Every asset your pipeline generates leaves with a cryptographic signature, a C2PA-candidate manifest, an invisible watermark, and a tamper-evident audit trail in object storage you control. Compliance as a three-second pipeline step — not a legal risk.
How it works
A brief runs through the Genblaze pipeline — classified and generated on GMI Cloud, with fallback chains.
The ComplianceSink canonicalizes the manifest and signs it with an Ed25519 key only your pipeline holds.
Asset and signed manifest land in Backblaze B2 under Object Lock — durable, retained, tamper-evident.
Anyone can re-hash the bytes, check the signature, and walk the revision lineage. No account required.
The proof
The public verifier re-computes the SHA-256 of the asset and checks it against the signed manifest. Re-encode, crop, or splice a single pixel and verification flips to a red Tamper detected — while the original stays provably intact in B2.
Try the verifierVERIFIED
TAMPERED
Mode 2 signing proves an asset came from your pipeline's key — not just that its bytes are intact.
Manifests sit under B2 Object Lock (governance, 365-day retention). The audit trail is append-only.
Reject-and-retry links every run to its parent. The verifier renders the full ancestry tree.
Structured provenance today, aligned to the C2PA claim model for a drop-in Mode 3 tomorrow.
A detectable watermark rides in the pixels, surviving format conversions the hash alone would miss.
A paste-a-URL page anyone can use — regulators, partners, auditors. No login, no SDK.