CaptiloVerifyDE

What happens between the shutter press and a defensible record

Every Captilo capture runs through nine independent, cryptographically linked steps before the file is ever exported. Each step exists to answer a question a claims adjuster, auditor, or opposing counsel will ask: which device captured this, when, and has it been altered since.

Nine steps, one continuous record

  1. 1

    Device authentication

    The camera opens only after the phone’s own authentication: an enrolled fingerprint or face, with the device PIN as fallback. A one-way SHA-256 commitment (binding an anonymous ID, a single-use nonce, and the photo hash) is then generated locally as a record that authorization happened. Fingerprint and face data never reach Captilo; the phone only reports that authentication succeeded.

    Authorization

    Shows the capture was authorized on that device. It is device-level authorization, not identity: phones never reveal which enrolled finger or face was used.

  2. 2

    Local cryptographic hashing

    SHA-256 hash of the raw photo bytes, plus a separate SHA-256 hash of canonicalized metadata (RFC 8785): the split V2 hashing scheme.

    Integrity

    Any change to a single pixel or metadata field produces a completely different hash, independently recomputable by anyone.

  3. 3

    Cryptographic signature

    A secp256k1 signature is generated over the exact signed payload, tied to a device-held private key.

    Non-repudiation

    Proves the proof was produced by the holder of a specific key, so it cannot be plausibly denied after the fact.

  4. 4

    Single-use nonce

    A device-bound, single-use nonce with a 60-second TTL is issued before capture and consumed on submission.

    Anti-replay and anti-backdating

    Prevents a previously generated proof from being resubmitted or reused to backdate a new capture.

  5. 5

    Blockchain anchoring

    Both hashes are submitted to the Sonic blockchain (EVM-compatible, sub-second finality) via the CaptiloProofRegistryV2 / CaptiloUnifiedRegistry contracts.

    Immutable audit trail

    Creates a permanent, third-party-verifiable record that cannot be altered or deleted after the fact, by Captilo or anyone else.

  6. 6

    eIDAS qualified timestamp

    An RFC 3161 timestamp from APED, a qualified trust service provider on the EU Trusted List, covering both the photo hash and the metadata record. It is requested in parallel with the blockchain transaction.

    Legally presumed time

    Under Article 41(2) of the EU eIDAS regulation, a qualified timestamp carries a legal presumption that its date and time are accurate. If the TSA response is delayed or empty, which happens rarely, the blockchain anchor still provides an independent timestamp.

  7. 7

    Fraud detection screening

    A battery of on-device checks runs before submission: swap and substitution detection, screen and print detection, geolocation-integrity checks, and device and emulator attestation. See the attack-by-attack breakdown below.

    Manipulation screening

    Swapped or injected photos are rejected; every other result is written into the signed proof record and shown on the certificate. Like any automated screening, it reduces risk but is not a guarantee.

  8. 8

    Offline captures (when applicable)

    If a device is offline at capture time, the same integrity checks still run on the phone and are signed when the proof syncs. The time comes from the device clock only, with no server nonce and no qualified timestamp until it syncs.

    Disclosed limitation

    Offline proofs are flagged as offline in the proof record and are permanently graded at most C. Nothing is hidden from a reviewer.

  9. 9

    Independent verification

    Anyone can re-upload a certificate or photo to the public verifier and have its hashes recomputed and checked against the blockchain record. The same checks also work with public tools alone, without Captilo.

    Third-party verifiability

    No Captilo account, no proprietary software: the proof stands on public cryptography and a public ledger.

Try it yourself. Upload any Captilo certificate and watch these checks run.

Check without Captilo Open the verifier

What each attack looks like, and what actually stops it

Not every signal blocks a submission, and it shouldn’t: a system that hard-rejects every imperfect signal produces false rejections in the field. Each defense below is labeled for what it actually does: reject outright, flag for human review, or lower the capture grade.

Has a hard block

Swap and substitution attacks

Swapping in a gallery photo, intercepting the file before it’s hashed, or routing a virtual or injected image into the pipeline.

Defenses

  • Capture-timing, EXIF-consistency and image checks
  • A single-use nonce, generated before the camera opens, is bound into the signed record
  • A fresh, per-capture hardware attestation (see jailbreak and attestation) bound to that exact photo

Outcome: An impossible capture timing or an EXIF device mismatch rejects the capture outright. The other checks are recorded in the signed proof, and a proof without a verified hardware attestation scores lower.

Flagged, not blocked

Screen and print attacks

Photographing a screen or a printed image to produce a fake “authentic” capture.

