Proofmode Android is C2PA Conformant

(Please note: Proofmode for Android 3.0 is currently in open testing and will be fully launched in May with a new “trusted” signing certificate. Stay tuned for our launch announcement!)

In April, we received the note we had long awaited from the C2PA.org Conformance Program Administrator about Proofmode for Android 3.0:

“We are pleased to inform you that your Generator Product has been deemed conformant at Max Assurance Level 1 by our conformance program!”

We were relieved and excited to have made it through. While the C2PA Conformance process seems fairly straightforward, it took us a few months to navigate, respond to the feedback, and shore up the holes in our application and documentation. For those of you who have made it through the Apple App Store review process with a brand new app, it felt a lot like that!

A big thank you to the C2PA team, supporters, and volunteers who make this FREE program possible. For a small organization like us, that makes a big difference.

You can also see the exact GitHub commit to the Conformant Product list JSON. This ecosystem of open conformance is powered by JSON files in a public GitHub repo, which we think works great.

Assurance Levels

The C2PA Conformance program implements a system of “assurance levels” as explained here:

A conforming product’s assurance level indicates the level of confidence that claims it signs reflect its intended behavior. A higher assurance level indicates a greater level of confidence. Currently, the conformance program has two assurance levels: level 1 and level 2

While Proofmode sought a “Level 1” conformance at this time, as you can see in our security documentation, we in fact do quite a bit more. Since we are using “Edge” claim generation on-device (your photos and videos never leave the device), we currently support many of the security requirements for the higher “Level 2” conformance. This means the total “Target of Evaluation” includes ensuring the software AND hardware we are generating the C2PA claim on is not compromised. To do this, we use capabilities including Google Play Integrity and Android Hardware Attestation to ensure a user is running the officially signed Proofmode app, on known, trusted hardware, that has not been rooted or modified, and has received the latest security updates within the last 90 days.

Learn from our Transparency

We have been working on the issues of media provenance and authentication as human-rights evidence for nearly 15 years with our partners at Witness.org. Through this time we have been committed to building an open, interoperable ecosystem of trust through free and open-source code and open standards like C2PA. The world we want to exist in, one that best protects the rights of people around the world, is one where many verified, interoperable C2PA conformant solutions exist.

One step we are taking to support that goal is to share what we have learned as publicly as possible. Through May and June, we will be continuing our C2PA Conformance journey for our other apps and tools, including Proofmode for iOS and Proofmode Verify (aka “ProofCheck”). Through that, we will be sharing our public documentation, interoperability samples, and other notes in a public repository on GitLab.

For those interested, you can view our Proofmode for Android Level 1 Conformance Security documentation on GitLab.

Open Standards, Open Code

Through our partnership with the Content Authenticity Initiative, we have developed and released the official C2PA Software Development Kits for Android and iOS. Our Proofmode apps are the current best showcase of those SDKs and code libraries. We will be sharing more details, samples, walkthroughs and more in the coming weeks. You can also find us on the CAI Discord or contact us here if you need help!

Explore Conformance!

You can browse the C2PA Conformance Explorer yourself to see our listing along with many other conformant products and services.