↓Skip to main content

Hardware provenance

Signed before software sees it.

Software can be edited, so it can be faked. Signing happens inside the camera, before a frame leaves the board, with keys that never leave the chip.

In development. This page is updated as things progress
CAD render of the assembled AnchorCam Stereo main board: the large metal package at centre is the SoC that runs the hash-and-sign pipeline, beside the board-to-board connector and populated components.

The large package at centre is the SoC where hashing and signing happen. Rendered from the board's own CAD.

How it works

Four steps. No frame leaves the board unsigned.

Camera module cross-section: light hits the sensor, frames pass through the ISP into a hardware secure zone where each frame is SHA-256 hashed and Ed25519 signed before leaving the module. Keys never leave the chip; the OS, apps, and editing tools sit outside the hardware trust boundary with no window to intervene.

Sensor to signature: inside the trust boundary, start to finish.

Sensor capture → ISP → Hash + sign (SHA-256 / Ed25519) → C2PA manifest

Why now

California's SB 942 and the EU AI Act's Article 50 both took effect August 2, 2026. AB 853 requires embedded provenance by default from 2028. Sign at the point of capture, and the board is already compliant with what just landed, and ready for what comes next.

Three thin cyan arcs on different orbits, converging from three directions onto one small aperture module at the center: three separate rules, one board built to meet them

Three rules. One board.

Roadmap

Neither of these exists yet. They are targets, not shipped capability. We write them down so you can hold us to them later.

Hardware roadmap illustration: now, a standalone signing PCB encased in tamper-evident resin; the goal, signing logic embedded directly on the image-sensor die.

Now: a standalone module in tamper-evident resin. Goal: signing logic on the sensor die itself.

Long-term

Signing on the die

Signing logic embedded directly on the image-sensor die: light to signature, in a single chip.

Certification

FIPS 140-3 + C2PA

Targeting FIPS 140-3 Level 2 certification and C2PA-compatible manifests.

What exists today: a custom PCB on commercial SoCs, and a resin-filled enclosure for tamper evidence. Nothing here is certified yet.

Signing is half of it. The other half is sync.

AnchorCam Stereo puts vision, touch, and motion on one clock. Sub-millisecond.

See AnchorCam Stereo Get in touch

Last updated 3 August 2026 · mutual.solutions