Reliable digital evidence is not merely a timestamp added to a file afterwards. The photo or video is created directly inside the CertiPhoto app, so that checks can begin before capture and continue until the data is received by the service.

Throughout this process, CertiPhoto checks the account and device state, uses single-use tokens to prevent replay, consolidates the available technical data and computes cryptographic fingerprints of the file. A proprietary AI-based anti-fraud analysis, trained on a corpus of more than 10 million photographs, also looks for signals that may indicate manipulation or inconsistency. These elements form a coherent and traceable chain rather than a collection of self-declared metadata.

The service then produces an electronically signed PDF/A-3B certificate bearing a timestamp from a trusted authority. The SHA-256 fingerprint binds the certificate to the exact file: even the slightest alteration produces a different fingerprint. The certificate identifier and QR code can subsequently be used to check its status and the essential information published by CertiPhoto.

The certificate establishes a set of verifiable technical facts: the identity of the requesting account, the device and app used, the reference time, the associated file and its cryptographic fingerprints. Location and contextual data are also recorded when they are available.

Geolocation is not limited to coordinates reported by the phone. CertiPhoto can cross-check several available sources, including positioning signals, Wi-Fi networks, the mobile cell and the IP address, in order to identify inconsistencies and strengthen the assessment of the capture location.

The certificate does not claim to interpret every aspect of the photographed scene on its own. It does, however, provide a structured technical chain supporting the origin, integrity and creation context of the file. These findings can be combined with other documents, witness statements or observations to build particularly strong evidence.

Online capture is a condition of trust, not merely an operating constraint. A phone's local clock can be changed, so CertiPhoto relies on server-side references and a timestamp issued by a trusted authority, independently of the time displayed by the device.

Connectivity also makes it possible to check the account, available permissions and device-integrity signals in real time. Mechanisms such as Play Integrity, App Attest and DeviceCheck are specifically designed to be verified online when the evidence is being created.

Finally, the server issues single-use tokens, prevents their reuse and immediately records sensitive steps. Offline capture would introduce an uncontrolled interval between recording and the return of network access, during which the sequence of events could not be established with the same degree of confidence.

No, because importing an existing image would remove the most important parts of the chain of trust. A service may prove that a file was submitted at a certain time, but it cannot reliably determine when, where and with which device the photograph was actually taken.

Between the alleged capture and submission, the file may have been copied, edited, recompressed or stripped of metadata. Adding a submission date afterwards cannot reconstruct that period or retrospectively verify the state of the device.

CertiPhoto therefore requires direct capture inside the app, allowing integrity, location, time and uniqueness checks to take place at the relevant moment. An existing document would instead require a document-deposit service, whose evidential purpose is different from that of a photograph certified when it is created.

Yes. Video certification follows the same core principles as photography: recording inside the app, technical checks, computation of cryptographic fingerprints, processing traceability and production of a signed certificate.

The certificate contains the information required to identify the video precisely and verify that it has not been altered. Some real-time video features are reserved for authorised accounts because they require additional processing and checks. Credit usage depends on the selected mode and options.

The video file is retained for 90 days in order to control the storage volume associated with this format. The PDF/A-3B certificate, which contains the fingerprints and verification data, remains verifiable without a time limit even after the video retention period has expired.

Files are not placed in storage that is directly exposed to the public, nor are they indexed by search engines. They are accessed through the portal, the API or certificate-specific verification pages, depending on account permissions and the applicable sharing context.

Certificates are archived securely and redundantly across three data centres located in France, in accordance with NF Z42-013 and ISO 14641. Cryptographic fingerprints make it possible to verify that stored content still matches the certified file.

Photographs are retained for 3 years for individual accounts and 10 years for business accounts, subject to the terms of service. Videos are retained for 90 days. The PDF/A-3B certificate and its signature can nevertheless be verified without a time limit, provided that the document issued by CertiPhoto is retained.

An individual account is intended for personal use. Its holder directly manages credits, purchases and certificates through the app or portal. Photographs associated with this type of account are retained for 3 years.

A business account links users to a company. Credits can be shared, while administrators define quotas, assign roles and obtain a consolidated view of the certificates produced by their teams. Photograph retention is extended to 10 years.

Businesses can also use features adapted to their organisation, including centralised management, business billing, CertiLink links, secure API access and specific configuration. A request for business status is reviewed so that the company and its supporting documents can be verified.

CertiLink is a secure link designed to streamline selected business workflows. It can open the app with a prepared context, help connect to the appropriate account or provide parameters required for an operation without making the user enter them manually.

The API serves a different purpose: integrating CertiPhoto with a company's information system. In its current read-only version, it can retrieve photographs, videos, certificates and credit information, and return temporary links to authorised files.

API access is protected by a dedicated key and an allowlist of IP addresses or network ranges. Company administrators can rotate keys through the portal, and calls are logged to support monitoring, auditing and the detection of abnormal use.

Any certificate can be reported or disputed from its public page. The dispute is recorded and precisely identifies the document concerned, without silently altering the signed certificate that has already been issued to the parties.

CertiPhoto can then review cryptographic fingerprints, technical logs, available contextual data and the consistency of the certification process. Where necessary, the examination can be supplemented with forensic investigation tools and information supplied by the people involved.

If a serious anomaly or fraud is established, the certificate may be invalidated and its public status is updated. A dispute alone does not cause automatic revocation: it starts a review process designed to protect both the reliability of the service and the rights of each party.