Content Credentials (C2PA)
Provenance travels inside the file in the open C2PA format, so it can be read by any compatible tool, not only OneTime’s.
Technology and trust
The architecture behind a OneTime result
OneTime is built so that its claims can be checked without trusting OneTime. This page describes each part.
Signed provenance
OneTime authors each provenance record and signs it with keys held in a managed key service. The private keys are never exported.
Post-quantum countersignature
Each record also carries an ML-DSA-65 signature (FIPS 204). It is designed to stay secure against future quantum computers.
Content integrity
A fingerprint of the file’s exact bytes is signed into the record. Any change to the file is detected.
Device-attested capture
The phone processes media itself and signs its evidence with a hardware-backed key. Raw photos and videos are never uploaded during capture.
Platform integrity
The app can present the platform’s own integrity evidence. Where that service is not configured, the result says so, and it is never shown as a pass.
Capture time and location
Capture time is bounded by OneTime’s server clock; the time the device reports is labelled as such. Location carries its level of assurance.
Verified accounts
Creators can prove control of social accounts and choose whether they appear in their media’s provenance. Account control is not legal identity.
Signed evidence over stored records
OneTime compares its stored records with the signed evidence in each file. If they disagree, the signed evidence is authoritative and the disagreement is reported.
Signed history checkpoints
OneTime records its own server-side history in an append-only log, designed to be checkpointed about every five minutes with classical and post-quantum signatures and retained in storage locked against deletion. The Transparency page shows what is live.
Independent witness on Hedera
OneTime is designed to publish a checkpoint to the Hedera network about every fifteen minutes, so it is timestamped and ordered outside OneTime’s infrastructure, each one committing to the checkpoints before it. The Transparency page shows whether a checkpoint has been witnessed. Hedera is a witness: it is not a signature, and it does not prove that media is true.
Public transparency log
Provenance registrations are appended to a log with signed checkpoints and consistency proofs, built for public audit. Its anchoring is currently local to OneTime’s deployment, not independently auditable.
Verification on this website
Coming soon: anyone will be able to check a file from any browser. The file stays on their device: only its fingerprint and its Content Credentials ID are sent to OneTime.
Design principles
- Your media stays on your device: OneTime stores provenance, not your photos and videos.
- Open standards, so evidence outlives any one tool.
- Every result states its limits, and missing evidence is never called fake.
- Claims you can check without trusting OneTime.