Trust Infrastructure for Digital Media
Designed and delivered independent trust infrastructure at TrustNXT, the trust layer for Physical AI: cryptographic data integrity from physical source to autonomous decision. Built end-to-end provenance and tamper-evidence for images and videos on a scalable serverless foundation on AWS, with multiple full stack applications. Shipped a multi-tenant whitelabel backend for tokenized capture flows and client SDKs. The platform exposes SDK APIs for certificate issuance (Protect), verification (Inspect), and RFC3161 timestamping, so operators in robotics, logistics, public safety, and the public sector can protect content at capture and allow simple public verification. Contributed to the open-source c2pa-ts to keep the platform aligned with the C2PA standard.
Project Details
Client
TrustNXT GmbH
Industry
Physical AI · Trust & Safety · Digital Media
Location
Hamburg, Germany
Services
Cloud Architecture, Full-stack Development, Security & PKI Engineering, SDK Development, DevOps, Developer Experience & Documentation
Challenge
Deliver cryptographic data integrity from physical capture to downstream decision - verifiable provenance and anti-tamper guarantees for photo/video workflows under AI manipulation and deepfake threats - while keeping capture/verification UX simple and standing up secure, auditable infrastructure from scratch.
Solution
Working closely with the CTO, we implemented AWS-native microservices, multi-tenant APIs, and deep-link flows with SSR. Cross-platform SDK APIs cover Protect (ephemeral client certificates via ACM PCA), Inspect (manifest/label verification), and RFC3161 Timestamping. iOS and Android mobile apps serve as another client for the backend, offering core functionality on mobile devices. Implemented serverless microservices architecture on AWS, developed multiple Next.js applications for different use cases, and implemented Coalition for Content Provenance and Authenticity (C2PA) specification.
Results
- Cloud and mobile app experience for protected capture and public verification
- Scalable AWS serverless infrastructure and multi-tenant APIs
- Designed and operated Trust SDK APIs: Protect (ephemeral client certificates via ACM PCA), Inspect (label verification), and RFC3161 TSA
- Built a multi-tenant whitelabel backend with token lifecycle, secure photo ingestion, inspection pipeline, and React SSR deep-link landing
- Developed TypeScript Web SDK and Kotlin Android SDK with documented flows (Fumadocs); collaborated on iOS SDK without owning the iOS app
- Set up developer experience and observability: CloudWatch dashboards/alarms, Slack ChatOps, Swagger UI, LocalStack
- Contributed to open-source c2pa-ts (TypeScript C2PA implementation by TrustNXT), aligning product with industry standards
- Enabled enterprise and public-sector demos and pilots for tamper-evident capture and verification