C2PA Content Provenance — Evidence & Transparency

This page publishes the real, independently-verifiable artifacts produced by VoiceSeal's C2PA marking-and-signing pipeline, with the current status stated plainly. Every technical claim below corresponds to the downloadable file it describes.

Artifacts generated 2026‑08‑01 · Production signature timestamp 2026‑08‑01T03:17:03Z (from the file itself).

✓ Current status — production signature, trust-list-recognized

The demonstrated signature is TRUSTED — PRODUCTION. The reference file below is signed by Trufo's production C2PA credential (common name Trufo Provenance Platform, issuer Trufo Inc.). A current C2PA validator reports validation_state: Trusted and signingCredential.trusted — the signing certificate chains to Trufo C2PA Root CA (2025, ECC P384), which is on the official C2PA Trust List.
Organization Validation (OV) is complete. Trufo Provenance Platform is listed as a Conformant generator product (assurance Level 1) on the official C2PA Conforming Products List (conformance dated 2026‑05‑08). Independently verifiable — see §4.
One honest caveat: the AI-disclosure is still generic. The signed file carries a c2pa.ai-disclosure assertion with the value {"modelType":"c2pa.types.model"}. It does not yet carry the specific IPTC trainedAlgorithmicMedia digital-source-type; that marker is being enabled with our signing provider and is not claimed here.

The trusted state below is the validator's own output, reproducible against the published official C2PA Trust List. We still do not claim trainedAlgorithmicMedia on a file that does not contain it. See the extracted manifest (§3) and validator output (§5) for the exact values.

1.What VoiceSeal does

VoiceSeal operates a post-synthesis marking gateway. Genuinely AI-generated audio produced by a third-party text-to-speech system is marked with an in-band C2PA manifest (embedded in the media file, not a sidecar) and signed via Trufo's production C2PA signing service — a Certificate Authority on the C2PA Trust List — including an RFC-3161 timestamp.

Marking is token-gated: a file can only be marked when its synthetic origin is established (a one-time synthesis-authorization token or an authenticated TTS integration). Arbitrary uploads cannot be marked.

VoiceSeal does not synthesize audio. It marks synthetic audio whose origin is established — it is a marking/attestation provider, not a generator. The reference audio below was generated by a third-party TTS system (ElevenLabs, model eleven_multilingual_v2) and then marked and signed through this gateway. The manifest additionally binds a ai.trufo.identity assertion naming the signing organization (VoiceSeal Inc).

2.Reference files (real, downloadable)

The exact files produced by the pipeline. Verify them yourself (§4).

REFERENCE_trufo_valid.wav VALID

158,840 bytes
sha256: 23c61535351d9faf43a69970c243cfc15bf02fa604af747f4a7f3bd30bf079cf

REFERENCE_trufo_tampered.wav INVALID

158,840 bytes (1 audio byte altered)
sha256: 4d9eb35139f31bf206c182bb9594dfb31d210227cd190c4673dfb7b054fa997a

The tampered file is byte-identical to the valid file except for a single altered audio sample, to demonstrate that the C2PA hard binding detects content modification (§5).

3.Extracted manifest (from the valid file, unredacted)

Key fields from the signed manifest of REFERENCE_trufo_valid.wav:

Signer issuer	Trufo Inc.
Signer common name	Trufo Provenance Platform — production credential (no `[TESTING]`)
Certificate chain root	Trufo C2PA Root CA (2025, ECC P384) — on the official C2PA Trust List
Signature algorithm	Es256
Certificate serial	53339682414300024441855619143613286882448089227
Timestamp (RFC-3161)	2026-08-01T03:17:03+00:00 — Trufo Timestamp Service (2025)
Organization identity	ai.trufo.identity = {"orgName":"VoiceSeal Inc"}
AI-disclosure assertion	c2pa.ai-disclosure = {"modelType":"c2pa.types.model"} (generic — not trainedAlgorithmicMedia)
Trust state	signingCredential.trusted
Overall validation	Trusted

The complete manifest as emitted by the current C2PA validator (c2pa-rs 0.90.1), validated against the official C2PA Trust List and published in full — including the signingCredential.trusted success and the (still generic) c2pa.ai-disclosure:

