Othra Verification Protocol

Signed by you.
Verifiable by anyone.

Every Othra takedown carries a cryptographic claim — proof that the request comes from a biometrically verified human, not a script, not an impersonator. Platforms can confirm it independently, on a public URL we publish.

Plain-language overview — change tabs anytime.
The idea

A claim is useless if it can't be checked.

Imagine writing a letter to Instagram saying "this is a fake video of me — please take it down." How does Instagram know it's really you who wrote it? Today, they don't. Anyone can copy that text and send it about anyone.

Othra changes that. We attach a digital "seal" to every takedown letter — a kind of cryptographic fingerprint that proves you are a real, verified person who actually scanned the suspicious content. The platform can check the seal at our public verification page. If the seal is broken or missing, the request is probably fake.

The short version

We give your takedown letter the same kind of trust a notarized document has — except faster, free, and built for the internet.

Takedown requests today are unauthenticated text. Anyone can impersonate anyone in a copy-pasted email. Trust & Safety teams compensate with manual review queues that scale linearly with abuse — which means they don't scale at all.

Othra issues a tamper-evident verification block alongside every takedown. Each block is HMAC-SHA256-signed over a canonical payload binding the user's identity, biometric fingerprint, and scan event into a single artifact. A reviewer can ingest the block, validate its structure on a public endpoint, and (in v2) verify the full signature against our audit log.

Protocol summary

Authenticated identity claim ≈ HMAC<SHA256>(canonical_payload, issuer_key), plus a public verify URL that returns a structural and authenticity check.

How it works

Three steps. One signature.

The whole protocol is invisible to you. You scan, you tap "Create Takedown Request," Othra does the rest. Here's what happens behind the curtain.

Each takedown invocation in the client triggers three sequential primitives. The signing key never leaves trusted code paths; the audit record never leaves Othra infrastructure.

01

Verify

When you first open Othra, you sign in with Apple and complete a quick liveness check — Othra confirms there's a real person behind the camera, not a photo or video. You add a few reference photos to your private vault. That's your identity.

Apple Sign In yields a stable user identifier. Apple Vision framework performs on-device liveness detection (head pose multi-axis check). Reference face embeddings are extracted on-device; only their hash and storage path persist.

Apple Sign In · Vision liveness
02

Sign

When you generate a takedown, Othra mixes who you are, the scan you just ran, and the moment in time into one compact "seal." Tampering with any part of it breaks the seal, so anyone checking later can tell something's wrong.

A canonical payload concatenates identity pseudonym, scan metadata, and timestamp. We HMAC-SHA256 the payload using an issuer key, producing a 256-bit signature. The verification block is rendered into the takedown letter in human-readable form, with a token encoding pointer into our audit log.

HMAC-SHA256 · canonical payload
03

Verify URL

The letter the platform receives has a link (othra.ai/verify/...). Anyone who clicks it sees a clean page showing the seal's details — issue time, verification class, cryptographic fingerprint. If anything's altered, the page shows a warning instead.

Each request includes https://othra.ai/verify/<token>, where the token base64url-encodes a compact pointer (verification ID + payload digest + signature prefix). The public verifier validates token structure and signature prefix; the v2 endpoint will perform a full server-side lookup against our audit log.

Public endpoint · token + audit pointer
Anatomy of the block

What the letter carries.

Below is roughly what a Trust & Safety reviewer at Instagram or TikTok sees attached to your takedown letter. Each field has a purpose, and none of them reveal personal information about you.

The block is a deterministic, monospace-formatted record appended to the localized takedown letter body. Field ordering is fixed; whitespace is canonicalized to enable byte-identical reproduction for signature verification.

Othra Identity Verification — sample block
═══════════════════════════════════════════════════ OTHRA IDENTITY VERIFICATION ═══════════════════════════════════════════════════ Verification ID: OTH-20260512-A7B3C9D1E2F3G4H5 Verified at (UTC): 2026-05-12T18:45:33Z Identity provider: Apple Sign In + Face liveness Biometric method: Apple Vision embedding (on-device) User pseudonym: f8d2c4e7a9b14c3e Biometric fingerprint: a3b9c8d2e7f1042b9c8e3d6f1a8b2c5d… Scan analysis ID: 550e8400-e29b-41d4-a716-446655440000 Vault match score: 96.4% similarity AI manipulation risk: 87.2% probability Detection confidence: 92.0% Risk classification: HIGH Cryptographic proof (HMAC-SHA256): a3b578826bcfb99a83c31a8ae291cddb… Verify this claim: https://othra.ai/verify/<token>

What each line means

Verification IDA unique receipt number for this specific takedown — like a tracking code.
Verified at (UTC)The exact moment your scan was signed, in Universal Time.
Identity providerHow we confirmed you're you — Apple's secure sign-in plus a live face check.
User pseudonymA scrambled version of your account ID. Doesn't reveal your name, email, or phone.
Biometric fingerprintA one-way scrambled version of "this scan + this user." Cannot be reversed into your face.
Scan analysis IDThe internal reference for the AI scan that produced this result.
Vault match scoreHow closely the suspicious image matches your reference photos.
AI manipulation riskHive AI's estimate that the image was AI-generated or manipulated.
Cryptographic proofThe mathematical "seal" produced over everything above. The proof that nothing has been tampered with.
Verify URLWhere a platform reviewer can check the seal's authenticity in seconds.

