ProvSeal Desktop
Local C2PA signing, verification, batch workflows and hardware-backed identities on your infrastructure.
Desktop page →ProvSeal Enterprise
On-premise Content Credentials for your organization
Desktop for local signing, verification and batch workflows. Console for machines, policies and audit metadata — without sending media to the cloud.
Media stays on your infrastructure. Keys stay on device, token, or organization-controlled signing material (P12/PFX, PKCS#11, YubiKey PIV, HSM-ready as supported in your pilot).
Two planes, one platform
Desktop is the execution plane. Console is the management plane. The free extension remains the usual browser entry point.
ProvSeal Console
Fleet enrollment, signing policies, audit metadata and releases — without processing raw media.
Console page →Chrome Extension
Free local verification, page scan and test-signing — start here before Desktop or Console.
Extension page →How the stack fits together
On-premise Desktop signing. Console receives policy and audit metadata only — no cloud media upload.
- Media / DAM / CMS Assets stay on your infrastructure
- ProvSeal Desktop Local sign, verify and batch
- Hardware / HSM-ready Organization-controlled keys
- Signed Credentials Embedded provenance on assets
ProvSeal Console
Policy and audit metadata only — no media upload
Desktop execution · Console governance · No cloud media upload
Two planes, clear boundary
Media and keys stay in the execution plane. The management plane only moves policy and audit metadata.
Execution plane
ProvSeal Desktop
- Local sign / verify
- Batch workflows
- Hardware-backed identities
- Media stays on device
Management plane
ProvSeal Console
- Device enrollment
- Signing policies
- Audit metadata
- No raw media processing
From extension testing to on-premise rollout
Start with the free Chrome extension, validate Desktop signing and batch workflows, then add Console governance when your fleet is ready.
- 01Install extension
Verify, scan pages and test-sign locally in Chrome. Extension →
- 02Deploy Desktop
Standalone local signing and batch workflows on your infrastructure. Desktop →
- 03Connect identities
P12/PFX, PKCS#11, YubiKey PIV or HSM-ready signing material as supported in your pilot.
- 04Add Console
Enroll machines, assign policies and review audit metadata. Console →
Local-first security model
Designed for organizations that cannot send media or signing keys to an external cloud signing service.
- Media files are processed locally on Desktop — not sent to a ProvSeal cloud signing service.
- Private keys stay on the device, token or organization-controlled signing material.
- Console manages policies and audit metadata, not raw media.
- Test certificates are for demo/internal validation, not public trust.
- Public trust requires recognized C2PA trust-chain readiness.
Enterprise pilot program
A controlled cohort to validate on-premise Desktop signing, batch workflows, hardware-backed identities and optional Console governance before wider rollout.
- ProvSeal Desktop access
- Batch workflow validation
- Hardware / HSM-ready identity review
- ProvSeal Console access if needed
- Signing policy and audit metadata review
- Controlled deployment planning
Conformance status: application in progress. ProvSeal is currently undergoing the C2PA Conformance Program application process as a Validator Product and is not currently represented as a C2PA Conforming Product. Read conformance status.
What this is not
ProvSeal Enterprise is a technical provenance system. C2PA Content Credentials describe declared origin and history — they do not prove that content is true or fake.
- Not a cloud signing API by default
- Not an enterprise browser extension
- Not fake or AI detection
- Not a guarantee that unsigned content is false
Ready to validate an on-premise C2PA workflow?
Validate Desktop batch signing and hardware-backed identities on your infrastructure, then add Console fleet governance when ready.