Provenance Studio

Generate AI images, video, and audio that ship with tamper-evident proof and EU AI Act disclosure built in.

Built for the Backblaze Generative Media Hackathon: Build with Genblaze on B2.

Inspiration

We kept seeing marketing teams generate AI images and clips at volume with no record of what tool made what, when, or whether it was even AI. With the EU AI Act Article 50 disclosure rules landing on August 2, 2026, that gap turns into real legal exposure: fines up to 15 million EUR or 3 percent of global turnover. We wanted the provenance to be automatic, not a spreadsheet someone maintains by hand.

What it does

Provenance Studio takes a brief and a modality, fans the request across multiple models with Genblaze, falls back automatically if the primary stalls, and returns the result with a SHA-256 provenance manifest. Every asset and manifest is stored on Backblaze B2 with durable URLs, embedded with C2PA Content Credentials plus a visible AI-generated label, and indexed in a searchable library. Any item opens a proof panel with a one-click tamper check, and teams can export a timestamped audit report per campaign.

How we built it

Next.js 14 App Router with Tailwind and a small shadcn-style component set for the studio, library, audit, and settings views. API route handlers own the orchestration, provenance manifest building, SHA-256 hashing, C2PA claim signing, and the tamper verifier. Genblaze drives the multi-provider fan-out and fallback with GMI Cloud as the primary provider, B2 is the content-addressed store, and c2pa-python embeds the credential. Keys are bring-your-own from a settings panel and never touch the server.

Challenges we ran into

Making the compliance story legible in a 60-second demo was the hard part: we built a live orchestration trace that shows a stalled primary handing off to a fallback, and a proof panel where a judge can flip between a passing verification and a simulated tamper to see detection work. Getting the manifest, C2PA signature, and B2 content-addressing to stay internally consistent so the tamper check is deterministic took a few passes.

Accomplishments that we're proud of

Provenance and durable storage are the product, not decoration, so Genblaze and B2 are genuinely load-bearing. We hit both layers of the EU AI Act transparency model: a machine-readable C2PA credential and a visible on-media label, plus lineage tracing that walks a v3 asset back through the models it forked from.

What we learned

The unit of work in generative media is a workflow, not a single call, and treating fallback plus provenance as defaults instead of add-ons changes the whole architecture. We also learned how concrete the compliance audience is: DTC and agency teams already feel the deadline pressure.

What's next for Provenance Studio

• Wire live C2PA (c2pa-python) embedding for MP4 video, not just image and audio
• Persist the library index in Postgres backed by B2 lifecycle rules
• Team roles and per-campaign access controls for agencies
• Signed PDF audit exports alongside JSON for regulator handoff
• Webhook ingestion so assets generated in other tools inherit provenance

Built With

• backblaze-b2
• c2pa
• docker
• genblaze
• gmi-cloud
• lucide-react
• next.js-14
• react
• tailwindcss
• typescript