Provenance API for the EU AI Act.
One API. Sign at capture or generation. Verify and recover anywhere. EU-hosted and C2PA-conformant.
Article 50(2) requires machine-readable marking.
From 2026-08-02, providers of AI systems that generate synthetic content must ensure their outputs are marked in a machine-readable format and detectable as artificially generated or manipulated under EU AI Act Article 50(2). The marking has to be readable by automated detectors and has to survive distribution. Inteqral signs, recovers, and verifies that marking through one API.
Article 50 applies from 2026-08-02. Under Article 111(4), added by Regulation (EU) 2026/1744, providers of AI systems, including general-purpose AI systems, that generate synthetic audio, image, video or text content and were placed on the market before 2026-08-02 must take the necessary steps to comply with Article 50(2) by 2026-12-02.
CA and Trust-Listed signing handled for you
Article 50(2) is technology-neutral: it does not prescribe C2PA, a CA relationship or HSM-backed keys. Inteqral implements a cryptographic provenance approach with a Trust-Listed certificate chain and signs every file inside an HSM partition. You call one endpoint.
Recovery after a platform strips the manifest
Most platforms remove C2PA on upload. Inteqral indexes each signed file by perceptual fingerprint and returns the original manifest for a stripped copy, making provenance recoverable even when the embedded manifest is removed.
A callable API over the C2PA specification
C2PA is published as an open specification. Inteqral exposes it as three endpoints with EUR billing, so a developer signs, recovers, and verifies provenance today.
Every C2PA verifier returns valid or invalid. We return the vector.
Article 50(2) requires outputs to be machine-readable and detectable, and the technical solution to meet its statutory performance criteria as far as technically feasible. We return origin, identity, and durability. The consumer runs its own policy. The same file passes or fails per buyer.
Same file, consumer policy
Three endpoints. One trust boundary.
Sign at capture or generation. Verify anywhere. Recover the original after a platform strips the manifest.
Attach a manifest
Attaches a C2PA manifest to any file. Signed inside the HSM partition.
Recover the original
Most platforms strip C2PA on upload. We match a stripped upload against a perceptual fingerprint and return the original manifest.
Manifest store indexed by perceptual fingerprintReturn the vector
Reads the manifest and returns a trust vector for origin, identity, and durability.
# sign a file at generation curl -X POST https://api.inteqral.com/sign \ -H "Authorization: Bearer $KEY" \ -F "[email protected]" \ -F "identity=x509" \ -F "durability=2" # verify anywhere and read the vector curl -X POST https://api.inteqral.com/verify -F "[email protected]" => { "o": 3, "i": 2, "d": 2 } // origin · identity (x509) · durability
A claims aggregator takes email, social X.509, Sumsub KYC, or an EUDI Wallet credential and emits an identity tier.
Every file is signed inside an EU-hosted HSM partition on a Trust-Listed certificate chain.
A manifest store indexed by perceptual fingerprint. pHash plus an ISCC-compatible learned embedding. Optional chain anchor.
One API. Usage-based plans.
Usage-based and EUR-denominated. One machine-readable marking workflow, one signed file, one fee.