User Guide

🔒 What is VerityRecord?

VerityRecord is a digital evidence platform that creates cryptographically sealed, timestamped records of your files and web content. It proves that specific content existed at a specific point in time, without the possibility of retroactive modification.

Key Terms

How It Works

🚀 Getting Started

Creating an Account

Sign up with your Google account or email address. No credit card is required. New accounts receive 50 starter credits to try the platform (25 after email verification + 25 SMS bonus).

Dashboard

After signing in, your dashboard shows:

• Credit balance — your remaining seal credits
• Recent bags — quick access to your latest records
• Quick actions — create a new bag, verify a document, or buy credits

💼 Creating a Bag

A bag is a container that holds one or more files and/or web links. Think of it as a sealed envelope for digital content.

1. Click "Upload & Seal" from the navigation or dashboard.
2. Give your bag a descriptive name (e.g., "Contract Draft - March 2026").
3. Add files by dragging and dropping, clicking the upload area, or pasting from clipboard.
4. Add web links by entering a URL in the link input field.

Limits

📄 Adding Files & Links

Files

You can add files in several ways:

• Drag & drop — drag files or entire folders onto the upload area
• File picker — click the upload area to browse your computer
• Clipboard paste — paste screenshots or copied files with Ctrl+V / Cmd+V

Supported file types include: images, videos, audio, documents, spreadsheets, 3D/CAD models, source code, AI/ML models, medical imaging (DICOM), BIM/architecture (IFC), scientific data, financial formats, geographic/GIS, network/security forensics, email, calendar, and web links — 327 file extensions across 22 content categories.

Web Links

Enter any URL to capture a web page as evidence. VerityRecord will:

1. Fetch the page content (HTML)
2. Generate a PDF snapshot of the page
3. Extract metadata (title, description, images)
4. Record HTTP headers, DNS, and TLS certificate information
5. Calculate a cryptographic hash of all captured data

This creates a comprehensive evidence package that proves the web page existed with that exact content at the time of capture.

🔒 Sealing Your Bag

Sealing is the core action that transforms your bag into a permanently locked, independently verifiable record. Once sealed, the contents can no longer be changed. Anyone who verifies the record can confirm it is exactly as it was at the moment of sealing.

What Happens During Sealing

1. Hash calculation — each file gets a unique SHA3-256 hash
2. Merkle tree — all file hashes are combined into a single root hash using a Binary Merkle Tree
3. Timestamp — an independent timestamp is obtained from DigiCert (RFC 3161)
4. Receipt — a signed receipt is generated containing all proof data
5. Transparency log — the seal is appended to a public, append-only ledger

Cost

Sealing costs 1 credit per item — each file and each captured link counts as one item. A bag with 4 files and 1 link costs 5 credits. Credits are deducted at seal time. If sealing fails for any reason, credits are automatically refunded.

📜 Understanding the Certificate

After sealing, a certificate page is generated that contains:

• Seal summary — the Merkle root hash and the independent seal timestamp
• File list — all files with their individual hashes, sizes, and types
• Proof chain — Merkle root, TSA token, receipt signature
• QR code — links directly to the verification page
• File previews — images, PDFs, videos, audio, and documents can be viewed inline

Certificate Chain & Transparency

Each certificate includes a verifiable chain of custody:

• Previous seal hash — per-user chain link (prev_seal_hash) so each new seal is anchored to your previous one
• Ed25519 digital signature — signed receipt with public key fingerprint (RFC 8032)
• Transparency log — log_index, leaf_hash, chain_hash, plus a daily Merkle root published at /transparency

Downloading

From the certificate page, you can:

• Download PDF certificate — A4 document with QR code and proof details
• Download bag archive — all original files plus the certificate PDF and evidence package
• Download evidence package — manifest.json + receipt.json + signature.txt + Proof_Methodology.html + offline verify.html (verifies the seal in your browser, no server needed). For link captures it also contains per-link evidence.json + evidence_manifest.json files that bind each captured artifact to the seal
• BagIt format (RFC 8493) — alternative archive layout for archival/forensic workflows. Append ?format=bagit to download endpoints.

