Security you can verify, not just believe.
Provena protects evidence with architecture, not promises. This page documents how the platform is built — and because every record is independently verifiable, the strongest security claim we make is one you can check yourself.
Six layers, each verifiable.
- 1 · Controlled runtime
- Capture happens in a dedicated remote environment operated by the platform, with a server-enforced interaction policy — not on the operator’s machine, where it could be staged.
- 2 · Preserved platform records
- Session context, actions, network activity, and server identity are recorded as the work happens — never reconstructed afterwards.
- 3 · Cryptographic integrity
- Every file is hashed with SHA-512 at origin and verified again at storage. Any later change is demonstrable, not debatable.
- 4 · Custody continuity
- Every event carries its own hash and the hash of the previous event. Modification, deletion, reordering, and insertion are detectable on verification.
- 5 · Sealed canonical state
- The package seal fixes the evidence set; the custody seal fixes the recorded chain. After sealing, the record has a single number the whole history must answer to.
- 6 · Independent external proof
- Fingerprints are registered with timestamp authorities and public networks that operate outside Provena — references that remain checkable even without us.
Isolation by disposal.
Every capture session runs in its own dedicated, containerized worker, allocated on demand and destroyed at teardown — with the allocation and destruction recorded as custody events. Sessions never share an environment, and nothing survives between them to clean up.
- One worker per session, never reused — contamination between sessions is prevented structurally, not procedurally.
- A locked-down interaction surface: system shortcuts, devtools, and the context menu are refused server-side; navigation is restricted to http and https.
- Service-to-service authentication with declarative endpoint rules and a closed-by-default fallback for internal platform calls.
- Client IP custody tracking with anti-spoofing propagation at the gateway, so access events name their real origin.
Alterations are not forbidden by policy. They are visible by construction.
- Hashing detects content change: a single altered byte in any preserved file produces a different SHA-512 fingerprint.
- The custody chain detects history change: inserting, removing, or reordering events breaks the hash links between them.
- Sealing detects set change: the package and custody seals fix the record as a whole; anything added or removed afterwards fails verification.
- External proofs detect backdating: independent timestamp references make it impossible to quietly move a record earlier in time.
Detection can be performed by reviewers outside Provena — in the browser, or fully offline with the custody export and standard tools.
Private evidence, public proof.
- Only fingerprints are registered externally — evidence content never leaves the platform for anchoring, and a hash reveals nothing about what it identifies.
- Public file checks compute the hash locally in the reviewer’s browser; the file itself is never uploaded.
- Access is a recorded event: report views, package downloads, and public checks become part of the custody trail after sealing.
- Retention and deletion are controlled workflows — with the deletion itself recorded, and third-party personal data redacted from public report views.
The strongest claim is the one you can check.
Security questionnaires and architecture reviews are welcome — and every Provena record gives you a way to test our claims directly.