How verification works.

When a delivery arrives you should not have to take anyone's word that what arrived is what was sent, unchanged. This page says what paperwing checks, the word the app uses for each check, and what it does not claim.

Three checks

1. Fingerprinted before it moves. Each file a contributor sends is fingerprinted on their own machine, before it goes anywhere. The fingerprint (a BLAKE3 hash) is what the file is known by from then on, and it is the name it is stored under.
2. Cloud verified. When an upload finishes, our server first confirms the file is there at exactly the size it should be. That is Uploaded, and it is a size check and nothing more. Then the server reads the stored file back and works the fingerprint out itself, instead of taking the sender's word for it. That is Cloud verified. A file whose bytes do not match stops being counted as verified, and the job says so.
3. On your drive. When the lead receives the job, each file is fingerprinted again as it is written to their drive, and it has to match the fingerprint taken where it came from. That is On your drive. A contributor sees the same check as On the lead's drive.

The lead can start receiving before Cloud verified has finished, because the drive makes its own check. Signing off waits for both: every delivery Cloud verified, and every file on the drive with no mismatch. Only an owner or admin can sign off sooner, and the reason they give is kept with the job. A file that does not match shows on the job. It does not quietly pass.

Two different claims, kept apart

What we check and what a camera can say are different questions, and the app never merges them.

• Ours: what was sent is what arrived, byte for byte, and what is on the drive matches it.
• The camera's: this file is what the camera made.

Content Credentials

Some newer cameras sign a photo at the moment it is taken. That is a Content Credential, also called C2PA: the camera saying this file is what it made and it has not been altered since. We carry it through the job beside our own fingerprint, and the record keeps both. A credential says nothing about whether the rest of the card arrived, and our check says nothing about what happened inside the camera.

Most files will not carry one, and that is not a fault. Only a handful of bodies sign, and most raw formats cannot hold a credential at all. Where there isn't one, the job says so plainly. Where there is one, we report exactly as far as it has been checked, and the words are not interchangeable:

• None. Nothing was found in the file.
• Carries one. A credential was found in the file and we have not confirmed it. Either our server has not read it yet, or it read it and could not say. Until it is confirmed, it is the camera's claim and not ours.
• Signed. The signature verifies against the certificate inside the file, and it covers exactly the bytes we hold, so the file has not changed since it was signed.
• Doesn't hold up. One of those two failed, and the job says which. A broken signature and an edited picture are different problems.

One thing “signed” does not mean is that we have confirmed who signed it, or that it was a camera. We show the name on the certificate and describe it as the certificate's own claim. We do not check that name against the industry trust list, so there is no tick beside it.

A credential that does not hold up is not a failed delivery. Once the file is Cloud verified, our fingerprint says it arrived as it was sent. It is the camera's claim about the file that does not check out.

The missing-card check

Cameras number frames in a run. If a contributor's files jump from 2210 to 2216, frames 2211 to 2215 are skipped, and the check says so before you sign off rather than months later. It also compares what arrived against the day's key moments, so a part of the day nobody has files from is flagged. It is arithmetic on frame numbers and capture times, not a guess made by a model. It runs on raw files, and a person's final edits do not get it.

It is a prompt, not proof. A frame deleted in the camera leaves exactly the same gap as a card that was never sent, and a moment nobody shot looks like a moment nobody sent. The check tells you where to look. It cannot tell you what happened.

What this does not claim

• Your own files, added with Add my files, are read where they are on your drive. They are not fingerprinted.
• It does not say who anyone is, and it does not judge a photograph. We never send your deliveries to a model. The only thing one reads is a document you choose to upload.
• A passing check is about the bytes. It does not say a file is good, wanted or complete, which is why the missing-card check is a prompt.
• Receiving a job to a drive needs Chrome, Edge or Arc on a computer. Sending works in any modern browser with nothing to install, and a phone can send but cannot receive.

What stays when the cloud copies go

When a job closes, its cloud copies are released. The record stays with the job: the manifest, every fingerprint and what was checked on it, the paperwork both ways and the sign-off. The manifest is written into the job's documents as it closes, so the record outlives the files it describes. See also deleting your data.

You can see all of this on a made-up job: open the demo.