Why a photo someone sends you is not proof
A file received by email or chat is just pixels with no reliable history. Metadata such as EXIF timestamps can be edited in seconds, and most messaging apps strip it entirely on send, so even honest metadata rarely survives the trip.
Nothing ties the image to a moment or a place. The sender could photograph an older print, reuse a picture from last year, or forward a screenshot, and nothing links the picture to the person who claims to have taken it.
On top of that, an image can now be generated or altered by AI. A convincing photo of damage that never happened, or a room that looks nothing like the real one, is within reach of anyone. Trust based on "they sent me a photo" no longer holds on its own.
What makes a capture tamper-proof
Live capture only. The proof must be filmed on the spot through the camera, never imported from a file. If someone can upload an existing image, the whole chain is worthless. Danaya allows a live camera capture only and blocks file import by design.
A fingerprint taken at the moment of capture. The instant the photo or video is taken, a SHA-256 hash, a unique fingerprint of the exact bytes, is computed on the device. Change one pixel later and the fingerprint no longer matches.
A server timestamp and a location. The capture is stamped with a server-side time and GPS coordinates, so the when and the where do not depend on the sender's clock or good faith.
A server signature and public verification. The fingerprint, timestamp and location are signed together with an HMAC-SHA256 key held on the server. Anyone can then check the result on a public page, with no account and no special software.
How to get proof from someone who has no account
The person on site should not have to sign up for anything. The practical pattern is a capture link: you create a link, name what you want captured, and send it. The other person opens it, films live, adds their name and an optional note, and you receive the result.
With Danaya this is a Verified Capture Link. You create the link, define the seal name and a short description of what to capture, and share the URL. The third party, a tenant, an expert, a courier, a claimant, opens the link, captures live in the browser, and enters their name and optional notes. No account is created on their side.
The sealed capture and a PDF report land straight in your dashboard, with captured by, the verification link, the timestamp and the location. Every plan, including the free one, keeps the report. The raw media is stored only if your plan allows it, on Business and above; on the free plan nothing but the report and the cryptographic proof is kept.
How Danaya does it, and what it does not claim
Concretely: the capture happens live in the browser, the SHA-256 fingerprint is computed on the capturing device, audio recorded with a video is included in the proof, the server adds a signed timestamp, GPS and device information, and a report is generated and stored. Anyone can verify a seal at its public link by re-uploading the file to compare the fingerprint.
It is worth being honest about the limits. Live capture blocks file import, but it cannot rule out a determined attacker injecting a feed through a virtual camera at the operating-system level. The photo fingerprint is not reproduced byte for byte on the server, because browsers re-encode images, so photo matching relies on an exact or perceptual comparison. Trust rests on the app and the integrity of the device used, not on hardware attestation: Danaya does not use C2PA or a hardware secure element, and there is no standalone audio seal. This is evidence strong enough for real disputes, not a claim of absolute unforgeability.