{
  "active_manifest": "urn:c2pa:381fdc93-02d2-4d84-aca7-e52af115563d",
  "manifests": {
    "urn:c2pa:381fdc93-02d2-4d84-aca7-e52af115563d": {
      "claim_generator_info": [
        {
          "name": "Trufo Provenance Service",
          "version": "1.0",
          "operating_system": "Amazon Linux 2023",
          "org.contentauth.c2pa_rs": "0.90.3+trufo"
        }
      ],
      "title": "AI-generated audio",
      "instance_id": "xmp:iid:4c27e948-46db-44f4-85c1-b4b86ab3eadb",
      "ingredients": [
        {
          "title": "input.wav",
          "format": "audio/wav",
          "instance_id": "xmp:iid:193bcbae-36ee-4c6e-92a1-07c639ff7190",
          "relationship": "parentOf",
          "label": "c2pa.ingredient.v3"
        }
      ],
      "assertions": [
        {
          "label": "c2pa.actions.v2",
          "data": {
            "actions": [
              {
                "action": "c2pa.opened",
                "parameters": {
                  "ingredients": [
                    {
                      "url": "self#jumbf=c2pa.assertions/c2pa.ingredient.v3",
                      "hash": "7Rato/fAckRHSy1srIBVUg45wU9w3cNFtb9sXBrn1KA="
                    }
                  ]
                }
              }
            ],
            "allActionsIncluded": true
          },
          "created": true
        },
        {
          "label": "ai.trufo.identity",
          "data": {
            "oid": "org_019faf40-dc88-78f1-ac38-613d4dadff1b",
            "orgName": "VoiceSeal Inc"
          },
          "created": true
        },
        {
          "label": "c2pa.ai-disclosure",
          "data": {
            "modelType": "c2pa.types.model"
          }
        }
      ],
      "signature_info": {
        "alg": "Es256",
        "issuer": "Trufo Inc.",
        "common_name": "Trufo Provenance Platform",
        "cert_serial_number": "53339682414300024441855619143613286882448089227",
        "time": "2026-08-01T03:17:03+00:00"
      },
      "label": "urn:c2pa:381fdc93-02d2-4d84-aca7-e52af115563d",
      "claim_version": 2
    }
  },
  "validation_results": {
    "activeManifest": {
      "success": [
        {
          "code": "timeStamp.validated",
          "url": "self#jumbf=/c2pa/urn:c2pa:381fdc93-02d2-4d84-aca7-e52af115563d/c2pa.signature",
          "explanation": "timestamp message digest matched: Trufo Timestamp Service (2025)"
        },
        {
          "code": "timeStamp.trusted",
          "url": "self#jumbf=/c2pa/urn:c2pa:381fdc93-02d2-4d84-aca7-e52af115563d/c2pa.signature",
          "explanation": "timestamp cert trusted: Trufo Timestamp Service (2025)"
        },
        {
          "code": "signingCredential.trusted",
          "url": "self#jumbf=/c2pa/urn:c2pa:381fdc93-02d2-4d84-aca7-e52af115563d/c2pa.signature",
          "explanation": "signing certificate trusted, found in System trust anchors"
        },
        {
          "code": "claimSignature.insideValidity",
          "url": "self#jumbf=/c2pa/urn:c2pa:381fdc93-02d2-4d84-aca7-e52af115563d/c2pa.signature",
          "explanation": "claim signature valid"
        },
        {
          "code": "claimSignature.validated",
          "url": "self#jumbf=/c2pa/urn:c2pa:381fdc93-02d2-4d84-aca7-e52af115563d/c2pa.signature",
          "explanation": "claim signature valid"
        },
        {
          "code": "assertion.hashedURI.match",
          "url": "self#jumbf=/c2pa/urn:c2pa:381fdc93-02d2-4d84-aca7-e52af115563d/c2pa.assertions/c2pa.ingredient.v3",
          "explanation": "hashed uri matched: self#jumbf=c2pa.assertions/c2pa.ingredient.v3"
        },
        {
          "code": "assertion.hashedURI.match",
          "url": "self#jumbf=/c2pa/urn:c2pa:381fdc93-02d2-4d84-aca7-e52af115563d/c2pa.assertions/c2pa.actions.v2",
          "explanation": "hashed uri matched: self#jumbf=c2pa.assertions/c2pa.actions.v2"
        },
        {
          "code": "assertion.hashedURI.match",
          "url": "self#jumbf=/c2pa/urn:c2pa:381fdc93-02d2-4d84-aca7-e52af115563d/c2pa.assertions/ai.trufo.identity",
          "explanation": "hashed uri matched: self#jumbf=c2pa.assertions/ai.trufo.identity"
        },
        {
          "code": "assertion.hashedURI.match",
          "url": "self#jumbf=/c2pa/urn:c2pa:381fdc93-02d2-4d84-aca7-e52af115563d/c2pa.assertions/c2pa.hash.data",
          "explanation": "hashed uri matched: self#jumbf=c2pa.assertions/c2pa.hash.data"
        },
        {
          "code": "assertion.hashedURI.match",
          "url": "self#jumbf=/c2pa/urn:c2pa:381fdc93-02d2-4d84-aca7-e52af115563d/c2pa.assertions/c2pa.ai-disclosure",
          "explanation": "hashed uri matched: self#jumbf=c2pa.assertions/c2pa.ai-disclosure"
        },
        {
          "code": "assertion.dataHash.match",
          "url": "self#jumbf=/c2pa/urn:c2pa:381fdc93-02d2-4d84-aca7-e52af115563d/c2pa.assertions/c2pa.hash.data",
          "explanation": "data hash valid"
        }
      ],
      "informational": [],
      "failure": []
    },
    "ingredientDeltas": [
      {
        "ingredientAssertionURI": "self#jumbf=/c2pa/urn:c2pa:381fdc93-02d2-4d84-aca7-e52af115563d/c2pa.assertions/c2pa.ingredient.v3",
        "validationDeltas": {
          "success": [],
          "informational": [
            {
              "code": "ingredient.unknownProvenance",
              "url": "self#jumbf=/c2pa/urn:c2pa:381fdc93-02d2-4d84-aca7-e52af115563d/c2pa.assertions/c2pa.ingredient.v3",
              "explanation": "input.wav: ingredient does not have provenance"
            }
          ],
          "failure": []
        }
      }
    ]
  },
  "validation_state": "Trusted"
}