Field semantics

Verification IDFormat OTH-YYYYMMDD-{16-hex}. Deterministic per signing event. Indexed primary key in Othra's audit log.
Verified atISO-8601 UTC, second precision. Used in canonical payload.
User pseudonymTruncated SHA-256 over user_id ‖ pseudonym_salt. One-way; same user always renders the same pseudonym, but the salt prevents cross-system correlation.
Biometric fingerprintSHA-256 over scan_id ‖ user_id ‖ biometric_salt. Binds a scan to a user without exposing the embedding.
Scan analysis IDUUID v4 referencing the Hive analysis record.
Vault match scoreFloat 0–1, formatted as percentage. Derived from cosine similarity between query embedding and vault embeddings (Apple Vision).
AI manipulation riskHive deepfake-detection probability, 0–1.
Cryptographic proofHMAC-SHA256 hex digest of the canonical payload (concatenated, delimiter-separated). 64 hex characters.
Verify URLPublic endpoint at /verify/<token>. Token encodes verification ID + payload digest + signature prefix in base64url.
Canonical payload (omitted for security)

The exact concatenation order, salt strings, and key material for HMAC computation are not published. A reviewer can validate structural conformance against our public endpoint. Verified platform partners can apply for direct programmatic access.

Privacy

Your face never leaves your phone.

The verification block is engineered to be tamper-evident, not revealing. None of these details appear in the letter or on the public verify URL:

  • Your real name, email, or phone number
  • Your photos (the suspicious one or your vault references)
  • The mathematical fingerprint of your face
  • Your IP address or device identifiers

The block is a pointer — enough to confirm a real verification happened, never enough to identify you to anyone but Othra.

The principle

Othra holds the audit trail. The world sees only an opaque proof. The two only connect if a court compels us — and even then, only for that one record.

We chose hashing over disclosure for every personally identifying field. The verification block is a commitment to data we hold — never a publication of it.

Face embeddingExtracted on-device by Apple Vision. Stored on Othra Storage as encrypted blob; only the SHA-256 fingerprint references it in the verification block.
User identifierApple's stable sub (per developer team) plus Supabase UUID. Both pass through a salted SHA-256 before becoming the pseudonym.
Scan imageUploaded for Hive analysis, retained 24 hours, then auto-deleted. The image itself is never referenced in the verification block.
Email / phoneStored encrypted in Supabase Auth. Never referenced in the block. Never returned by the verify URL.
IP / device IDCaptured in Supabase server logs for security purposes only. Not part of the verification protocol.
Design principle

Every field in the block is either a one-way hash, a deterministic ID, or content the user voluntarily provided (URL, platform). No raw PII, no biometric template, no recoverable identity.

For platforms

What Trust & Safety actually sees.

When a Trust & Safety reviewer at Instagram or TikTok opens your takedown letter, they see your request and the verification block. They can click the verify URL to confirm it's a real Othra claim — without leaving their browser, without creating an account.

The verification page shows:

  • Status: "Verified Othra claim" with a green checkmark — or a red warning if the link is broken
  • Issue date — when the seal was created
  • Cryptographic fingerprint — the truncated proof
  • Issuing authority — Hanium LLC, the operator of Othra
  • Contact — legal@othra.ai for evidentiary requests or platform partnership

The platform-facing verifier at /verify/<token> performs a layered check. Today it is structural; in v2 it will be cryptographic against our audit DB. In v3 it will expose a signed JWT for programmatic integration.

Current flow (v1)

  1. Decode base64url token → three-part record
  2. Validate verification ID format (^OTH-\d{8}-[A-F0-9]{16}$)
  3. Check payload-digest and signature-prefix length thresholds
  4. Render a structural "recognized claim" page or "not recognized" warning

Server-side flow (v2, in progress)

  1. Token decoded as above
  2. Verification ID resolved against Othra audit log
  3. Full signature recomputed server-side and compared
  4. Returns one of: verified, structurally_valid_but_unknown, tampered, revoked
Programmatic verification (planned)

Verified platform partners will receive API keys for POST /verify/api/v1/check returning a signed JWT response. Contact legal@othra.ai.

Trust model

We tell you the limits as clearly as the strengths.

v1 of Othra is a strong credibility statement — designed to survive human review and casual scrutiny. v2, in progress, moves the signing key off your phone and into Othra's servers, making the seal cryptographically forgery-proof.

v1's HMAC issuer key is bundled with the client. Sophisticated adversaries can extract it and forge structurally-valid blocks offline — though the audit log will not contain the corresponding record, so v2's server-side check would detect such forgeries.

Today — v1 Berkid
Credibility statement
  • Block formatting Deterministic, monospace, tamper-evident under non-cryptographic review.
  • Public verifier Structural and prefix-signature check; explains the claim to reviewers.
  • Audit retention Every verification event held in Othra's audit log for evidentiary purposes.
Next — v2 / v3
Cryptographic + programmatic
  • Server-side signing Issuer key moves to a Supabase Edge Function. Client never sees the key.
  • Full signature verification /verify recomputes HMAC against audit log; returns authoritative status.
  • Partner JWT API Trust & Safety teams receive signed JWT responses for automated review pipelines.
  • Revocation Othra can invalidate compromised or contested claims, reflected at the verifier in real time.

Want to verify a claim or integrate?

Trust & Safety teams, security researchers, journalists, and partner platforms: we're listening.

Open the verifier Contact legal@othra.ai