. The C2PA manifest travels inside the file and can be inspected with C2PA-compatible tools.
- Privacy by design
- Published copies are resized to 1080 px. The full-resolution original stays on your phone.
What the manifest records
- That the image was created as a digital capture in Captilo
- Its blockchain proof on Sonic
- Capture context: capture time and time zone, device model, platform, OS version and camera facing
- The integrity-check result from capture
- A one-way biometric commitment hash and the authentication type, never biometric data
- Your Captilo username, as the photo’s title
- The location, only if you switch it on when publishing
Security features
- Server-side processing
- Extraction and hash calculation happen on our server, so a certificate can’t be made to pass by editing it in the browser.
- Image hash recalculation
- The embedded image is extracted and re-hashed on every check, which defeats image-swapping attacks.
- No certificate storage
- Uploaded certificates are deleted as soon as verification finishes.
- Anonymous verification
- No account is needed to verify a certificate.