Security & Trust

• C2PA Signer processes supported media files directly in the local extension environment.
• Verification and signing workflows are designed to run locally, without uploading your files to a C2PA Signer backend.
• The extension may read selected local files, visible media on the current tab, and signing material that you explicitly import or generate.

• When you select or drop a file into the extension, the file is used only for the requested action: verify, inspect, or sign.
• C2PA Signer does not use your files for advertising, profiling, training, or unrelated analytics.

• C2PA signing requires a certificate and private key. C2PA Signer supports test certificates for development and demo workflows, and may support imported signing material such as .p12 or .pfx files.
• Private keys should always be handled carefully. Do not import production signing credentials into environments you do not control.

The CAI documentation recalls that an X.509 v3 certificate and a key conforming to C2PA requirements are needed to sign claims, and recommends protecting private keys with a high level of security.

• A test certificate is useful for learning, demos and internal validation.
• It can show how a C2PA signing workflow works, but it does not mean the signature is publicly trusted.
• For production trust, organizations should use certificates issued through the C2PA trust ecosystem.

• C2PA Signer requests only the permissions needed to provide its core features: file verification, local signing, page media scan, context menu actions, download of signed files, and local settings.
• Permissions are not used for advertising, tracking, profiling, or unrelated browsing history collection.

Store review guidelines recommend requesting the narrowest possible permissions, and permissions must be consistent with the single purpose of the extension.