🔗 Sharing & Access Control

Sealed bags can be shared with granular access controls:

Share Links

Each bag has at most one active share link at a time. Create it with optional restrictions:

Single-View

Generate a single-use link that is consumed after the first successful view. The bag content itself is not deleted — only the link burns. To permanently destroy content after one view, use a Burn Bag instead (see Key Terms).

• Enabled with a single click plus a confirmation dialog; once the link is used, it cannot be reopened
• The link is internally locked to a single successful view
• The first opener sees the content; everyone else (including the same viewer reopening) gets a “viewed · used” message
• The owner is notified when the link is used and by whom (the viewer’s account, or “anonymous”) — no raw IP address is ever stored
• The cryptographic proof (receipt, hash, timestamp) and the bag content remain intact for the owner — only the share link is consumed

Time Lock (Embargo / Visible-From)

Schedule a sealed bag to become viewable only at a future date — the certificate exists immediately and is timestamped, but the file contents stay locked until the embargo lifts.

• Visible from — ISO date when content becomes viewable
• Visible until — optional end date

Email Sharing

Send the certificate link directly via email to up to 5 recipients at once. Each recipient gets a personalized email with the certificate link and bag summary.

QR Code

Every sealed bag gets a QR code that links to the public verification page. Download or copy it for physical documents, presentations, or printed materials.

Share Activity

Share Activity lives inside My Bags: turn on the Sharing filter and pick a bag — the panel tells the bag's whole story (created → sealed → link shared → opens → link closed). Access is counted, not identified: who opened is never recorded or shown — you see opens, unique visitors and downloads as day-level counts. No member identity, no city, no device details; raw IP addresses are never stored.

✅ Verification

Anyone can verify a sealed record without an account. Verification confirms:

• The content has not been modified since sealing
• The timestamp is authentic (independently issued by a trusted TSA)
• The Merkle root matches the individual file hashes

How to Verify

1. By link — open the certificate URL or scan the QR code
2. By document code — enter the document code (XXXX-XXXX-XXXX) or paste the certificate link on the verification page
3. Offline (no internet) — open /verify-offline and drop the evidence package ZIP. The page does everything in the browser, with zero network calls. Useful when our servers are unreachable, or for air-gapped forensic workflows.

Transparency Log & Status

Two public pages let anyone audit the platform without an account:

• /transparency — append-only ledger of every seal entry plus daily heartbeat signals
• /status — system uptime, recent incidents, and live availability bars

API Verification

Developers can verify records programmatically using the free-tier API:

Every public certificate page also includes a “Report content” link — anyone can report abusive or illegal content (with category selection); reports are reviewed and can lead to content takedown while the cryptographic trail stays intact.

🔐 Encryption

For sensitive documents, you can encrypt your bag before sealing using zero-knowledge encryption:

• Encryption uses AES-256-GCM
• The encryption key is derived from your password — VerityRecord never sees or stores it
• Encrypted files can only be decrypted by someone who knows the password
• The cryptographic proof (hashes, timestamps) remains verifiable even without the password
• Files you upload are encrypted before they are uploaded — not even VerityRecord can access the original content (evidence captures of the links you add are produced at capture time and then encrypted)
• Changes to an encrypted bag (e.g. creating a share link) require a short-lived vault session — you re-enter the bag password to prove you hold the key

How It Works

1. During the seal confirmation, toggle the "Encrypt bag" option
2. Enter a password — no minimum length is enforced; the choice is yours. A strength meter and an honest warning are shown: because the encrypted data is downloadable by anyone holding the link, a weak password can be cracked by offline guessing — 12+ characters are strongly recommended
3. Each file's SHA3-256 digest is computed on the original content, then the file is encrypted client-side with AES-256-GCM before upload
4. To view file contents later, the password must be entered on the certificate page