Defenses

  • Frequency analysis across sampled patches, looking for the moiré interference a camera picks up from a display or a printed dot screen
  • Edge-sharpness analysis: a re-photographed image has softer edges than the real scene
  • Designed not to flag regular textures such as fabric or mesh

Outcome: Not blocked. When the analysis points to a screen or a print, the proof carries a screen-photo warning (medium or high) that is signed into the record, printed on the certificate, and recommends human review. It cannot be removed without breaking the proof. The warning does not change the capture grade.

Flagged, not blocked

Geolocation spoofing

Using a fake-GPS or mock-location app to misrepresent where a photo was taken.

Defenses

  • Android exposes an OS-level “mock location” flag; Captilo reads and records it on every capture

Outcome: Not blocked, because external GPS receivers can use the same interface. A flagged location is marked “Spoof location detected” in red in the app, on the certificate and on the verify page, and the capture grade is at most C. The flag is signed into the record and cannot be removed.

Graded, not blocked

Jailbreak, root and device attestation

Running Captilo on a modified OS, or using tooling to inject a fabricated image into a compromised device.

Defenses

  • Root and jailbreak status is detected and recorded in the signed proof
  • One-time device registration binds Captilo’s signing key to a hardware attestation (Google Play Integrity on Android; Apple App Attest for the iOS app), verified server-side
  • A fresh, live per-capture attestation assertion is bound to that capture’s nonce and photo hash

Outcome: Not blocked, because many legitimate users run modified devices. Instead, the per-capture attestation is checked by Google’s servers rather than by the app, so a compromised device cannot simply claim it passed. A proof without a verified attestation scores lower and cannot reach the High band.

Has a hard block

Emulators and virtual cameras

Running the app in a simulator, or routing a virtual or fake camera source into the capture pipeline.

Defenses

  • A physical-device check confirms the app isn’t running in a simulator
  • A hardware timing check that helps detect emulators and debugging tools
  • Android camera enumeration flags externally routed or virtual camera sources

Outcome: Blocked outright when the camera source is clearly virtual. Unclear cases are not blocked, to avoid rejecting genuine captures.

A capture grade you can see

The verdict is separate and binary: a proof is verified only when its picture and metadata hashes match the blockchain record. The capture grade, A to D, says how well the circumstances of that capture are backed up. It is shown in the app and on the certificate.

What it can never be: a proof that is not on the blockchain gets no grade at all. An offline capture, or a location that came from a simulation app, is graded at most C, however well it does elsewhere. The grade is calculated on the phone as a guide; what anyone can re-check independently is the signed record and its blockchain anchor.

  • When

    Is the capture time independently confirmed by a qualified eIDAS timestamp?

  • Where

    Is there a real GPS fix, and how precise is it?

  • Who authorized

    Was the capture unlocked with a fingerprint or face, or only a device PIN?

  • Device

    Did a live hardware attestation confirm a genuine phone at the shutter?

Read this before you rely on it

What this record supports

  • A mathematically verifiable statement of what the file’s bytes and metadata were at the moment of anchoring.
  • An immutable, third-party-checkable timestamp and blockchain record no single party can quietly alter.
  • A documented, reproducible technical chain you can hand to an insurer, auditor, or your own counsel to build a chain-of-custody argument.
  • An EU-qualified eIDAS timestamp, which carries a legal presumption of accurate time across EU member states.

What it does not do

  • It does not guarantee that any specific court, arbitrator, or insurer will admit or accept the record. Admissibility depends on jurisdiction, the rules of the proceeding, and the discretion of the deciding body.
  • It does not guarantee that fraud screening catches every manipulated or AI-generated image. A screen-photo warning is a prompt for human review, not a verdict, and the absence of a warning is not proof of authenticity.
  • It is not a replacement for expert witness testimony, formal forensic examination, or advice from qualified legal counsel.

The binding legal language is in the Disclaimer, part of our Privacy Policy & Terms.

Will this be admissible in court?

Captilo produces cryptographic integrity, timestamping, and provenance evidence that supports a chain-of-custody argument and can be submitted to a court, insurer, or auditor. It is not a guarantee that any specific body will admit it. Admissibility is a legal determination made by the deciding body under the rules of that proceeding, not something any technology vendor can promise.

What Captilo can do is make the underlying technical record as strong and as independently verifiable as possible, so that when your counsel lays the evidentiary foundation, they have real cryptography, a real blockchain record, and a real qualified timestamp to point to, not just a claim.

Evaluating Captilo for your organization?

Talk to us about standards compliance and integration details for your procurement or compliance review.

For enterprise & compliance