Trust center
Where Proofcan runs, how it is protected, who processes data for it, and what it does not claim. Every line is backed by the security architecture document submitted with the C2PA application, the providers' own records or a measurement.
Certification and C2PA status
- C2PA Conformance
- Application in progress.
- Application scope
- Conformance Program 0.2 · Content Credentials 2.2 · Generator Product, backend · Assurance Level 1 · still images (JPEG, PNG, WebP)
- Signing certificate
- A test certificate (“PROOFKIT Test Signer”). The signature verifies; validators report the signer as untrusted.
- Timestamp service
- DigiCert's public RFC 3161 server timestamps each signature. It receives only a hash of the signature, never the image or personal data. Validators report that authority as untrusted for C2PA.
Security architecture
Signing key
RSA 2048, PS256. Generated on the engine host and never written to disk in plain form; stored encrypted with AES-256-GCM (systemd credentials). Only the signing tool reads it, only while signing.
GPSA §2.2
Engine isolation
The engine listens only on the loopback interface and is reached through a Cloudflare tunnel. A network firewall drops inbound traffic before it reaches the host. The service runs hardened under systemd (exposure score 1.7).
GPSA §2.6
Transport
engine.proofcan.com accepts TLS 1.3 only. The site talks to the engine over TLS 1.3, and every engine response to the site is signed (HMAC-SHA256) and checked.
GPSA §2.2, §2.5
API keys
Shown once, when created. Proofcan stores only the key's SHA-256 and its first 12 characters. A revoked key is refused from the next request. Up to five per account.
GPSA §2.6
Administrative access
Root on the engine host signs in only with a 12-hour SSH certificate; password logins are off. The operator's GitHub, Vercel, Cloudflare and Hetzner accounts use two-factor sign-in.
GPSA §2.2, §2.6
Scanning
Dependencies are scanned on every push and weekly, with Dependabot alerts and security updates on. An OWASP ZAP baseline scan runs monthly against the site and the engine.
GPSA §2.3, §2.6
Data handling
- Uploaded original
- Exists only for the request, then deleted.
- Signed file
- Downloadable for 24 hours, then removed.
- Registry record
- Lookup ID, SHA-256 and time; kept until the owner deletes the marking.
- Public record page
- Never shows the file name or the account.
- Where
- Website and server functions in Frankfurt, Germany (Vercel, fra1); the signing engine in Nuremberg, Germany (Hetzner); the database in Ireland (Turso, AWS eu-west-1). All in the EU.
- Payments
- Paddle.com Market Limited, as Merchant of Record.
- Data processing agreement
- On request: support@proofcan.com.
Subprocessors
Companies that process personal data on Proofcan's behalf. Checked on 31 October 2026 against the providers' own records and Proofcan's configuration.
Vercel Inc.
What it does for Proofcan
Hosts the website and its server functions: sign-in, dashboard, quota and API key checks.
Personal data
Account email and name, session, the IP address of each request.
Where
Server functions in Frankfurt, Germany (fra1).
Turso, Inc
What it does for Proofcan
The website's database.
Personal data
Account email and name, password hash, markings, usage and API key hashes.
Where
Ireland (AWS eu-west-1).
Hetzner Online GmbH
What it does for Proofcan
Runs the marking engine: watermark, C2PA signature and registry.
Personal data
Uploaded images (deleted after the request), signed files (24 hours), registry records.
Where
Nuremberg, Germany.
Cloudflare, Inc.
What it does for Proofcan
DNS for proofcan.com, the TLS endpoint and tunnel for engine.proofcan.com, and email routing for support@proofcan.com.
Personal data
Uploads and API requests on their way to the engine; email sent to support@proofcan.com.
Where
Cloudflare's global network.
Merchant of Record
Paddle.com Market Limited
What it does for Proofcan
Merchant of Record: the seller of your subscription and the payment intermediary. Paddle handles checkout, invoices and VAT under its own privacy policy.
Personal data
Billing and payment details.
Where
United Kingdom.
Sign-in provider
Google Ireland Limited
What it does for Proofcan
Sign in with Google, only if you choose it: Google confirms who you are and passes your email address and name to Proofcan.
Personal data
The email address and name of the Google account you sign in with.
Where
Ireland, for users in the EEA and Switzerland. Google may process data on its servers around the world.
Report a vulnerability
Security problems and C2PA non-conformances go to support@proofcan.com. What to include is on the security page.
What Proofcan does not claim
- It does not make you compliant with the EU AI Act or any other law.
- It does not guarantee that a watermark survives every edit.
- It does not detect AI imagery in general.
- It is not legal advice.