ProvSeal: On-premise C2PA signing for Content Credentials and digital provenance
Seal every step.
Keep every key.
Original photo, retouching, AI-generated element, approval: ProvSeal records and signs every layer of your content with the C2PA standard. On your infrastructure, with your own keys.
- Member of the Content Authenticity Initiative
- Designed by a PKI specialist
- 300+ Chrome extension users
Four steps.
Four seals.
Each step adds its proof to the file. Together they tell the full story of the content, and let you stand behind it.
-
Creation
The origin is declared: camera capture, software or AI model.
-
Editing
Every retouch or addition is recorded as a tracked action.
-
Approval
Your team approves, and the policy applies the right labels.
-
Publication
The final file is signed with your identity, from your HSM.
Supported formats
SigningJPEGPNGPDFVerificationJPEGPNGPDFMP4MOVWebM
Software is no longer the problem. Trust is.
Building a signing tool has become easy. What remains hard is certificate management, and knowing where your files and keys go.
Your keys never leave
Plug in your HSM or import your certificate: the application does the rest, on your machine. Online platforms host your proofs, and sometimes your certificate, in their cloud.
PKI, without the PKI expertise
We hide certificate complexity, as the big platforms do. The difference: everything happens locally, designed by a PKI specialist.
A predictable cost, not per signature
Online APIs bill by usage: the more you produce, the higher the bill. ProvSeal runs on your premises, with no per-signature meter.
Deployed on your premises, in three steps.
- Connect your identityPlug in your existing certificate or your HSM. We help you choose an authority recognised by the C2PA trust list.
- Describe your processWhich steps to sign, with which labels, by which identity. The policy applies to every workstation on the team.
- Sign in batches, keep the recordDesktop signs locally. The Console keeps the history for your audits, without ever seeing your files.
ProvSeal Desktop
Signs, verifies and batch-processes. Files never leave the machine.
ProvSeal Console
Workstations, policies, audit and updates. A governance layer, not a signing engine.
- No media is sent to a cloud signing service.
Same result. A different model.
Online platforms do excellent work and suit many teams, but everything goes through their service. ProvSeal makes the opposite choice: you keep full control of the chain, from the key to the signed file, inside your organisation.
| Online platforms and APIs | ProvSeal |
|
|---|---|---|
| Your files | Pass through an online service | Never leave your workstation |
| Your private keys | Often entrusted to the platform | In your HSM or token |
| Where proofs are stored | In their cloud | In the file, on your premises |
| Certificate | Often the provider’s | The one you choose |
| Jurisdiction | The provider’s | Yours |
| Team process and batches | Up to you to build | Included with Desktop and Console |
| Billing | Usage-based | No per-signature meter |
| Offline signing | No | Yes, on the workstation |
Not ready yet? Verify any file.
The ProvSeal extension reads the Content Credentials of an image, a video or a PDF right in your browser. No file is uploaded.
- TrustedSigned by an identity on the C2PA trust list.
- Signed, not recognisedValid signature, identity outside the trust list.
- InvalidThe file was modified after signing.
- No informationNo Content Credentials. That does not mean fake.
Free · Already used by 300+ people
For every team that publishes.
Every profession has its steps. ProvSeal records them all, in the order they happen.
All use cases
Pick your profession to see how ProvSeal fits into your production, step by step.
Proof that survives copying.
A screenshot or a social network can strip C2PA metadata. IMATAG’s invisible watermark, embedded in the pixels, then lets you trace the content’s origin.
- C2PA, in the fileThe complete, signed story of every step.
IMATAG, in the pixelsAn invisible mark that survives copying.
Join the pilot program.
Test ProvSeal for 30 days on your real production. You connect your certificate or HSM, we configure the rest with you, and your feedback shapes the product.
- Installation on your infrastructure, with your certificate or HSM
- Direct support from the team, from the first batch to the last
- Your feedback feeds into the product roadmap
- A technical report for your compliance file
Write to the pilot team
Tell us who you are and what you want to sign: we get back to you to set up the pilot.
pilot@provseal.fr Write to the teamCommon questions
Straight answers, including about what ProvSeal does not claim to do.
See all questionsIs ProvSeal only for AI-generated content?
No. ProvSeal signs your whole production: photos, retouched visuals, PDF documents and AI-generated content. The origin of each piece of content is declared in the manifest, so you can justify your process, AI or not.
Do my files or keys go through your servers?
No. Signing happens on your workstations, with your certificate or HSM. The Console only receives governance metadata, never your media.
Can I use my existing certificate?
Yes: P12/PFX today; PKCS#11, YubiKey and HSM in the pilot program. To get Trusted status in verifiers, the certificate must come from an authority on the C2PA trust list. We help you choose it.
What does the pilot program include?
ProvSeal is in beta. For 30 days, we install it with you on your infrastructure, configure your signing policy and support you through your first batches. Your feedback directly shapes the product.
Is ProvSeal enough to comply with the AI Act?
ProvSeal provides the technical means to mark your content with the C2PA standard. Your exact obligations depend on your role and uses: have them validated by your legal counsel.
Does ProvSeal detect AI-generated images?
No. ProvSeal declares and verifies provenance. It does not guess whether unmarked content was generated by AI.