practice / data · verification

Verified human data. A record on every item, not a badge on the box.

Anyone can print the word verified on a dataset card. This page is what the word means when eeko uses it: nine layers of checks, records, and signatures, built as each item moves from intake through review to delivery, that travel with the data and can be checked without trusting us.

Nine layers per item Ed25519 signed Independently timestamped Receipt by hash
Hero image · 840 × 1050
checks per item
9layers
from fingerprint to receipt
consent recorded
100%
a release or licence bound to every item
signed receipts
1/order
every item by ID and hash
scraped items
0ever
nothing taken without permission

What is verified human data?

Verified human data is training data where three claims are backed by evidence rather than assertion: that a specific person or organisation made the item, that they agreed in writing to its use for AI, and that the item is what it was declared to be, human-made rather than generated, original rather than copied, reviewed rather than merely uploaded. The evidence is attached to the item itself, not kept in a spreadsheet somewhere, and it stays attached when the item is delivered.

The need is not theoretical. Training data is now examined by regulators, by opposing counsel in discovery, and by customers running their own diligence. A vendor's assurance that the data is "clean" answers none of them. A per-item record that a third party can check does.

eeko applies the same record to everything the data practice ships: custom datasets, annotation of your own data, recordings from capture projects, and licensed catalogue work. It is also what makes the practice safe to build on; the agents and retrieval systems we deploy into regulated companies are trained and evaluated on data that can survive the same compliance review as the systems themselves.

Verification layers image · 2100 × 900
Nine layers, applied in order, each leaving an entry in a signed, hash-chained audit trail that ships with the item.

Training data provenance, layer by layer.

What happens to an item between the moment it arrives and the moment it ships, and what each step lets you prove afterward.

01 / identityCORE
Fingerprint
On arrival each file gets an exact SHA-256 hash plus perceptual fingerprints suited to its type: crop-tolerant hashes for images, acoustic prints for audio, hashes per frame for video, and text or shape prints for documents and 3D models. A re-encoded or cropped copy is still recognised.
  • SHA-256 and perceptual hashes
  • Frame hashes, acoustic fingerprints
02 / uniquenessCORE
Duplicate and conflict check
Every upload is compared with everything registered before it. A match to someone else's earlier item is flagged, both parties hear about it, and the newer item is held out of every dataset until a reviewer settles the conflict.
  • Exact and near-duplicate matching
  • Held pending review, resolution logged
03 / originHUMAN
Human-origin check
Each item carries a declaration: made by a person, made with AI help, or generated outright. We read what the file says about itself, including generator signatures in EXIF and XMP, the IPTC digital-source-type field, and any C2PA generation record, and a detected generator wins over the declaration.
  • EXIF/XMP, IPTC, C2PA detection
  • Detected origin beats declared origin
04 / consentCORE
Consent and rights, bound to the item
The training permission, the licence terms, and any releases for people or property are attached to the item itself. Work that shows a person is offered for training only when that person's consent is on record.
  • Releases and training permission per item
  • Licence scope, term, exclusivity
05 / safetyPRIVACY
Safety and personal-data screen
Every upload passes a hash block-list and a safety classifier. Documents and tables get a personal-data scan, and whatever it finds is masked before delivery, with the masking logged. Location metadata is stripped at intake.
  • Block-lists and safety classifier
  • Personal data masked, masking recorded
06 / reviewEXPERTS
Expert review, source recorded
Labels written or checked by a verified specialist are marked expert-reviewed, separately from what the owner declared and from anything a model suggested. You always know which of the three said what about an item.
  • Label source: expert, owner, or model
  • Second-expert pass on an agreed share
07 / signatureSIGNED
Signed provenance record
Every item carries a provenance record signed with the eeko registry key using Ed25519, and every change afterward is appended to a hash-chained, signed audit trail. Where the format allows, a C2PA manifest with the same facts is embedded in the file.
  • Ed25519 signature, published key
  • Hash-chained audit trail, C2PA manifest
08 / timestampANCHORED
Independent timestamp
The SHA-256 of each original is committed to the Bitcoin blockchain through OpenTimestamps. When the file existed can then be proven by anyone holding the file and the proof, without asking eeko and without trusting our clock.
  • OpenTimestamps proof per original
  • Verifiable with any public client
09 / receiptDELIVERY
Delivery marks and signed receipt
Licensed deliveries carry a forensic mark that names the delivery, and every order ships with a signed receipt that names each item and its hash. What you received, and that you received it, is on the record for both sides.
  • Forensic mark per delivery
  • Receipt, item by item, hash by hash

A provenance record being built.