Also downloadable: manifest_valid.json (the exact JSON above).

4.Verify it yourself

Use the official C2PA command-line tool, c2patool. A current validator is required — Trufo's claims use a recent C2PA claim format, so validate with c2pa-rs 0.90 or newer (recent c2patool releases; older versions may not decode the claim).

# Read + validate the signed manifest, checking the trust list
c2patool REFERENCE_trufo_valid.wav

# The valid file reports validation_state: Trusted,
#   signer "Trufo Inc." (Trufo Provenance Platform),
#   with signingCredential.trusted (chains to Trufo C2PA Root CA 2025,
#   which is on the official C2PA Trust List).

# Now validate the tampered copy
c2patool REFERENCE_trufo_tampered.wav

# The tampered file reports validation_state: Invalid,
#   with assertion.dataHash.mismatch ("Hashes do not match").

Independent, third-party confirmation of the signer's trust status:

C2PA Conforming Products List — official list (browse via the C2PA Conformance Explorer): search Trufo Provenance Platform — status conformant, generator product, assurance Level 1.
C2PA Trust List — official trust anchors: contains Trufo C2PA Root CA (2025, ECC P384), the root this file's certificate chains to.
Adobe Content Credentials Verify — contentcredentials.org/verify: drag in REFERENCE_trufo_valid.wav; the signer is recognized (no "Unknown/Unrecognized source" warning).

5.Validation output (real, from our run)

Validated with c2pa-rs 0.90.1, verify-trust enabled against the official C2PA Trust List, on the two files above:

REFERENCE_trufo_valid.wav — Trusted

✓ validation_state: Trusted
✓ signingCredential.trusted — signing certificate found in the C2PA trust anchors
✓ claimSignature.validated — claim signature valid
✓ timeStamp.trusted / timeStamp.validated — Trufo Timestamp Service (2025)
✓ assertion.dataHash.match — data hash valid (content intact)

REFERENCE_trufo_tampered.wav — Invalid

✗ validation_state: Invalid
✗ assertion.dataHash.mismatch — "asset hash error … Hashes do not match"
✓ signingCredential.trusted — (same production cert; the signature itself is still trusted, but the content no longer matches the hard binding)

The single altered audio byte flips the file from Trusted to Invalid — demonstrating the tamper-evidence of the in-band hard binding.

6.Limitations (stated plainly)

C2PA metadata is cryptographically bound and tamper-evident, but it is not indestructible: downstream transcoding, re-encoding, or deliberate metadata stripping can detach the credential from the media. C2PA detects tampering of a credentialed file; it cannot prevent removal of the credential.
The AI-disclosure is currently generic ({"modelType":"c2pa.types.model"}); the specific IPTC trainedAlgorithmicMedia source-type is not yet present and is being enabled with our signing provider. We do not claim that marker on this file.
Trust-list recognition reflects the signer (Trufo's production C2PA credential) being on the official C2PA Trust List; it attests who signed and that the content is intact, not any judgement about the audio's content beyond the assertions it carries.
VoiceSeal maintains voiceprint fingerprinting and audit records as supplementary layers. These are not presented as a substitute for the mandatory in-band marking.
We are not presenting watermarking as a functioning control here. Our in-band, signed C2PA manifest is the marking mechanism described on this page.

This page is maintained as a factual record. The signature is now production-scope and trust-list-recognized; the remaining open item is the specific trainedAlgorithmicMedia disclosure, which is being enabled with our signing provider. When it is present, the reference files, manifest, and status above will be updated to match, and this notice revised. Until then, the status is exactly as stated.