Independent proofs of integrity and provenance for digital archives.

Designate a Primary and a Backup Signing Officer, typically senior archivists, collection managers, or the director. They hold the hardware keys and authorise each batch when notified. The role requires no technical background. IT involvement is limited to the initial integration, which Authentic Memory designs and implements.

Hashes are read directly from the preservation system, which in most cases has already computed them during ingest. Where they are not pre-computed, the tooling runs locally on institutional infrastructure or on a server you provide, and computes them in place. Source files are never transmitted; only 64-character hash strings and structured metadata reach Authentic Memory.

Each version is its own record. Archives commonly hold a preservation master alongside access copies, subtitled editions, or excerpts prepared for exhibitions and loan. Any of these can carry its own proof, and because records are batched into a single Merkle tree, anchoring an additional version adds practically no cost. The usual pattern is to anchor the preservation master in every case, together with the derivatives the institution actually distributes, so that the file a member of the public encounters is also the file that verifies.

A re-encoded or edited file is, cryptographically, a different file. Its fingerprint changes, and verification against the original proof fails. That strictness is deliberate: a proof that still matched after re-encoding could not tell a harmless format change from a real manipulation. In practice, institutions therefore anchor the encodings and cuts they actually distribute, which adds little cost per version. A documented procedure for tracing excerpts, re-encodes, and edited versions back to their anchored originals is in development as part of our current programme.

Yes. The GAMI Proof Record format is a published open specification (the machine-readable JSON Schema is available at authenticmemory.org/schema/v1/gpr-schema.json), and the hashing, GPR-construction, and verification tooling is released under open licences. A formal open standard (v1.0) with an implementation guide and a documented PREMIS mapping is being published in 2026. Verification can be reproduced from public documentation alone. No GAMI software is required, and any institution can implement the standard independently.

C2PA and GAMI address different halves of the problem. C2PA handles provenance for newly created recordings at the point of capture, with credentials embedded in the file itself. For historical holdings that design fits poorly: archival practice avoids writing into preservation masters, and embedded credentials are lost when platforms strip metadata or re-encode. GAMI therefore keeps the proof outside the file, has the institution's own key sign it, and uses a timestamp that needs no certificate authority to persist. For new recordings we recommend adopting C2PA at capture. An export path that derives Content Credentials manifests from GAMI proofs, so that anchored archive media can be recognised wherever Content Credentials are displayed, is in development.

Conventional timestamps, such as RFC 3161 or eIDAS qualified timestamps, depend on a certificate authority whose keys and trust chain have to be maintained and re-validated for as long as the proof must hold, which for archival material means decades. Anchoring to Bitcoin removes that dependency: there is no certificate to expire, no authority to be wound up or coerced, and verification does not rely on Authentic Memory or any other single organisation continuing to exist. Only a hash is written; no cryptocurrency is bought, held, or transacted, and a single anchor can cover a whole batch, so the cost does not grow with the number of records. Where an institution also needs the legal presumption a qualified electronic timestamp carries, GAMI can sit alongside one rather than replace it.

Only a one-way hash is ever written to the blockchain. No personal data, and no file content, is anchored; a hash is a cryptographic fingerprint that reveals nothing about what a file contains, and source material is never transmitted to Authentic Memory or stored on its infrastructure. The descriptive metadata shown in the public verifier lives in a separate, institution-controlled layer that can be amended or withdrawn at any time, including to honour a right-to-erasure request, without affecting the validity of the cryptographic proof. The arrangement is compatible with the Bundesarchivgesetz duty to safeguard authenticity and integrity, and with the GDPR principles of data minimisation and purpose limitation; a data-processing agreement under Art. 28 GDPR is provided for any personal or special-category metadata involved.

Previously anchored records are not affected: each GPR carries the signature made under the key at the time of signing, and its validity rests on the OpenTimestamps timestamp regardless of the key's current status. For future signing, a new device is shipped, registered, and added to the DID document. Officer transitions are handled by Authentic Memory directly as a conversation, not as a software flow.

No. Authentic Memory is a post-ingestion layer that reads outputs already produced by the preservation system. It does not write to or modify the archival management system, and the preservation workflow itself is unchanged. Assisted integration works with the standard data structures of Archivematica, Preservica, ArchivesSpace, AToM, and unmanaged filesystems; reusable connectors and a self-service API extend this for institutions that want a lighter-touch or self-serve path, and custom adapter development is available for other systems.

Anchored GPRs remain valid and verifiable. The blockchain anchor is maintained by the Bitcoin network and is independent of any single organisation. The institution holds the GPR files, the open-source tooling, the signing keys, and the DID document needed for independent verification. Verification can be reproduced offline using published standards. Discoverability through the index is the only function bound to Authentic Memory, and the index is mirrorable.