Trust Centre
University IT, data protection and procurement find the basis for their review here. Statements are limited to what is evidenced; open points are marked as open.
Writing sessions and the local journal. The journal holds process data, but no manuscript text, no typed characters and no clipboard contents. Input verification uses key and timing information only transiently in limited memory. The record stays on the device until you share it.
Only what you share: the record and the file, by email or portal. With Moodle this happens only after you confirm recipient, course and activity. In Word, a full DOCX copy is passed to the local ExtraProof service on the same device.
From Verify, nothing: files are processed in the browser’s memory. Through the contact form, we receive the information you enter and submit there. Only if you activate or request the optional service receipts in the app are the details shown there transmitted. For a pilot, recipients, responsibilities, access, storage and deletion are documented in writing beforehand.
Whether record and signature are unchanged, whether the file matches the bound version, which observation gaps exist and which level was actually achieved, also offline. Not verifiable: a person’s identity, the truth of all events and the origin of thoughts.
Word, a writing app or another supported tool. The manuscript stays there.
On the deviceCaptures permitted process data and processes it locally. No manuscript text in the journal.
Local processingSigned, bound to the file version and stored locally.
Signed recordYou share record and file, or confirm a Moodle submission.
InstitutionRecipients verify in their own browser. No transfer to Extraara.
Local verificationSteps 1 to 3 take place on your device. From step 4, only what you initiate happens.
Exceptions are named, not left out: Word passes a DOCX copy to the local service, and with Moodle the document and record go to the confirmed institution. Metadata can be personal data even when processing is local.
Before every pilot we define and document the following in writing for the specific environment:
Fixed values for hosting, retention and subprocessors are not yet published. We state no values that are not confirmed. We make no blanket GDPR compliance claim; it is assessed with your data protection office for the specific environment.
Extraara is a member of the Content Authenticity Initiative.
ExtraProof is being developed for interoperability with C2PA Content Credentials and open provenance infrastructure.
About the CAI
What verification establishes, how keys are assessed and what it does not establish.
Which data stays where and when it is shared.
Which attacks and actions remain possible.
Levels L1 to L5, requested and achieved.
Verify records locally in the browser, without an account.
Report security issues: contact, process, scope.
Target standard, state of implementation, known limitations.
How this website handles files and contact details.
Process, roles and evaluation questions of a pilot.
What a controlled environment would require.
C2PA interoperability in development
Standards and trust