01 / Key Custody
Hardware-Bound Keys
Generated inside the iPhone's Apple Secure Enclave. Non-exportable, bound to physical hardware, and protected from OS-level extraction or malware.
Apple Secure Enclave·ECDSA P-256·Non-exportable
Trust and Credentials
Security Compliance
Lens applies defense-in-depth controls to protect capture integrity, privacy, and operations. Lens is also listed on the official C2PA Conforming Products List; see the proof. Start with the compliance summary, then review the detailed control mappings.
Executive summary
Lens combines hardware-backed cryptography (Secure Enclave, ECDSA P-256, TLS 1.3), strict data handling aligned to GDPR and CCPA, and OWASP Mobile Top 10 risk mitigation. The sections below map each control domain for security review.
Security at a glance
Essential principles governing how Lens protects device keys, media, and capture integrity.
02 / Data Privacy
On-Device Point of Capture
C2PA claims and cryptographic signatures are computed locally at the moment of capture. Your photos and videos are never sent to a cloud HSM or server to be signed.
Local Media Signing·HEIC · JPEG · MOV · PDF·Zero Cloud Uploads
03 / Key Isolation
Zero Cloud Key Sync
Stored using ThisDeviceOnly Keychain access and excluded from iCloud sync or backups. Upgrading phones generates a fresh key; past signed captures remain valid.
ThisDeviceOnly Keychain·No iCloud Sync·Per-Device Key
04 / Verification
C2PA Max Assurance Level 1
Publicly confirmed conformant under C2PA Conformance Program v0.2 / C2PA Specification v2.4 (record 019fe372-a787-7fa4-a664-1d8e17c616de).
Record 019fe372·C2PA Spec v2.4·Conformance v0.2
Compliance Basis
Lens bases its security architecture on C2PA Specification v2.4, the C2PA Generator Product Security Requirements, and C2PA Harms Modelling v2.4. Together, these frameworks inform our architecture, threat model, and harm mitigation approach.
Primary References:
- C2PA Technical Specification 2.4 — Core protocol, manifest structures, and assertion definitions
- C2PA Security Considerations 2.4 — Threat model, cryptographic controls, and implementation guidance
- C2PA Harms Modelling 2.4 — Human rights considerations, misuse scenarios, and stakeholder guidance
The controls, mitigations, and privacy protections on this page follow guidance from these C2PA specifications and the C2PA Conformance Program.
C2PA Conformance
Lens is listed on the official C2PA Conforming Products List. You do not have to take our word for it. Here is how to check the record yourself.
Status
Conformant
Assurance level
Max Assurance Level 1
Product name on the list
Lens Proof-of-Work
Conformance record ID
019fe372-a787-7fa4-a664-1d8e17c616deSpec version
C2PA 2.4 (Conformance Program v0.2)
Confirmed
August 18, 2026
The C2PA Conformance Program tests and confirms that a product meets the C2PA standard before it appears on the list. Lens passed that review, so verifiers and other C2PA-compliant tools can recognize Lens Proof-of-Work as a trusted signer.
Check it yourself:
- View the record in the Conforming Products List. This is the raw source record maintained by C2PA. Search the page for "Lens Proof-of-Work" or record ID "019fe372-a787-7fa4-a664-1d8e17c616de".
- Browse the C2PA Conformance Explorer. This official interactive tool opens with the Lens record already filtered.
Capture and enrollment boundary
Lens creates and signs C2PA claims on the iPhone. Certificate issuance is a separate step.
When CA-signed enrollment is enabled, Secure Enclave generates and retains the non-exportable P-256 key, and Lens signs the certificate signing request locally. The enrollment backend proxies the CSR and limited enrollment metadata to the certificate authority, but it does not receive the private key or photo/video content.
After enrollment, Lens creates the C2PA claim and signs the media on the iPhone at capture. This is different from a remote server-side HSM model where a backend-held key signs uploaded media. An external timestamp authority, when used, provides a separate time signal and does not perform the capture signing.
Compliance Summary
Data Protection
GDPR, CCPA
Cryptographic Security
Secure Enclave, ECDSA P-256, TLS 1.3
Mobile Security
OWASP Mobile Top 10
Privacy
Privacy by Design
Incident Response
ISO 27001-aligned
Security Architecture
Lens follows a defense-in-depth model across four distinct security layers.
Data Protection & Privacy
Lens applies privacy by design throughout the app: local processing, zero analytics, and full user agency.
Privacy Principles:
- Data Minimization: Only collects data necessary for core camera functionality
- Purpose Limitation: Data used only for stated provenance and metadata purposes
- Storage Limitation: Media and metadata stored locally on-device under user control
- User Control: Users control what data is captured, signed, and exported
- Transparency: Clear disclosures with zero covert telemetry or usage analytics
Cryptographic Security
Hardware-backed key lifecycle management and industry-standard cryptographic algorithms.
Vulnerability Management
Continuous automated scanning, OWASP Mobile Top 10 threat mitigation, and a binding 90-day remediation SLA.
Vulnerability Disclosure:
- Responsible Disclosure: reneboygarcia@field-notes.dev
- Response Time: 48 hours acknowledgment, 90 days resolution target
- CVE Assignment: For critical vulnerabilities
- Public Disclosure: After patch deployment and user notification
Dependency vulnerability management
We commit to remediating Critical and High CVEs in our dependencies within 90 days. Our SCA, SBOM, policy, and runbook are documented in the Product Security Architecture and dependency vulnerability management runbook. We use GitHub Dependency Graph and Dependabot for visibility and alerts, and Trivy in CI for scanning and CycloneDX SBOM generation. For dependency CVE reports or questions: reneboygarcia@field-notes.dev.