An illustrative record for one photograph entering the catalogue. Each line is an entry in the item's signed audit trail.

// item-2m9x.record audit.chain receipt.sig
tail -f
00:00 INTAKE Camera original received from a registered photographer. SHA-256 and crop-tolerant perceptual hash computed.image/jpeg · 6240 × 4160 · EXIF intact HASHED
00:00 ORIGIN Declared human-created. EXIF, XMP, IPTC source type, and C2PA inspected; no generator signature, camera make and lens recorded.declaration stands HUMAN
00:01 DEDUPE One near match by perceptual hash: an earlier upload by the same photographer. Linked as a variant, not blocked.same rights holder LINKED
00:02 CONSENT Model release for the person pictured attached. Training permission and licence terms attached: training and evaluation, non-exclusive, perpetual.release ref · licence ref BOUND
03:15 REVIEW Dense caption and attribute labels written by a verified reviewer, checked by a second. Both authors recorded on the labels.label source: expert-reviewed REVIEWED
03:16 SIGN Provenance record signed with the registry key. C2PA manifest embedded. Hash submitted to OpenTimestamps; Bitcoin confirmation pending.Ed25519 · C2PA · OTS proof queued SIGNED
on order DELIVER Delivery copy marked with the order identifier. Item listed on the signed receipt by ID and hash alongside everything else in the order.receipt countersigned by the buyer RECEIPTED

When the question comes, an answer or a document.

A regulator, a litigator, or a customer asks where the training data came from. Here is what each kind of data lets you say.

unverified data
What you can say

The vendor said it was fine. Nobody can name the source of an item, show the permission for it, prove a human made it, or show when it existed. The delivery was a folder.

  • Source Unknown
  • Permission Assumed
  • Human-made Unchecked
  • Duplicates Likely, unresolved
  • Date Unprovable
  • Delivery A folder
eeko verified data
What you can show

For any item: the named, consenting rights holder; the signed licence for this use; the checked origin; the fingerprint comparison; a timestamp anchored outside eeko; and the receipt that lists the item by hash.

  • Source Named, consenting rights holder
  • Permission Signed licence, per item
  • Human-made Declared, checked, recorded
  • Duplicates Fingerprinted and resolved
  • Date Independently anchored
  • Delivery Signed receipt, item by item

Four things you can verify without calling us.

A record that only eeko can read is not much of a record. Every layer that matters can be checked with public tools and the files in your delivery.

CHECK 01
Recompute the hashes
Hash each delivered file with SHA-256 and compare it with the receipt and the provenance record. A mismatch means the file is not the one we signed for.
CHECK 02
Verify the signatures
Check the Ed25519 signature on the provenance record, the audit trail, and the receipt against the published eeko registry key. Any altered entry fails.
CHECK 03
Confirm the timestamp
Run the OpenTimestamps proof for any original through a public client. It resolves to a Bitcoin block, which fixes the earliest date the file is known to have existed.
CHECK 04
Read the manifest
Open the embedded C2PA manifest with a standard content-credentials tool to see the same origin, consent, and review facts carried inside the file itself.

Declared, signed, anchored, and honest about limits.

Audit review image · 1200 × 900
The record is built for the reader who does not trust us yet: counsel, a regulator, a customer's security team.

How the registry behaves

  • Declared — each item's answer on AI training is published where machines look for it: metadata, response headers, robots rules, and a text-and-data-mining reservation. Nobody has to guess.
  • Signed — every record carries the registry key's signature, so a changed byte in any entry is detectable by anyone with the public key.
  • Anchored — timestamps live in a public blockchain that eeko does not control and cannot edit.
  • Honest — a registration is evidence; it is not a legal ruling. Our licences and terms say what the technology proves and what it does not, in plain language.

The same commitments apply whether the item came from a creator licensing their work, a company selling its archive, or a worker in a capture program.

The same proof, whatever the file is.

Fingerprints are chosen to fit the format, so a copy is caught whether it was cropped, re-encoded, trimmed, or transcribed.

Audio verification image · 800 × 1000
Audio — acoustic fingerprint, speaker release, linguist review. See speech and audio datasets.
Video verification image · 800 × 1000
Video — per-frame hashes, releases for everyone in frame, protocol review. See video datasets.
Document verification image · 800 × 1000
Documents — text fingerprints, schema, masking log, signed record. See document datasets.

