Question 1

What does a provenance record prove?

Accepted Answer

That this exact content was made for a named person by a named agent, that the person approved it at a stated time, and that it has not changed since. It does not prove the content is correct. It says who to hold to it.

Question 2

Do I need an account to check a file?

Accepted Answer

No. Drop the file on this page, or run the open verifier from a shell. The keys and the log are public. Nothing but the record's id leaves your browser.

Question 3

Why not detect AI-written text instead?

Accepted Answer

Classifiers decay and text watermarks do not survive a paraphrase. Agents will write most documents, so the useful question is not whether AI was involved but who stands behind the result. A signed record answers that.

Question 4

What is in the record that anyone can read?

Accepted Answer

Only what the person agreed to publish: their name and email, the agent's kind and client name, the file's name and type, its hash and size, the time, the note, and the sources' names and hashes. Workspace, file and user ids and folder paths never enter the statement.

Question 5

Which files can be signed?

Accepted Answer

Any file in a workspace, or in a connected Google Drive, OneDrive, SharePoint or Dropbox, gets a registry record, certified where it lives. A PDF also carries the record inside it, bound to its bytes, so the file proves itself with no call to us; on a connected drive the platform's own version history keeps the bytes before. Notes and documents a platform renders on request (a Google Doc) have no fixed bytes: export them as a PDF first. Editable formats such as .docx are registered as they are.

Question 6

How is a signing approved?

Accepted Answer

The agent asks with the file's hash. The person's confirmation, in their assistant or in the app, is a decision about that content and nothing else. A file that changes between the ask and the signing is refused, not signed.

Question 7

What happens when a record is withdrawn or a person leaves?

Accepted Answer

A withdrawn record stays and says so, and the withdrawal is logged so it cannot be quietly undone. When a person erases their account their records are revoked and their name, email and the signature are cleared; a verifier is told revoked, never shown who.

Question 8

Why a public log?

Accepted Answer

A signature proves a record was not altered after we made it, not that we did not make it later or drop it. Every signing and revocation is a leaf of a Merkle log whose signed head is published. An entry inserted later, backdated or removed changes every head after it, and anyone who kept a head can tell.