VASHIX
Request Early Access
VASHIX

Photo and video verification designed for Indian enterprise.

Early AccessSecure Cloud
C2PA 2.1·Encrypted·Data Protection

Product

  • Solutions
  • How It Works
  • Trust Score
  • Book a Demo
  • ROI Calculator
  • Changelog
  • Status PageOnline

Developers

  • Documentation
  • API Reference
  • Android SDK Guide
  • C2PA 2.1 Specification

Company

  • About
  • Blog
  • DPDP Compliance
  • Contact
  • hello@vashix.com
  • Careers

Vashix is in early access. Core verification is live. Compliance certifications are in progress.

© 2026 Vashix · All rights reserved

Privacy PolicyTerms of ServiceRefund & CancellationData Processing AgreementSecurityAccount Deletion

Made in India 🇮🇳

Blog/Trust Score Explained: How Vashix Rates Photo Integrity from 0 to 100
Product26 March 20268 min read

Trust Score Explained: How Vashix Rates Photo Integrity from 0 to 100

A deep dive into the deterministic 0–100 scoring system that powers every Vashix verification — the five signals, four tiers, fraud penalties, and why we chose math over AI.

When a photo arrives in your claims system or inspection dashboard, the first question is always the same: can I trust this? Is it a genuine capture from a real device at the right location and time? Or is it recycled, edited, spoofed, or generated by AI?

The Vashix Trust Score answers that question with a single number between 0 and 100. No ambiguity, no subjective review — a deterministic score computed from verifiable cryptographic and sensor signals. This article explains exactly how it works, what goes into the calculation, and what the score tiers mean for your verification workflows.

What Is the Trust Score?

The Trust Score is a number from 0 to 100 assigned to every photo captured through the Vashix system. It's computed deterministically — the same inputs always produce the same score. There's no machine learning model making probabilistic guesses. The score is the sum of verified signals minus fraud penalties.

The score answers five questions about the photo:

  1. Was it signed by real hardware? — Did the photo's signature come from a verified TEE or StrongBox chip, validated against Google's Hardware Attestation Root CA?
  2. Was the GPS trustworthy? — Is the location accurate, and was mock GPS detection active at the time of capture?
  3. Was it captured fresh? — Does it have a valid server-issued nonce, proving it wasn't a replay of an older capture?
  4. Was the device moving naturally? — Does the IMU (accelerometer + gyroscope) data show natural hand tremor, not a phone mounted on a tripod or a sensor replay?
  5. Is it bound to a workflow? — Is the photo tied to a specific claim, session, or inspection assignment?

The Scoring Formula

The Trust Score starts at 0 and adds points for each verified signal. The maximum possible score is 100.

Signal Max Points How It's Verified
Hardware Attestation 40 Certificate chain validated against Google Hardware Attestation Root CA. StrongBox gets full 40, TEE gets 30, software-only gets 15.
GPS Verification 20 Accuracy-based scoring. High-precision GPS with mock location detection active scores highest. Web uploads are capped at 4 points.
Nonce Freshness 15 Server issues a cryptographic nonce before each capture. The capture must include this nonce to prove it was taken within the allowed time window (120 seconds).
Motion / IMU Seal 15 Accelerometer and gyroscope data must show natural hand movement. A 3-frame hash sequence (before, during, after shutter) proves the device was in motion and the sensor data is consistent.
Workflow Binding 10 Photo is bound to a specific session, claim ID, or inspection assignment. Prevents orphaned captures that could be attributed to any claim.

Important: The score can also go down from fraud penalties. If the system detects that a photo is an exact duplicate of a previous submission, 40 points are deducted. Failed liveness checks deduct 20 points. Invalid watermarks deduct 15. These penalties apply on top of whatever positive score the signals earned.

The Four Tiers

The raw 0-100 score maps to four tiers. These tiers determine how your organization should treat the photo in your workflow:

90–100 GOLD

StrongBox hardware chip. Highest security level. Full chain of custody from capture to server. Suitable for auto-approval in high-value claims.

60–89 SILVER

TEE (ARM TrustZone) hardware signing. GPS and IMU verified. Suitable for standard field claims and inspections.

25–50 BRONZE

Software-only signing or browser-based capture. Limited verification. Flag for manual review. Not recommended for high-value disputes.

0–15 NOT VERIFIED

Web uploads, WhatsApp-forwarded photos, or AI-generated images. No hardware attestation, no provenance. Investigate or reject.

Why Deterministic, Not AI?

A common question: why not use machine learning to determine if a photo is genuine?

The answer is auditability. An ML model produces a confidence score based on learned patterns — but you can't explain exactly why it gave 87% instead of 92%. When you're making decisions about insurance claim payouts, legal evidence, or regulatory compliance, you need to be able to point to the exact signals that justify the score.

The Vashix Trust Score is fully decomposable. For any score, you can see: "This photo scored 84 because it received 30/40 for TEE attestation, 18/20 for GPS accuracy, 15/15 for nonce freshness, 11/15 for motion seal, and 10/10 for workflow binding." No black box. Every point is traceable to a verifiable signal.

This doesn't mean ML has no role. Server-side fraud detection uses pattern analysis for duplicate detection and geo-anomaly flagging. But the core Trust Score — the number your team acts on — is deterministic and explainable.

Why Web Uploads Can Never Score Above 38

Browsers have no access to hardware security chips, no IMU sensor data, and GPS can be spoofed in seconds via developer tools. Without hardware attestation (40 points gone), without real IMU motion seal (15 points gone), and with GPS capped at 4 points, the maximum theoretical score for a web upload is 38/100.

This ceiling is intentional and permanent. It's not a limitation we plan to "fix" — it reflects the fundamental security difference between a browser and a hardware-attested mobile device. Web uploads are useful for basic analysis (EXIF parsing, duplicate detection, AI content checks), but they can never reach the verified threshold.

Setting Your Own Thresholds

Different workflows have different risk tolerances. A routine property inspection might accept SILVER (60+) captures. A high-value motor insurance claim might require GOLD (90+). A quick delivery proof might accept BRONZE if the amount is low.

Vashix lets you set minimum tier requirements per session. When creating a capture session, you specify the minimum acceptable tier. If a capture comes in below that threshold, the dashboard flags it for review rather than auto-accepting.

What the Score Doesn't Tell You

The Trust Score verifies evidence integrity — that the photo was taken on a real device, at a real location, at a specific time, and hasn't been modified. It does not verify the content of the photo. A GOLD-scored photo proves that a specific device captured a specific scene at a specific location and time. It doesn't prove that the damage in the photo is new, or that the property in the photo is the right one.

Photo verification addresses the evidence chain. Claim validation still requires human judgment. The Trust Score removes the evidence manipulation problem so your team can focus on the business decision.

Want to see capture-time verification in action?

Learn how Vashix helps insurers prevent photo fraud at the point of capture.

Talk to UsRead the Docs
← All Articles