Trust & Security

Security by design

CanonProof is built for evidence workflows. We protect your files, your certificates, and your data — while keeping verification publicly checkable.

Cryptographic signatures Plan-based retention Public verification of certificates
Security overview

Protect files, preserve integrity, prove authenticity

SHA-256 hashing ES256 signatures Role-based access Retention controls Public verify link
Lifecycle protection

Security from upload to public verification

01

Ingest & hash

Files are hashed (SHA-256) and identified by type (image/audio/video/PDF). The hash becomes the anchor for integrity across the system.

02

Verify & explain

Forensic extractors generate indicators. A scoring layer produces status + confidence. Outputs are designed for auditability — not black-box labels.

03

Issue & sign

A certificate snapshot is created and signed (ES256). This makes the result tamper-evident for court bundles, reports, and third parties.

04

Public verification

The public verification page validates the certificate authenticity without exposing your account. It proves the certificate is real and unchanged.

Important: what CanonProof verifies

CanonProof certifies integrity signals and authenticity indicators for a digital file and signs the result. It does not determine the truth of claims or events — it provides an independently verifiable technical assessment.

AI is advisory-only

When AI analysis is available, it is recorded as indicators (probabilities/confidence) and never becomes the sole decisive factor. If AI is unavailable, the certificate records that fact.

Retention & storage controls

Certificates are kept according to your plan’s retention window and storage cap. Public verification remains free, even if you downgrade later. See Retention & storage policy.

Data protection

Safeguards for sensitive evidence

Protection layers

  • Authentication for account and API access.
  • Scoped credentials for integrations (API keys / bearer tokens).
  • Least-privilege access model for sensitive operations.
  • Certificate signing ensures tamper-evidence for outputs.

Operational security

  • Audit-friendly outputs (indicators + reasoning).
  • Plan-based retention and storage limits.
  • Public verification page doesn’t require an account.
  • Separation of concerns: AI is advisory, forensics remain core.
FAQ

Security questions

No. Certificates are signed (ES256). Any modification breaks signature verification and will fail on the public verification page.

No. Public verification is designed for external trust. Anyone can check the certificate authenticity via the public link.

No. AI is advisory-only. When available it becomes indicators; when unavailable the certificate records that fact.

Retention depends on your plan. See Retention & storage policy for exact windows and storage caps.

Need security details for a client or case?

We can provide a security summary tailored for PI firms, law firms, insurers, and platforms.