Trust & Compliance
Enterprise-Grade Trust & Compliance
Provio is built for environments where evidence integrity is non-negotiable. Our platform aligns with ISO 27037:2012, uses independent cryptographic timestamps, and is designed to meet Australian evidentiary requirements.
ISO 27037:2012 Alignment
ISO 27037 defines four key processes for handling digital evidence. Provio implements each process through purpose-built technology.
Identification
ISO 27037: Recognising potential digital evidence and documenting its context.
Provio: Every capture records device identity, GPS coordinates, accelerometer data, and network context. Evidence is tagged with project and case metadata at the moment of creation.
Collection
ISO 27037: Gathering digital evidence while maintaining its integrity.
Provio: The Provio iOS app captures media directly from device sensors, immediately hashing the raw bytes with SHA-256. No intermediate processing can alter the original content.
Acquisition
ISO 27037: Creating a verifiable copy of the evidence data.
Provio: Each capture is packaged into a self-contained EVP (Evidence Package) archive containing the media, metadata, cryptographic signatures, and hash chain entry. The EVP format ensures nothing can be added, removed, or modified without detection.
Preservation
ISO 27037: Maintaining the integrity and authenticity of evidence over time.
Provio: RFC 3161 timestamps from independent authorities prove when evidence existed. ECDSA P-256 signatures bind content to its creator. An append-only hash chain links every capture into a tamper-evident sequence.
9-Step Verification Pipeline
Every EVP evidence package passes through nine independent verification checks. The entire pipeline runs client-side in the browser using the Web Crypto API — no server trust required.
Archive Structure
Validates the EVP archive is a well-formed ZIP with all required entries: media file, metadata, signatures, hash chain data, and public key.
Metadata Validation
Parses and validates the JSON metadata against the EVP schema. Checks for required fields, valid timestamps, and consistent device information.
Content Hash
Recomputes the SHA-256 hash of the media file and compares it against the hash recorded in metadata using constant-time comparison to prevent timing attacks.
Hash Chain
Verifies the hash chain entry links correctly to the previous capture, ensuring the append-only sequence has not been broken or reordered.
Content Signature
Verifies the ECDSA P-256 digital signature over the raw media bytes using the embedded public key. Confirms the content was signed by the capturing device.
Metadata Signature
Verifies the optional ECDSA P-256 signature over the metadata JSON, ensuring capture context (location, time, device info) has not been altered.
Content Timestamp
Validates the RFC 3161 timestamp token against the content hash, proving the media existed at a specific point in time as attested by an independent TSA.
Metadata Timestamp
Validates the optional RFC 3161 timestamp token for the metadata, providing independent proof of when the capture context was recorded.
Result Aggregation
Compiles results from all previous steps into an overall integrity verdict: pass, fail, or warning. Any single failure marks the entire package as compromised.
Independent Timestamp Authorities
Provio uses multiple independent RFC 3161 Time-Stamp Authorities. Each TSA provides cryptographic proof that evidence existed at a specific point in time, independent of Provio.
DigiCert Timestamp Authority
DigiCert, Inc.
Root CA
DigiCert Trusted Root G4
Publicly trusted CA accredited under the WebTrust program. TSA complies with IETF RFC 3161 and ETSI EN 319 421.
One of the world's most widely used timestamp authorities, providing cryptographic proof that a hash existed at a specific point in time.
FreeTSA
FreeTSA.org
Root CA
FreeTSA Root CA
Publicly available RFC 3161 timestamp service providing independently verifiable timestamps using standard cryptographic protocols.
An independent, freely accessible timestamp service. Timestamps can be verified by any party using the TSA's public certificate.
Apple Timestamp Service
Apple Inc.
Root CA
Apple Root CA - G3
Operated as part of Apple's PKI infrastructure, used for code signing and notarization across the Apple ecosystem.
Timestamps issued by Apple's PKI infrastructure are independently verifiable and trusted across the Apple developer ecosystem.
Security Controls
Defence-in-depth security across every layer of the platform.
IRAP Assessment Preparation
Provio is actively preparing for Information Security Registered Assessors Program (IRAP) assessment at the PROTECTED level, aligning with the Australian Government Information Security Manual (ISM).
Session Management
JWT-based authentication with short-lived access tokens, secure refresh rotation, and server-side session invalidation. All sessions are bound to device fingerprints.
Encryption at Rest
All evidence data is encrypted at rest using AES-256. Database fields containing sensitive metadata use column-level encryption. Encryption keys are managed through a dedicated key management service.
Encryption in Transit
All communications use TLS 1.3. Certificate pinning is enforced in the iOS application. API endpoints reject connections using deprecated cipher suites.
Row-Level Security
Supabase Row-Level Security (RLS) policies enforce data isolation at the database level. Users can only access evidence belonging to their organisation, enforced regardless of application logic.
Australian Compliance Readiness
Provio is designed to produce evidence that satisfies Australian legal requirements for digital evidence admissibility.
Evidence Act 1995 (Cth)
- Section 48 — Proof of contents of documents. EVP packages are self-contained archives where the original media and its metadata are bundled together with cryptographic proof of integrity.
- Section 69 — Exception to hearsay rule for business records. Provio audit logs and automated capture metadata qualify as records made in the ordinary course of business operations.
- Sections 146-147 — Evidence produced by processes and devices. The cryptographic verification pipeline demonstrates the process that produced the evidence, and expert witness reports document the methodology.
Electronic Transactions Act 1999
- Technology-neutral legislation that recognises electronic records as legally equivalent to paper records when integrity requirements are met.
- Provio's cryptographic signatures and RFC 3161 timestamps satisfy the Act's requirements for reliable methods of maintaining integrity of electronic communications.
- The EVP format's self-contained verification capability ensures that the integrity of evidence can be demonstrated to any party at any time without reliance on Provio's systems.
Ready to learn more?
Download our methodology whitepaper for a detailed technical overview, or contact us to discuss enterprise compliance requirements.