Content Credentials

Every image generated by Depicta includes Content Credentials — machine-readable metadata proving it was AI-generated. This is based on the C2PA (Coalition for Content Provenance and Authenticity) standard.

What’s included

C2PA metadata

Embedded in every generated image:

Field	Description
Generator	“Depicta” — identifies the service
Action	“Created”, marked as AI-generated (IPTC trainedAlgorithmicMedia). When the model provider already signed the image, “Opened” and “Watermarked” instead, linking to the provider’s credentials
Timestamp	When the image was generated (UTC)
Model	The AI model and operation used
Digital signature	Cryptographic proof the metadata is authentic

There is also an invisible watermark in each file we deliver, except very plain or transparent images and GIF or SVG files. It is an additional marker in the image itself. Check an image for our marks.

Image hash

We store the SHA-256 hash of every image generated through Depicta, and of every image you upload. It is linked to your account for 12 months; after that we remove the link to your account (and, for uploads, the IP address and user agent recorded with it). It remains stored after that as the hash, a timestamp and the file type only.

The hash is returned in every generation response (image_hash field) and per-format (formats.{png,jpeg,webp}.hash).

EU AI Act compliance

The EU AI Act (Article 50) requires AI-generated content to be machine-readably marked as such, effective August 2, 2026. These markers are how we mark AI-generated images under Article 50(2) of the EU AI Act. They are not a certificate, and editing or converting an image can remove or weaken them.

Caution

You must not remove, alter, or disable Content Credentials or watermarks; doing so breaches our Terms of Service. If you publish AI-generated images, you may also have to tell your audience that they are AI-generated (EU AI Act, Article 50(4)); see Section 8.2 of the Terms.

Keep the marking, and label realistic images you publish

Every image Depicta generates carries Content Credentials (C2PA) that mark it as AI-generated, and usually an invisible watermark. Do not strip them. Many local tools remove them when converting or resizing (image editors, cwebp, Pillow without metadata options, some upload pipelines). For format changes, resizing, cropping and optimising, use Depicta’s processing operations, which keep the Content Credentials.

If you are going to publish an image that looks real and shows, or could be taken for, a real person, place, object or event (a “photo” of your office, team, product, a client, or a recognisable landmark), under the EU AI Act you must make clear that it is AI-generated, visibly, where people first see it. Use a short caption such as “AI-generated image” or “AI-generated scene, made with Depicta”. For clearly artistic or fictional work, a light, unobtrusive caption is enough. Abstract, decorative and clearly illustrated images need no label. This is general information, not legal advice. You decide and are responsible for how you publish (Terms of Service, Section 8.2).

Verifying Content Credentials

You can verify any Depicta-generated image using:

• Content Credentials Verify — official C2PA web tool
• Adobe Photoshop / Lightroom — shows Content Credentials in the info panel
• Any C2PA-compatible tool

Processing and credentials

metadata-strip removes EXIF, XMP and other metadata but always keeps Content Credentials. Vectorize adds Content Credentials to the SVG it makes when signing is enabled. Images you only crop, resize, convert or optimise are not marked, because they are not AI-generated.