Technical model
How Delphi decides that evidence can be trusted.
Delphi secures the path from capture to certificate: attesting the device with Apple App Attest, requiring capture inside the Delphi app, screening for reproduced images, binding time and location to the record, and anchoring a cryptographic proof on a public blockchain.
← Platform overviewCapture
Evidence originates inside the Delphi capture environment. It cannot be supplied from outside it.
Photos and videos are recorded through the Delphi Verify iOS app using the device camera. Media cannot be selected from the photo library, imported from another device, or uploaded from an external source. This single constraint removes the largest category of evidential fraud: submitting an image that is genuine, but is not of this asset, at this time, in this place.
A certificate holds between one and twenty items of evidence, and both photos and video are supported. Each item is reviewed before it is accepted into the draft.
The app requires foreground precise location, and can refuse to capture when iOS reports reduced location accuracy. Position samples are stabilised on the device, and samples that are stale, invalid or insufficiently accurate are rejected rather than recorded with a caveat.
A capture session is single-use and expires twenty-four hours after the first capture. Evidence assembled in one session cannot be quietly extended or reused later.
Attest
The device and the application prove they are what they claim to be, using Apple App Attest.
On first use, the app generates an App Attest key in the device's secure hardware, attests it against Apple, and registers the verified device with Delphi. The attestation public key and signature counter are retained.
At publication, the app signs a canonical payload covering the capture session, the session nonce, the selected privacy level and the ordered list of media commitments. Delphi verifies that the device belongs to the user, that the platform and attestation environment are valid, that the assertion signature and bundle identity are correct, and that the signature counter has strictly advanced.
The practical consequence is worth stating plainly: an ordinary API client cannot publish arbitrary media as though it had come from the trusted iOS capture flow. The attestation is what makes the capture constraint enforceable rather than merely stated.
Photos are additionally screened for reproduction risk — images of screens, printed photographs and other reproduced surfaces — which is the most common way an otherwise sound capture pipeline is defeated. Analysis returns an accepted, rejected or technically-failed result, and a rejected analysis blocks publication.
Seal
The evidence is committed, hashed and recorded in a single publication transaction.
Source media is hashed with SHA-256 before upload, and the complete manifest is committed in advance. The server later requires the publication proof to reference exactly the expected commitments, in capture order — so media cannot be substituted, reordered or added after the fact.
Publication is refused if the session has expired or been used, if media counts, order or commitments do not match, if hashes are invalid or duplicated, if a photo analysis was rejected, if timestamps fall outside the session window, if the privacy requirements are unmet, or if the device is not verified.
On success the certificate is written together with its media, proof, verification status and a pending blockchain anchor, and a public eight-character code is issued.
Anchor
A proof is published to the Ethereum Attestation Service on Base, outside Delphi's control.
After the certificate is committed, Delphi submits an Ethereum Attestation Service (EAS) attestation containing the certificate proof to Base mainnet, chain ID 8453.
The anchor moves from pending to submitted to confirmed, or records a failure with a stored error. The public report distinguishes a certificate that has been created from one whose record is confirmed on-chain — a distinction we surface rather than smooth over, because the two are not the same assurance.
Once confirmed, the report exposes the transaction hash and attestation UID, which link directly to the external EAS explorer. The purpose is narrow and worth being precise about: it establishes that this exact proof existed in this exact form at that point in time, on a record Delphi does not control and cannot quietly revise.
Verify
Anyone holding the code can inspect the evidence and check it independently.
A certificate opens from a QR code or an eight-character public code. No account and no relationship with Delphi is required — which matters, because the party who most needs to trust the evidence is rarely the party who created it.
The report presents the media, the device-reported capture time, the number and type of evidence files, the capture location and accuracy, capture and device verification status, and the blockchain anchor state.
An expandable independent-verification section exposes the decoded proof fields and media hashes, so a technical reviewer can recompute the relevant values rather than taking the interface at its word.
If a certificate has been deleted, the code returns a permanent removed state rather than silently disappearing.
Corroborating signals
No single signal is trusted on its own.
Delphi accepts evidence only when several independent checks agree. Which signals are available differs by asset class — and that is the difference between a verification platform and a camera application.
Apple App Attest
LiveHardware-backed device and app attestation
In-app capture only
LiveNo library import or external upload
Photo reproduction screening
LivePhotographs screened for screens, prints and reproduced surfaces
Precise location required
LiveReduced-accuracy capture refused
Device capture time
LiveBound to a single-use 24-hour session
SHA-256 media hashing
LiveCommitted before upload, verified at publication
EAS anchor on Base
LiveChain ID 8453, externally inspectable
Video evidence
LiveWith thumbnail and media property validation
What is shipped, and what is not
The signals above the divider are in the product today. Those below it are development direction, shown because they explain where the platform is going rather than what it currently does. We would rather be clear about the boundary than let it be inferred.
Asset identifiers
RoadmapVIN, serial, title or consignment reference
Navigational position
RoadmapVessel and marine corroboration
QR and NFC tags
RoadmapPhysical asset tagging
Telemetry and IoT
RoadmapConnected asset data
Location privacy
Prove where, without exposing exactly where.
Location is the most sensitive thing Delphi records. Evidence usually needs to establish where something was — but it rarely needs to publish that to the nearest metre for anyone holding the code.
Precise coordinates are shown on the certificate. Appropriate where the specific position is itself the evidence.
Public coordinates are snapped to a coarser grid, and the displayed address is generalised.
Only an approximate area is published — enough to establish region without disclosing a specific address.
The privacy level is chosen at publication, and is automatically restricted if the available accuracy cannot support the level requested. Reduced public precision does not weaken verification: the underlying capture retains the device-derived evidence needed to check the proof.
Deployment
How Delphi is used today.
Verification is only useful where the work already happens. Here is what deploying Delphi currently involves — and what it does not yet include.
iOS capture app
AvailableEvidence is captured through the Delphi Verify app on iOS, by the people who already attend the asset. Sign-in with Apple, Google or email.
Third-party verification
AvailableCertificates open from a QR code or public code with no account and no onboarding, so counterparties, adjusters and lenders can check evidence directly.
Certificate management
AvailablePublished certificates can be browsed, edited where authorised, and deleted — with deletion recorded and the public code returning a removed state.
Programmatic integration
Not yetA partner-facing API for creating capture requests and retrieving certificates from your own systems is not yet available. Integration requirements are something we are actively scoping with early customers.
Android capture
Not yetCapture is currently iOS only. The device attestation model is built on Apple App Attest; an Android equivalent is not yet shipped.
If your deployment depends on something in the second group, tell us. Knowing which of these actually blocks a rollout is genuinely useful to us.
Where does trust break down in your industry?
- A handover that goes wrong.
- A claim that is hard to substantiate.
- An inspection that costs more than it should.
- A milestone nobody off-site can verify.
- A transfer of responsibility nobody recorded properly.