Tamper-evident photo evidence for disputes, audits and compliance

Captilo gives insurance, construction, and legal-ops teams a defensible photographic record: cryptographically sealed, blockchain-anchored, and time-stamped by an EU-qualified trust service, without ever taking custody of the underlying photos.

Talk to us See the evidence workflow

Anchored on: Sonic blockchain
Qualified time: APED, eIDAS trust service
Content Credentials: C2PA Conformant Generator, Level 1
Photo custody: Stays on the capturing phone
Verification: Works without Captilo

Unverifiable photos are a quiet liability

Claims fraud exposure
Manipulated and AI-generated damage photos make fraudulent claims cheap to attempt. Unverifiable imagery is the weak link in every digital claims process.
Audit and dispute costs
Construction milestones, delivery conditions, and site inspections documented with ordinary photos are easily backdated or disputed, turning routine audits into costly investigations.
Evidentiary weakness
Standard EXIF metadata is stripped or rewritten with free tools in seconds. Legal and compliance teams are increasingly expected to explain how photographic evidence was authenticated, not just that it exists.

Why the architecture matters to your business

Captilo keeps photos on your devices and puts only their fingerprints on a public blockchain. That one design decision changes your risk, your compliance work and your exit.

A smaller breach and compliance surface

Creating a proof sends Captilo no photo, no location and no name. There is no evidence archive at Captilo for an attacker to reach, for your privacy team to assess, or for anyone to purge when you stop.

No lock-in, not even to us

Proofs are anchored on a public blockchain, and each certificate carries everything a verifier needs. Anyone with IT skills can check them with public tools, even if Captilo no longer exists.

How to check a proof without Captilo

Time and integrity that stand on their own

Proofs are time-stamped by APED, a qualified trust service whose timestamps EU law presumes accurate, and anchored on a blockchain that no single party controls, Captilo included.

Nothing to integrate before you start

Your team captures with the Captilo app and shares PDF certificates through the channels it already uses. No SDK, no data pipeline, and nothing to unwind if you stop.

Open standards, reviewed like infrastructure

Nothing here asks your procurement or security team to trust a black box. Every mechanism below is a named, independently verifiable standard.

Cryptographic hashing: Split SHA-256 hashing of the photo and of its canonicalized metadata (RFC 8785), independently recomputable by any party, including yours.
Blockchain anchoring: Every proof is anchored to the Sonic blockchain (EVM-compatible, sub-second finality), a permanent record no single party controls.
eIDAS qualified timestamps: RFC 3161 timestamps from a qualified trust service provider on the EU Trusted List, legally presumed accurate in every EU member state (eIDAS Art. 41).
C2PA Content Credentials: Captilo is a C2PA Conformant Generator Product (Max Assurance Level 1). Photos published online carry Content Credentials following the open C2PA standard.
Device-local architecture: Original photos never reach Captilo’s servers, and biometric data never leaves the phone. Only two cryptographic hashes are anchored on the blockchain.
GDPR-aligned by design: A copy of a photo leaves the phone only when a user shares, publishes, or submits it to a team. No biometric data is transmitted, and every category of data we process has a documented purpose and legal basis.

We never take custody of your photos

The full signed record travels inside the certificate your team chooses to share. There is no central photo repository for a breach to expose, and no Captilo server your evidence depends on: proofs stay verifiable even if Captilo is gone.

On the phone

The original photo
Fingerprint and face data, in secure hardware
The signing key and its recovery phrase

On the blockchain

A SHA-256 hash of the photo
A SHA-256 hash of its record
The proof’s event ID and capture time

In the certificate you share

The photo
The full signed record: time, place, device and check results
Everything a verifier needs to re-check it

Captilo’s servers check signatures, device attestation and credits. They work with hashes and a pseudonymous account ID and never receive the original photo. A resized copy reaches us only when someone publishes a photo, and a small thumbnail, encrypted end to end, only when a team uses Smart Requests. Full detail in the Privacy Policy.

Chain-of-custody workflow

The full technical chain from shutter press to blockchain anchor, mapped step by step to the evidentiary concept each step supports.

Read the workflow

Integration

Verified proofs can be checked programmatically against the blockchain registry, and certificates can be attached directly to claims, procurement, or case-management workflows. No SDK required for partners.

Discuss integration

Run a free two-month pilot

We offer every business a free pilot as a Business organisation: 3,000 shared credits for up to 50 people. Your team documents real work in the field, and you decide with real certificates in hand.

Request a pilot How the pilot works What sets Captilo apart

Setup: Tell us what your team needs to document, and we set up the pilot with you. Captilo runs on Android phones today.
During the pilot: The full product for two months, extendable once by a month, as a Business organisation: 3,000 shared credits for up to 50 people, PDF certificates, public verification, and team requests with four-eyes confirmation.
When it ends: Nothing to migrate and no deletion project. Your photos and certificates never left your devices and systems, and every proof stays verifiable. If your team used Smart Requests, deleting the team removes its data from our servers 30 days later.
Privacy review: A small, pseudonymous data set to assess: device IDs, plan status, proof status and, only if you use Smart Requests, the structure of a team (codes, roles, request status). Team names, member names, task text and thumbnails are encrypted on the phones; Captilo cannot read them. Every item and how long we keep it is listed in our Privacy Policy.

Questions businesses ask us

Does Captilo store our photos?

No. Photos and their signed records stay on the phone that took them. Creating a proof sends Captilo SHA-256 fingerprints, a signature and a pseudonymous ID. A resized copy reaches Captilo only when someone chooses to publish a photo online, and a small thumbnail, encrypted end to end, only when a team uses Smart Requests.

What happens to our evidence if Captilo shuts down?

It stays verifiable. Each proof’s fingerprints are on the public Sonic blockchain, and each certificate carries the photo, its signed record and its event ID. Anyone with IT skills can recompute the fingerprints and compare them on the blockchain with public tools. We publish the exact steps and a verification script.

Check a proof without Captilo

What does Captilo process under the GDPR?

Creating a proof sends nothing that names a person. What we do process is small and pseudonymous: a device ID, plan and credit status, the processing status of each proof, and, only if you use Smart Requests, the structure of a team. Team names, member names, task text and thumbnails are encrypted on the phones, and Captilo cannot read them. Every item and its retention period is listed in our Privacy Policy. The photos themselves stay on your devices and systems, under your own policies.

How long we keep data

Is there anything to clean up when a pilot ends?

No data migration and no deletion project. Your photos and certificates were never with us, and every proof stays verifiable. Accounts are pseudonymous, and a free account left unused is deleted automatically after six months. If your team used Smart Requests, deleting the team removes its data 30 days later.

Will a Captilo proof be accepted in court?

No tool can guarantee that. Captilo provides a technical record that a court or an opposing party can check for themselves: qualified eIDAS timestamps, which EU law presumes accurate, and a public blockchain anchor. Whether evidence is admitted depends on the proceeding and the jurisdiction.

Admissibility, in detail

Do we need to integrate anything?

Not to start. Your team uses the Captilo app, and certificates are PDF files you share like any other document. Systems that need automated checks can look proofs up in the public blockchain registry directly.

Which phones does Captilo run on?

Android phones today. The iOS app is in preparation.

Let’s talk about your evidence workflow

Procurement questions, integration scoping, or a pilot for your claims, audit, or legal-ops team. Tell us where you’re starting from.

Prefer email? contact@captilo.app