Robot episodes are hashed per stream with the operator agreement bound to them; 3D files get shape prints that catch re-exports; text gets prints that find near-copies, with author, reviewer, and rubric version on every demonstration. See teleoperation data and 3D and CAD datasets.

Verification questions.

What does verified mean for training data?

At eeko it means nine specific things happened to the item and each left a record: it was fingerprinted, checked against everything already registered, checked for human origin, bound to its consent and licence terms, screened for safety and for personal data, reviewed by a verified expert, signed, independently timestamped, and listed on a signed receipt. Verified is not a label we attach; it is the sum of those records, and you can inspect every one of them.

How do you detect AI-generated content in a dataset?

Every item declares its making: by a person, with AI assistance, or by a generator. We then look for evidence that contradicts the declaration. Generator signatures in EXIF and XMP metadata, IPTC digital-source-type fields, and embedded C2PA generation records are read automatically, and any of them overrides a human-made claim. The detection is logged on the item, so a buyer can see what was found. Synthetic content is not forbidden, but it is never allowed to pass as human.

What is a signed provenance record?

A structured statement about one item, covering its hashes, its declared and detected origin, its consent and licence references, who reviewed it, and when each of those facts was recorded, signed with the eeko registry key using Ed25519. Every later change to the item is appended to a hash-chained audit trail that is signed the same way, so tampering with any entry breaks the chain. Where the file format supports it, a C2PA manifest carrying the same facts is embedded in the file.

Why anchor timestamps in a public blockchain?

Because a timestamp we issue ourselves only proves what we say. Through OpenTimestamps, the SHA-256 of each original is committed into the Bitcoin blockchain, which nobody, including eeko, can rewrite. Anyone holding the file and the proof can confirm that the file existed by that date without asking us or trusting our systems. For disputes about who made something first, or whether a file predates a model, that independence is the point.

Is a verification record legal proof of ownership?

No, and we say so plainly. Registration with eeko is evidence: it shows what a file looked like, who declared what about it, and when. It is not a copyright ruling and it does not settle disputes by itself. What it gives you is a documented chain you can put in front of counsel, a regulator, or an opposing party, in place of an assurance from a vendor. Our licences and terms are written to be understood, including what the technology cannot do.

What happens when a duplicate is found?

Each upload is matched by exact hash and by perceptual fingerprint against everything already registered, so a crop, a re-encode, or a trimmed clip of an earlier file is still caught. When a match is found, both parties are told, the newer item is flagged, and it stays out of every dataset until a reviewer resolves the conflict. The resolution is written into both items' audit trails, so a buyer can see that it happened and how.

Can we audit the verification ourselves?

Yes. Recompute the SHA-256 of each file and compare it with the receipt. Verify the Ed25519 signature on the provenance record and the audit trail with the published registry key. Check each timestamp proof against the blockchain with any OpenTimestamps client. Open the C2PA manifest with a standard content-credentials tool. None of those steps need eeko to be online or cooperative, which is what makes the record worth having.

Data you can defend.

Tell us what the model needs. Everything we deliver carries the nine layers above, and a data lead replies inside one business day to walk you through the record on a real sample. No deck. A sample and its audit trail.

Experienced within

  • SOC 2 Type II
  • ISO 27001
  • HIPAA
  • HITRUST r2
  • ISO 27701
  • PCI DSS
  • NIST CSF 2.0
  • CMMC
  • FedRAMP
  • GDPR

Markets served.

As an enterprise AI agency, eeko systems delivers production AI systems remote-first across the United States and internationally — including these markets:

New York City, New York (NY)

Los Angeles, California (CA)

Chicago, Illinois (IL)

Houston, Texas (TX)

Phoenix, Arizona (AZ)

Philadelphia, Pennsylvania (PA)

San Antonio, Texas (TX)

San Diego, California (CA)

Dallas, Texas (TX)

San Jose, California (CA)

Austin, Texas (TX)

Jacksonville, Florida (FL)

Fort Worth, Texas (TX)

Columbus, Ohio (OH)

Charlotte, North Carolina (NC)

Indianapolis, Indiana (IN)

San Francisco, California (CA)

Seattle, Washington (WA)

Denver, Colorado (CO)

Washington, District of Columbia (DC)

Boston, Massachusetts (MA)

El Paso, Texas (TX)

Nashville, Tennessee (TN)

