The fine print, writ large.
What Content Credentials prove, and what they do not. Knowing the difference avoids reading too much into a status.
C2PA verifies evidence, not truth
ProvSeal helps inspect provenance signals. It does not decide whether an image is real, fake or AI-generated. Use Content Credentials as technical evidence in a review workflow — not as a verdict on truth.
- That the file contains Content CredentialsWhether a file contains C2PA Content Credentials.
- That the file has not changed since signingWhether a file still matches its signed manifest: the cryptographic hash binds the manifest to the exact bytes of the file.
- Who signedWho signed the manifest, when certificate data is available.
- Whether the signer is recognizedWhether certificate trust can be evaluated against a recognized source, such as the C2PA Trust List.
- The declared stepsThe actions and ingredients the signer declared, in order.
- That the declaration is authenticWhat the manifest contains was indeed signed by this certificate.
- That the scene is realC2PA does not prove that a depicted event took place, or that visual content is true or factual.
- That a human made itIt shows the declared tools and actions, not the nature of the author.
- Ownership of rightsA manifest neither grants nor verifies copyright.
- What is AI and what is notProvSeal is not an AI detector: it does not classify all generated or edited media and does not judge true from false.
- That unsigned content is falseNo credentials is not evidence that content is false. Most content does not have Content Credentials yet.
- That the metadata will surviveA screenshot or some platforms can strip it.
- That a test certificate is publicly trustedIt does not make test certificates publicly trusted.
- Test certificates: useful for demos, never for public trust.
How to read status labels
Status labels explain available evidence in the product UI. They are not truth verdicts.
- TrustedValid Content Credentials with a certificate chain recognized by the configured trust sources.
- Signed but untrustedCryptographically valid signature, but the certificate is not recognized as publicly trusted.
- InvalidC2PA evidence exists, but integrity or signature validation failed.
- No credentialsNo C2PA data found. This does not mean the content is fake or false.
A file can show a valid manifest with a self-signed or test certificate. That is expected for demos — it is not public trust, and AI detection remains undetermined.
Use the report as evidence to investigate
A C2PA result is one input in a wider review workflow. Teams should combine C2PA evidence with editorial review, source checks, file history and organizational policy.
Combine C2PA data with your own review tools for stronger provenance decisions.
Questions about our limitations?
An honest answer is better than a promise. Write to us.