T
TruthSource← Back to home
TRUST & SECURITY CENTER

The integrity layer behind every certificate.

TruthSource proves what happened to a file without keeping the file. Hash on the client, anchor the proof on a public ledger, embed standard provenance metadata, and retain nothing that could later be leaked — that is the whole architecture.

Zero-RetentionC2PA 1.3 ProvenancePolygon AnchoringGDPR Aligned

Security disclosures and incident reports → security@truthsource.pro · 72h response SLA

Zero-Retention Policy

We prove the asset, then discard it. Only the fingerprint survives.

  • SHA-256 is computed on your device before anything is transmitted
  • Only the digest and certificate metadata are ever persisted
  • Source media is purged once hashing and analysis complete — the record keeps a permanent media_purged flag as audit evidence
  • Erasure on request: account deletion removes your personal data and certificates

C2PA Content Provenance

Standards-based provenance, not a proprietary wrapper.

  • C2PA 1.3 compliant manifests embedded natively in the asset
  • Manifest carried in a JUMBF box so compatible viewers read it directly
  • XMP metadata mirrored for tools that predate C2PA
  • Every manifest is versioned, so provenance history stays inspectable

Polygon Blockchain Anchoring

Proof-of-existence that does not depend on trusting our servers.

  • The SHA-256 digest is anchored to Polygon PoS Mainnet
  • Transaction hash and mined block timestamp are stored on the certificate
  • Anyone can verify the anchor independently against the public ledger
  • Isolated Amoy Testnet is used for sandbox keys (tsk_test_)

GDPR Alignment

Privacy by default, with the paperwork to match.

  • Data processed and stored in the EU (Frankfurt, eu-central-1)
  • Consent decisions recorded as timestamped events with anonymised identifiers
  • Article 28 Data Processing Agreement available on request
  • No automated decision-making — AI layers output technical signals only
ZERO-RETENTION LIFECYCLE
01
Hash locally
SHA-256 computed in the browser or on your server.
02
Anchor the proof
Digest sealed on Polygon; certificate issued.
03
Drop the source
Original media nullified — nothing left to leak.
OPERATIONAL CONTROLS
🔐

Encryption

At-rest encryptionAES-256 — all database records and stored metadata
In-transitTLS 1.3 — all API and dashboard connections
File handlingSHA-256 computed client-side. Original files never transmitted unless Vault is enabled.
Key managementAWS KMS (Frankfurt region)
🏗️

Infrastructure

Data processing regionEU-Frankfurt (AWS eu-central-1)
Blockchain networkPolygon Mainnet for production. Isolated Amoy Testnet available exclusively for API sandbox environments (tsk_test_ keys).
DatabaseIsolated per-app with row-level security (RLS) policies
BackupsDaily encrypted snapshots, 30-day retention
Uptime SLA99.9% target — see /status for live status
🛡️

Access Control

AuthenticationSSO (Google OAuth 2.0) + email/password with 2FA optional
Row-Level SecurityUsers can only read/write their own records. Admin role required for system-level operations.
API keysHashed with bcrypt before storage. Prefix-only shown after creation.
Rate limitingPer-key, configurable 60 req/min default

Enterprise Sign-In (SSO / SAML)

Federate access through your corporate identity provider so users authenticate with existing directory credentials and MFA policies. Available on Enterprise plans.

CONFIGURATION — OKTA
Metadata URL, Entity ID and the X.509 signing certificate are exchanged with your IdP administrator during onboarding. Attribute mapping covers email, display name and role group.
Status: Not configured
📋

Compliance

GDPRData processor under EU GDPR. DPA available on request.
Data residencyAll personal data stored in EU (Frankfurt). No US data transfer by default.
SOC 2 Type IIIn progress — target Q4 2026
C2PACompliant with C2PA 1.3 specification. C2PA is a trademark of the Coalition for Content Provenance and Authenticity.
EU AI ActAI Intelligence Layer (Layer 5) outputs raw technical signals only. No automated decisions. Transparency-compliant.
🔍

Penetration Testing

Last pen testScheduled Q3 2026 — report available to Enterprise clients under NDA
Vulnerability disclosuresecurity@truthsource.pro — 72h response SLA
Bug bountyResponsible disclosure program — contact us for scope
📄

Data Processing Agreement

Enterprise and Pro users can request a signed Data Processing Agreement (DPA) for GDPR Article 28 compliance. The DPA covers:

✓Subject-matter and duration of processing
✓Nature and purpose of processing
✓Type of personal data and categories of data subjects
✓Obligations and rights of the controller
Request DPA → legal@truthsource.pro
© 2026 TruthSource. Patent Pending. Questions? security@truthsource.pro

Deepfake Detection & Zero-Knowledge Privacy: Your original files are securely deleted immediately after analysis.

TruthSource🍪 Cookie Consent

TruthSource uses cookies for essential functionality and, with your consent, for analytics and advertising. You can accept all, manage preferences, or reject non-essential cookies. Privacy Policy · Cookie Policy

Consent powered by TruthSource