How it works

Three mechanisms, each designed so the guarantee holds without anyone being asked to take PROV's word for it.

Part one

Establishing that you are a person

Proving personhood online is hard because every cheap signal can be bought. Phone numbers, email addresses and payment cards are all available in bulk. Anything that can be purchased at scale cannot establish that a human exists.

PROV uses a ladder. Each rung costs more to fake than the one below it, and the rungs that matter cannot be reached without a body in a room.

Level 1
GuestAn ordinary account. Email, password, and the biometric your phone already uses to unlock itself. You can read, follow and take part. You cannot vouch for anyone else.
Level 2
Verified humanReached through a period of camera-direct posting — short pieces captured in the app rather than uploaded from the camera roll. The capture path is what carries the weight: the content is hashed as it is recorded.
Level 3
Attested humanReached in person. Existing attested members confirm you exist by meeting you and tapping phones. Only at this level can an account vouch for others, take part in dispute resolution, or move money out of the platform.

The economics are the point. An attacker who wants a thousand Level 3 accounts needs a thousand bodies attending real events and being physically confirmed by people who already have standing to lose.

Part two

Declaring where a work came from

Generated media is not going away and PROV does not treat it as illegitimate. What it does not accept is generated media presented as a camera recording.

Every published work carries a declaration, written to the ledger when it is published and permanently attached to it:

Raw
Captured by a camera. Not generated, not substantially altered.
Tuned
Captured, then adjusted — colour, trimming, correction. The subject matter is as recorded.
Spliced
Combines captured and generated material.
Synthed
Produced by a model.

The declaration is the creator's, and it is permanent. Editing a work does not reset it — amendments append to the record rather than replacing it, so the history of a piece stays legible.

A viewer can therefore ask what something is and get an answer that was recorded at publication, not inferred afterwards by a classifier.

Part three

Who holds the keys, and who holds the files

Keys. Your signing key is generated in your phone's secure hardware and never leaves it. Publishing requires that key, released by the phone's own biometric. PROV cannot sign on your behalf, because PROV does not have your key.

Recovery. Losing a phone is survivable without a central authority handing your identity back. Recovery proves you are the same human through the record you have already built, and reputation follows the person through it. There is no clean-slate button.

Files. Content is distributed across a network of operator-run machines rather than held solely in one company's data centre. The governing constraint on the design is that it depends on no third-party infrastructure beyond user-owned devices and internet connections, with narrow documented exceptions for payment processing and identity verification.

Questions?

This page describes the design rather than a finished product. If you want the detail behind any part of it, write to us.