Overview
Every image exported from Teila carries two independent layers of provenance protection:
- A forensic invisible watermark (TrustMark, steganographic) embedded in the pixel data. Measured to survive recompression, resizing, metadata stripping, screenshots (including a screenshot of a page or a photo of a screen) and moderate cropping. Heavy cropping (roughly half the frame or less), rotation by an arbitrary angle, and purpose-built watermark-removal tools defeat it; we do not claim otherwise.
- A C2PA Content Credentials manifestembedded as JUMBF metadata, cryptographically signed. Survives the asset only while the file container is intact; lost on screenshot or recompression without C2PA-aware tooling.
Both layers reference the Teila verification endpoint at https://teila.ai/v/<licenseId> where the full licence state can be inspected.
Signing entity
Content Credentials are signed by Teila Ltd, a private limited company registered in England and Wales.
Companies House number: 17289728
Governing law: United Kingdom (UK GDPR + Data Protection Act 2018). Data controller details in our Privacy Policy.
Trust status
Teila's claim signing certificate is issued by SSL.com, a certificate authority whose C2PA root is on the C2PA Trust List. Verifiers that load the C2PA Trust List (for example contentcredentials.org) report the Teila signer as trusted; no trust anchor needs to be imported by hand.
Every manifest also carries an RFC 3161 timestamp from the SSL.com C2PA Time Stamping Authority (https://ts-c2pa.ssl.com/ecc), itself on the C2PA TSA trust list. The timestamp proves the signature was made while the certificate was valid, so manifests remain verifiable after the certificate expires or is renewed.
Content signed before the switch to the SSL.com certificate (October 2026) carries the earlier self-issued Teila chain and is reported as "signing certificate untrusted". The manifest itself is still valid; the earlier root remains published at /.well-known/c2pa/legacy-self-signed-root.pem.
Certificate chain
The chain is published at /.well-known/c2pa/chain.pem (Teila leaf followed by the SSL.com intermediate, PEM-encoded; the root is the trust anchor and is not part of the chain). Individual certificates are also served separately.
Leaf (signing) certificate
- Subject
- CN=Teila, O=Teila Ltd, C=GB
- Issuer
- CN=SSL.com C2PA ICA E1 2025, O=SSL Corporation, C=US
- Algorithm
- ECDSA_SHA_256 (ES256)
- Key spec
- ECC_NIST_P256 (private key held in AWS KMS, never exportable)
- Validity
- 2026-10-06 → 2027-10-07
- SHA-256 fingerprint
- 90:28:C5:55:8E:D6:1F:BD:64:73:70:61:77:0E:0E:CD:B7:3C:6F:71:06:C0:EC:3A:12:AA:C0:52:75:D3:D6:0B
- PEM
- /.well-known/c2pa/leaf.pem
Intermediate certificate
- Subject
- CN=SSL.com C2PA ICA E1 2025, O=SSL Corporation, C=US
- Issuer
- CN=SSL.com C2PA ECC Root CA 2025, O=SSL Corporation, C=US
Root certificate
- Subject
- CN=SSL.com C2PA ECC Root CA 2025, O=SSL Corporation, C=US
- Self-signed
- no
- SHA-256 fingerprint
- 8A:8B:02:3B:EE:D9:55:F5:D3:37:07:05:68:E3:32:9A:5E:76:AE:9E:D3:F1:82:10:90:F5:60:5E:1F:FD:B0:50
- PEM
- /.well-known/c2pa/root.pem
Custom assertion schema
Every Teila-signed asset carries a custom C2PA assertion labelled com.teila.license containing license metadata: license_id, verification_url, issued_at, expires_at, licensee, talent, scope, scope_hash, and content hashes. The current status and expiry of the licence are returned by GET /api/v1/verify/:licenseId on teila.ai.
Revocation
Revocation status of the signing certificate is served by SSL.com over OCSP (http://ocsp-c2pa.ssl.com, referenced in the certificate itself). On key compromise Teila asks SSL.com to revoke the certificate and publishes the revoked fingerprint here with its effective date. The signing key is held in AWS KMS and never leaves it.
To report a suspected compromise: [email protected]
Certificate chain last generated: Wed, 07 Oct 2026 00:00:00 GMT