Detroit, Michigan (MI)

Oklahoma City, Oklahoma (OK)

Portland, Oregon (OR)

Las Vegas, Nevada (NV)

Memphis, Tennessee (TN)

Louisville, Kentucky (KY)

Baltimore, Maryland (MD)

Milwaukee, Wisconsin (WI)

Albuquerque, New Mexico (NM)

Tucson, Arizona (AZ)

Fresno, California (CA)

Sacramento, California (CA)

Kansas City, Missouri (MO)

Atlanta, Georgia (GA)

Miami, Florida (FL)

Colorado Springs, Colorado (CO)

Raleigh, North Carolina (NC)

Omaha, Nebraska (NE)

Long Beach, California (CA)

Virginia Beach, Virginia (VA)

Oakland, California (CA)

Minneapolis, Minnesota (MN)

Tulsa, Oklahoma (OK)

Arlington, Texas (TX)

New Orleans, Louisiana (LA)

Wichita, Kansas (KS)

Cleveland, Ohio (OH)

Tampa, Florida (FL)

Bakersfield, California (CA)

Aurora, Colorado (CO)

Honolulu, Hawaii (HI)

Anaheim, California (CA)

Santa Ana, California (CA)

Corpus Christi, Texas (TX)

Riverside, California (CA)

Lexington, Kentucky (KY)

St. Louis, Missouri (MO)

Stockton, California (CA)

Pittsburgh, Pennsylvania (PA)

Saint Paul, Minnesota (MN)

Cincinnati, Ohio (OH)

Greensboro, North Carolina (NC)

Anchorage, Alaska (AK)

Plano, Texas (TX)

Lincoln, Nebraska (NE)

Orlando, Florida (FL)

Irvine, California (CA)

Newark, New Jersey (NJ)

Toledo, Ohio (OH)

Durham, North Carolina (NC)

Chula Vista, California (CA)

Fort Wayne, Indiana (IN)

Jersey City, New Jersey (NJ)

St. Petersburg, Florida (FL)

Laredo, Texas (TX)

Madison, Wisconsin (WI)

Chandler, Arizona (AZ)

Buffalo, New York (NY)

Lubbock, Texas (TX)

Scottsdale, Arizona (AZ)

Reno, Nevada (NV)

Glendale, Arizona (AZ)

Gilbert, Arizona (AZ)

Winston-Salem, North Carolina (NC)

North Las Vegas, Nevada (NV)

Norfolk, Virginia (VA)

Chesapeake, Virginia (VA)

Fremont, California (CA)

Garland, Texas (TX)

Richmond, Virginia (VA)

Baton Rouge, Louisiana (LA)

Boise, Idaho (ID)

San Bernardino, California (CA)

Spokane, Washington (WA)

Des Moines, Iowa (IA)

Modesto, California (CA)

Birmingham, Alabama (AL)

Tacoma, Washington (WA)

Fontana, California (CA)

Oxnard, California (CA)

Fayetteville, North Carolina (NC)

Huntsville, Alabama (AL)

Moreno Valley, California (CA)

Rochester, New York (NY)

Glendale, California (CA)

Yonkers, New York (NY)

Augusta, Georgia (GA)

Amarillo, Texas (TX)

Little Rock, Arkansas (AR)

Akron, Ohio (OH)

Shreveport, Louisiana (LA)

Grand Rapids, Michigan (MI)

Mobile, Alabama (AL)

Salt Lake City, Utah (UT)

Huntsville, Texas (TX)

Tallahassee, Florida (FL)

Overland Park, Kansas (KS)

Knoxville, Tennessee (TN)

Worcester, Massachusetts (MA)

Brownsville, Texas (TX)

New Port Richey, Florida (FL)

Jackson, Mississippi (MS)

Providence, Rhode Island (RI)

Fort Lauderdale, Florida (FL)

Sioux Falls, South Dakota (SD)

Tempe, Arizona (AZ)

Cape Coral, Florida (FL)

Springfield, Missouri (MO)

Pembroke Pines, Florida (FL)

Eugene, Oregon (OR)

Peoria, Arizona (AZ)

Corona, California (CA)

Lancaster, California (CA)

Rockford, Illinois (IL)

Salinas, California (CA)

Palmdale, California (CA)

Springfield, Massachusetts (MA)

Charleston, South Carolina (SC)

Duluth, Minnesota (MN)

London, England (ENG)

Dublin, Ireland (IRE)