What is Chain of Custody?
In evidence handling, "chain of custody" refers to the documented history of who had possession of evidence and when. For digital evidence, we need a way to prove that a recording hasn't been altered since it was created.
Verity creates a cryptographic chain of custody using hash functions and digital signatures.
How It Works
1. Chunk Hashing
When you record video, it's split into small chunks (3-5 seconds each). Each chunk is hashed using SHA-256, producing a unique 64-character fingerprint.
Video chunk → SHA-256 → a3f2b8c4d5e6f7a8b9c0d1e2f3...
If even a single bit of the video changes, the hash will be completely different. This is a one-way function—you cannot reconstruct the video from the hash.
2. Hash Chaining
Each chunk's attestation record includes the hash of the previous chunk, creating a linked chain:
Chunk 1: hash=a3f2..., previous=null
↓
Chunk 2: hash=8d1c..., previous=a3f2...
↓
Chunk 3: hash=b7e9..., previous=8d1c...
↓
...If someone tries to modify or remove a chunk in the middle, the chain breaks—the modified chunk's hash won't match what the next chunk expects as its "previous" hash.
3. Timestamp and Signature
For each chunk, our relay records:
- Timestamp — When we received the chunk (UTC)
- Relay signature — Our digital signature over the entire record
The signature proves the attestation came from our relay and hasn't been modified since. It uses asymmetric cryptography—we sign with our private key, and anyone can verify with our public key.
Public Key Verification
Our relay's public key for signature verification is published at a standard location following industry conventions:
https://api.myverity.app/.well-known/verity-signing-key.json
This allows independent verification without trusting our verification UI. Third-party tools can fetch this key and verify attestations directly.
What Attestation Proves
Attestation CAN prove:
- A recording existed at a specific time (timestamped by relay)
- Chunks were received in a specific order
- Video has not been altered since upload (hashes match)
- Tampering, if any, is detectable (chain breaks)
Attestation CANNOT prove:
- What the video actually shows is true or accurate
- Where or by whom the recording was made
- That the recording is complete (portions before upload may be missing)
- Legal admissibility (courts determine this)
Verifying a Recording
Anyone with a session ID can verify the chain of custody using our verification tool:
- Enter the session ID
- We retrieve all attestation records for that session
- We verify each hash links to the previous correctly
- We verify our relay signatures are valid
- We display the result: chain valid or broken
If you have the original video files, you can also recompute the hashes yourself and compare them against the attestation records.
Attestation Data Protection
Your video recordings live in storage you control. But what about the attestation records that prove authenticity? We protect them with a three-tier redundancy strategy:
Primary DB
Real-time storage in Cloudflare D1 for fast verification queries.
Hot Backup
Write-through to R2 object storage for corruption recovery.
Off-Provider
Weekly backups to Backblaze B2 for provider independence.
This ensures your attestation records remain verifiable even if our primary database is corrupted, accidentally deleted, or our infrastructure provider has issues.Learn more about our data redundancy strategy →
Technical Specifications
| Hash Algorithm | SHA-256 |
| Signature Algorithm | ECDSA with P-256 curve |
| Timestamp Source | Cloudflare edge server (NTP synchronized) |
| Storage | Cloudflare D1 + R2 + Backblaze B2 (redundant) |
| Public Key Location | /.well-known/verity-signing-key.json |
| Verification API | Public, no authentication required |
| Retention | Indefinite (never deleted, only archived) |