NEXI Ventures — Product Brief
Cryptographic Content Authentication Protocol
Every image, video, document, and audio file leaves a permanent, mathematically-verifiable trail. No central authority. No trusted third party. Pure cryptographic proof — anchored to time.
The Problem
AI image and video generators produce indistinguishable synthetic media at zero marginal cost. Deepfakes are cheap. Misinformation is profitable. The existing response — "context clues" and "media literacy" — has categorically failed. The only viable solution is mathematical proof applied at the moment of creation.
Effective August 2026, the EU AI Act mandates provenance labeling for all AI-generated content distributed within the European Union. Organizations failing to comply face fines up to €30M or 6% of global annual turnover. ProofMark's C2PA-compatible manifests satisfy this requirement automatically.
Six markets face existential risk from fake content:
Cryptographic Foundation
ProofMark is not a "trust us" system. Every proof is independently verifiable with open-source tools and no access to ProofMark's servers. The security derives from mathematical hardness assumptions — problems requiring compute power equivalent to all Bitcoin mining for longer than the age of the universe.
Every file ingested by ProofMark is reduced to a 256-bit digest that deterministically encodes its exact byte sequence — pixel values, audio samples, glyph positions. The hash is the cryptographic fingerprint. Any modification, even changing a single pixel, produces a completely different hash.
Birthday bound at 2¹²⁸ operations (~3.4 × 10³⁸). At 10¹⁸ hashes/second (all of Bitcoin's combined hashrate), finding a SHA-256 collision requires 1.08 × 10²² years of continuous computation.
Reversing a SHA-256 hash to recover the original requires 2²⁵⁶ operations. The observable universe contains ~10⁸⁰ atoms. Preimage attacks are physically impossible with any conceivable technology.
A single bit change in input causes ~50% of output bits to flip — the strict avalanche criterion. Watermarked vs. original, visually identical images produce completely different hashes. No gradient-based forgery works.
A SHA-256 hash proves the content is unchanged. A digital signature proves who generated that hash — and binds them to it permanently. The signer cannot deny it. The mathematics of the elliptic curve discrete logarithm problem makes denial mathematically meaningless.
secp256k1 ECDSA secures $1.2T in Bitcoin and $400B in Ethereum. Every on-chain transaction — hundreds of millions per day across both networks — relies on this exact signature scheme. ProofMark reuses the most battle-tested cryptographic primitive in the history of software.
Hash + signature proves authenticity. A timestamp proves when the content existed. RFC 3161 is the internet standard for trusted timestamping — its tokens are admissible as legal evidence in courts across the US, EU, and UK under eIDAS, the ESIGN Act, and UETA.
Client generates a TimeStampRequest containing a nonce and the SHA-256 digest. Zero content leaves the client — only the 32-byte fingerprint traverses the network.
TSA records current UTC time (±1 second accuracy), appends nonce and serial, signs the TSTInfo structure with its X.509 certificate. Returns a TimeStampToken in ASN.1 DER encoding.
TSA certificate chains to an intermediate CA and then to a root CA — DigiCert, Entrust, or GlobalSign. Token is verifiable without ProofMark servers existing at all. Permanent proof.
Individual timestamping at scale is expensive and serial. ProofMark uses a binary Merkle tree to batch-certify thousands of documents with a single TSA call every 60 seconds. The inclusion proof for any document in a batch of 1,000,000 requires only 20 SHA-256 hashes — 640 bytes regardless of batch size.
1 TSA API call costs $0.001. That call timestamps the Merkle root, which represents 10,000 documents simultaneously. Per-document TSA cost: $0.0000001. We charge $0.029/document on Pro. Gross margin on timestamping component: 99.999%. Infrastructure scales linearly with documents; revenue scales linearly with documents. Perfect margin retention at scale.
C2PA is the emerging global standard for content provenance, backed by Adobe, Microsoft, Google, Intel, ARM, and Sony. The EU AI Act's technical provenance requirements map directly to C2PA. ProofMark generates fully-compliant C2PA manifests and embeds them in media via JUMBF containers.
