PreVU Labs · London
Tessera stamps every file when it is made, so anyone can check later that it is real and has not been changed.
Live Technical Preview · C2PA 2.2Two things, and you need both
Tessera is a provenance system and an evidence layer. Not one with the other bolted on — they are the same machinery answering two different questions, and an organisation that has only one of them is exposed.
Provenance · is this file what it claims?
A signature bound to the content. One changed byte and verification fails, with a reason. This is the question a newsroom, a platform or a court asks about a single asset.
Evidence · can you show what you did?
A complete, dated, externally checkable record of the controls you had in place. This is the question a regulator or a prosecutor asks about your organisation — and under the UK offence, the burden of answering it is yours.
Neither substitutes for the other. Perfect provenance on every asset does not discharge a statutory defence you have to prove. A flawless compliance record does not tell a reader whether the photograph in front of them has been altered. Tessera was built for both because the same signed, hash-linked records serve both.
Why now
Anyone can generate a convincing image in seconds. The consequence is not only that fakes exist — it is that genuine things are no longer believed. A real photograph of a real event now carries the same burden of proof as a fabricated one, and the person who has to carry it is whoever is telling the truth.
Detecting fakes is a race nobody wins; the generators improve faster than the detectors. Proving originals is a different problem and it is tractable — because the original has something a fake never will: a verifiable record of where it came from.
And the same shift has put a second demand on you. Regulators have stopped asking whether you have a policy and started asking what you can show — in the UK's case, with the burden of proof reversed onto the defendant. That is why provenance and evidence arrive together rather than in sequence.
There is also a deadline, and for most organisations it has already passed. EU AI Act Article 50 has applied since 2 August 2026. The UK offence under section 66I of the Sexual Offences Act 2003 has been in force since 29 June 2026, carries a defence the defendant has to prove, and reaches UK-incorporated bodies for acts done abroad. The dates, the penalties and the statutory text →
How it works
Sign at the source
The moment content is captured or produced, Tessera attaches a cryptographic signature describing what it is and who stands behind it.
It travels with the file
The signature is recorded alongside the file and follows it. Sharing something does not strip its provenance.
Anyone can verify
A checker returns a plain answer — signed and unchanged, signed but altered since, or unsigned. No account, no trust in us required.
What is live today
Everything below runs end to end in the engine today and is covered by our automated verification suite.
| Capability | How it works |
|---|---|
| Ed25519 signing and key management | Cryptographic signatures bound to key pairs with zero vendor lock-in |
| Signed manifests bound to file content | Content-bound assertions embedded alongside or inside the asset |
| Tamper detection | One changed byte fails verification immediately, naming the exact reason |
| Hash-linked edit chains | Every crop, edit or transformation links to the prior state so removed steps show as a break |
| Article 50 AI-generated marking | Machine-readable synthetic media disclosures aligned with EU AI Act Article 50(2) |
| Perceptual hashing | Matches a re-encoded or transcoded asset back to its provenance record across platform pipelines |
| C2PA Content Credentials | Embedded directly in the asset, written and read through c2pa-rs (C2PA 2.2 reference implementation) |
| W3C Verifiable Credentials | VC Data Model 2.0 with DataIntegrityProof, verified in both directions |
| Inclusion proofs and compact offline receipts | ~800-character Merkle inclusion proofs verifiable offline without calling our servers |
Who it is for
Generative AI platforms
Your output is synthetic media. Article 50 lands squarely, and the UK offence reaches tools that can produce imagery of people.
Newsrooms and publishers
Provenance was already an editorial concern. The obligation formalises it.
Platforms carrying user content
Users upload synthetic content; the marking duty sits with you.
Public bodies
Expected to be exemplary, and answerable for how they know what they publish is genuine.
All ten sectors, with the obligation each one carries →
Built on standards, not on trusting us
Tessera uses open cryptographic signing. The site is served from Cloudflare Pages; nothing about a check depends on where we run. Verification does not depend on Tessera existing. The check is an Ed25519 signature over a content hash — anyone with the public key and a standard library can do it without us. A signature you can only check by asking one company is not proof; it is a subscription.
Join the list
One email when it opens. Nothing else, ever.