It used to be enough to ask whether an image looked right. Today, with generative AI and easy-to-use editing tools, a convincing image proves very little. The more useful question is: can we show where this image came from, and what happened to it along the way?

Content Authenticity is about answering that question. This article explains the main ideas behind Content Authenticity, what Content Credentials are, what they can and cannot tell you, and how Content Authenticity works in Fotoware Veloz.

If you are ready to set up the feature, see Content Authenticity archive settings.

Why Content Authenticity matters

Traditional metadata, such as IPTC and Exif, is useful but easy to change. It can be edited, removed, or made up, and many platforms strip it when files are uploaded. A credit line or a trusted logo is no longer enough to prove where an image came from.

Organizations that publish images are increasingly expected to document the history of their content and be able to back up that documentation when someone asks. Regulation is moving in the same direction. For example, the EU AI Act requires AI-generated and AI-modified content to be clearly labeled.

Content Authenticity gives you a standardized, verifiable way to document the origin and history of your assets.

Key terms

Several terms in this area are often used interchangeably, but they mean different things:

• Content authenticity: The general idea that you should be able to establish where a piece of media came from and what has happened to it.
• C2PA: The open technical standard that makes this possible. C2PA is also the name of the organization that maintains the standard, the Coalition for Content Provenance and Authenticity. Because the standard is open, any compliant tool can read the information.
• Content provenance: The documented history of an asset: where it came from, which tools were used on it, what was changed, and whether AI was involved. 
• Content Credentials: The signed record that carries the provenance information inside the file. Some websites and platforms show a small CR (Content Credentials) icon to indicate that an image has Content Credentials you can inspect.
  
• Manifest: The technical term in the C2PA standard for a single Content Credentials record.
• Content Authenticity Initiative (CAI): A community of organizations that promotes the adoption of the C2PA standard. Fotoware has been a member since 2023.

How Content Credentials work

Content Credentials are created by C2PA-enabled devices and software, such as compatible cameras, editing applications, and AI tools.

1. The record is created. When a C2PA-enabled camera captures a photo, or an AI tool generates an image, the device or software adds a record to the file. The record contains statements about the asset, for example, the device or application used, the date, and whether AI was involved.
2. The record is signed. The record is sealed with a digital signature based on a certificate, similar to how a secure (HTTPS) website is signed. The signature shows who issued the record and makes any later change to the file or its history detectable.
3. The history grows. When the asset is edited in another C2PA-enabled tool, that tool adds a new signed step to the record instead of replacing the existing one. Over time, this builds up a history of the asset. If an asset is created by combining several images, the record can include each original image and its own history.
4. The record is validated. Any C2PA-compliant tool can read the record and check two things: whether the record is intact and still matches the file, and whether the signature comes from a recognized issuer.

What Content Credentials can and cannot tell you

Content Credentials give you verifiable facts about an asset, but it is up to you to judge what those facts mean.

Content Credentials can tell you:

• Who issued the credentials, and with which application or device
• When the content was created or changed
• Which changes were recorded, such as crops or color adjustments
• Whether AI was involved, if this was recorded
• Whether the file or its record has changed since it was signed

Content Credentials cannot tell you whether an image is true or accurate. Keep in mind:

• Valid credentials are not a seal of approval. A heavily edited image can have valid credentials, because the credentials record the edits rather than prevent them. An AI-generated image from a tool that signs its output also has Content Credentials, and the record says that AI was used.
• Missing credentials do not mean an image is fake. Most images, including almost all photos taken before the standard existed, have no Content Credentials. The absence of credentials proves nothing either way.
• The CR icon is shown by the platform, not the file. Whether the icon is displayed depends on the website or platform showing the image. An image can have Content Credentials even if no icon is shown.

Why Content Credentials get lost

Content Credentials are only useful if they stay attached to the file. On its way from the camera to the reader, an image can pass through many systems and be copied many times, and every step is an opportunity for the record to be lost. For example:

• On upload: Systems that convert or re-encode files upon arrival can remove the record before anyone has worked on the image.
• During editing: If an image is cropped or adjusted in a tool that does not support C2PA, the change is not recorded, or the record is removed altogether.
• When adding metadata: If a captioning tool does not support C2PA, the caption and credit are retained, but the signed record may be lost. The image appears well documented even though its verifiable history is gone.
• On export and publishing: Renditions for print, web, and social media are often created without the record, and many platforms remove embedded metadata on upload.

It takes only one break in the chain for the provenance of an image to become impossible to prove. Because a Digital Asset Management (DAM) system stores and manages images throughout their lifecycle, it plays a key role in keeping Content Credentials visible and usable.

Content Authenticity in Fotoware Veloz

When Content Authenticity is enabled for an archive, Fotoware Veloz reads the Content Credentials of assets as they are uploaded, validates them, and makes the information available where you work.

Content Authenticity features are available in both the Main and Pro interfaces, although some features are accessed differently in each interface.

• Check credential status at a glance. Each asset is checked for Content Credentials, and the result is shown as one of the following statuses: Valid credentials, Unrecognized signature, Invalid manifest, Tampered or Missing credentials.
• See AI involvement and camera origin. Optional markers show which assets have Content Credentials indicating AI-generated content, and which were captured with a camera.
• Filter assets. Content Authenticity filters let you find or exclude assets based on credential status, AI-generated content, and origin. For example, you can show only assets with valid credentials that were captured with a camera.
• Inspect the full history. You can view a summary of an asset's Content Credentials and explore its provenance graph, a visual overview of how the asset was created and changed before it was uploaded. You can also download the raw manifest.
• Control who sees what. Administrators decide per archive which users and groups can view a summary of Content Credentials and which can view the full details.

Content Credentials are displayed only for assets uploaded after Content Authenticity is enabled for the archive.

Next steps

• Content Authenticity archive settings
• Viewing Content Credentials and provenance
• Filtering assets using Content Authenticity information

Further reading

• What is C2PA? A Guide to Content Credentials and Content Provenance
• Content authenticity & C2PA support in Fotoware DAM
• C2PA Technical Specification