EU AI Act (effective August 2026) mandates provenance labeling for AI-generated content. C2PA manifests satisfy the technical requirements exactly. Every ProofMark customer achieves full regulatory compliance automatically — compliance is the product.
C2PA manifests are natively readable in Adobe Photoshop, Lightroom, and the Content Credentials browser extension. Chrome and Safari native support is forthcoming. ProofMark proofs remain verifiable independently of ProofMark infrastructure — permanent by design.
Verification Architecture
Every operation is deterministic and independently reproducible. A third party with no access to ProofMark's servers can verify any proof using open-source cryptographic libraries alone.
Viral Distribution Engine
Every proof generates a permanent public URL. Every journalist, editor, photographer, or viewer who verifies content lands on a branded ProofMark page. Verification is free — no account, no friction. The viral loop scales with every creator who publishes.
A photographer uploads an image. They receive a verified badge, a public verification URL, and an embeddable HTML snippet. They put the verification link in their portfolio, their licensing agreements, their social captions. Every piece of content they publish carries the ProofMark verification link.
A news editor clicks the verification URL. They land on a branded ProofMark page showing: hash match (content unchanged), ECDSA signature valid (authentic signer), RFC 3161 timestamp (existed at time T), C2PA manifest (provenance chain). Zero friction. No account required. The editor bookmarks ProofMark.
The news editor wants to certify their own published images before competitors steal and recontextualize them. They sign up for a Pro account. The brand whose ad was deepfaked wants enterprise verification for all AI-generated creative. Every verification event is an acquisition touchpoint.
Each ProofMark Pro subscriber publishes ~47 ProofMark-linked content pieces per month. Each piece generates an estimated 12 verification page views (social sharing, editorial review, licensing checks). At a 2% verifier-to-subscriber conversion rate: 47 × 12 × 0.02 = 11.3 subscriber referrals per Pro user per month. At churn = 4%/month and k-factor ≥ 1.05, growth is self-sustaining without paid acquisition beyond 500 initial subscribers.
Technology Stack
Pricing Model
Verification is always free — it powers the viral engine. Authentication is where revenue lives. Simple tiers with defensible per-unit economics.
Revenue Projections
| Milestone | Subscribers | Avg MRR/User | Monthly Revenue |
|---|---|---|---|
| Month 1 — Launch | 50 | $14 | $700 |
| Month 2 | 150 | $15 | $2,250 |
| Month 3 | 350 | $18 | $6,300 |
| Month 6 | 900 | $22 | $19,800 |
| Month 9 | 2,000 | $25 | $50,000 |
| Month 12 | 4,200 | $28 | $117,600 |
| ARR at Month 12 | — | — | $1,411,200 |
MVP Budget
| Item | Type | Cost |
|---|---|---|
| Engineering (120h @ $100/h) | One-time | $12,000 |
| DigiCert TSA (legal-grade RFC 3161) | Monthly | $89/mo |
| Supabase Pro | Monthly | $25/mo |
| Vercel Pro | Monthly | $20/mo |
| Cloudflare R2 storage | Usage | ~$30/mo |
| Stripe processing (2.9% + $0.30) | Revenue % | ~$87/mo @ $3K MRR |
| Domain + SSL certificate | One-time | $50 |
| Total MVP Launch Cost | — | ~$15,000 |
ProofMark requires no ML models, no GPU compute, and no proprietary data. The cryptographic primitives are mature open-source libraries with decade-long production histories. The hardest engineering problems — streaming SHA-256 and RFC 3161 client — are solved problems. Two engineers, three weeks, production-ready.
The cryptographic technology is replicable. The moat is network effects: verified creators who embed ProofMark verification URLs in their published work, editorial and legal workflows that adopt ProofMark verification as standard practice, and C2PA ecosystem positioning as an independent certification authority. First-mover advantage in independent content certification is winner-take-most.