Technical Parameters

💰 Credits & Pricing

VerityRecord uses a simple credit system:

Credits do not expire and are not subscription-based. Volume discounts apply automatically along a continuous curve (formula: price = $0.80 × (25/qty)0.25, floor $0.15):

📄 Supported File Types

VerityRecord supports 327 file extensions across 22 content categories (17 file categories plus link-capture categories). Every format receives full cryptographic hashing (SHA3-256), timestamping, and integrity verification; most formats also get an inline browser preview — 40 of them cannot be previewed and are kept as a downloadable evidence archive instead. Being listed here means the format is accepted and sealed, not that it can be displayed.

This table names common uses, not file extensions — entries like Helm, Sigma or FHIR refer to formats whose files carry a supported extension (.yaml, .json, .rules…). The authoritative, machine-generated extension list is below.

🌐 Link Capture

When you add a web link, VerityRecord captures comprehensive evidence:

• HTML snapshot — the full page source code
• PDF rendering — a visual snapshot of the page as it appeared. Capture runs on a bounded time budget (finalized by ~120 seconds even on slow pages) and always aims to produce a PDF
• Screenshot — fallback visual record when a PDF cannot be produced (on some specialized platforms the structured capture takes its place)
• HTTP metadata — response headers, DNS records, TLS certificate details, redirect chain
• Structured data — platform-specific metadata (prices, reviews, engagement metrics)

Specialized Platforms

VerityRecord has specialized parsers for 26+ platforms (and growing) including:

• Social media — YouTube, Twitter/X, Instagram, TikTok, LinkedIn, Facebook, Reddit, Pinterest
• Audio / video — Spotify, Vimeo, SoundCloud, Twitch, IMDb
• E-commerce — Amazon, eBay, AliExpress, Trendyol, Hepsiburada
• Classifieds & real estate — Craigslist, Sahibinden, Zillow
• Knowledge / dev — Wikipedia, GitHub, Stack Overflow, Medium, Ekşi Sözlük

Capture Abuse-Prevention Guards

To keep capture infrastructure healthy, the platform applies automatic limits:

🤖 Smart Features

Automatic Tagging

When you upload a file, VerityRecord automatically analyzes the filename, file type, and extension to assign relevant tags. This helps you organize and identify files at a glance.

Tags appear as small chips on each file in the file list. No AI or external service is used — tagging is rule-based and runs entirely on the server at upload time.

Link Monitoring

Automatic re-checking of captured links is currently not available — the feature is built but disabled until it meets our reliability bar. Every capture is a single point-in-time record; to document a page again, simply capture it again in a new bag.

Duplicate Detection

If you add a file that already exists in the same bag (matched by name, size and a quick content hash), you'll see a warning to avoid accidental duplicates.

📱 Apps & Platforms

VerityRecord is available on multiple platforms:

PWA & Offline

The web app can be installed on your device from the browser. Once installed, it works offline for viewing cached content. The Service Worker caches essential assets and provides an offline fallback page.

🔔 Notifications

VerityRecord sends push notifications to keep you informed about your records:

• Seal completed — when your bag is successfully sealed
• Share activity — when someone views or downloads your shared certificate
• Draft expiry warning — reminder before an unsealed draft is auto-deleted
• Credit alerts — low balance and purchase confirmations

Notifications are delivered via browser push (Web), native push (Android), and email (for critical events). You can customize notification preferences from /account > Notification Settings.

🛡 Security & Cryptography

Why These Standards Matter

Backup & Disaster Recovery

Operational resilience:

• Daily Firestore backups exported to Google Cloud Storage at 03:30 UTC. 30-day retention with automatic cleanup.
• Restore rehearsal procedure documented in the ops runbook (verify-restore.mjs script validates collection counts and key fields after restore).
• Independent verification — even if VerityRecord went permanently offline, every evidence package can still be verified using only standard cryptographic tools and the published TSA / Ed25519 / SHA3 standards.

📅 Data Retention

❓ Frequently Asked Questions