The ProofProfile registry answers questions about two million artists. AI assistants can now ask it questions directly.
You can ask an AI assistant whether a song existed before AI music services arrived. The AI assistant can now answer from the ProofProfile registry instead of from memory. The registry is built on CopyrightChains. On 23 October, it held 2,006,172 artists and 9,900,373 recordings, each with a Bitcoin timestamp.

Each record includes its own proof, so anyone can verify the answer without trusting the AI assistant or us.

The tools

AI assistants use small programs, called tool servers, to get information from outside sources.

ProofProfile has several of them.

They all read the same records, and each one is made for a different kind of user.

Verify and ProofProfile are for anyone who wants to know about music.

You enter a name and get the artist's registered recordings and a link to the artist's page. Each recording is identified by its ISRC, the code assigned to every commercial release.
Music publishers and collecting societies can start with the song itself, using its own code: the ISWC (where available).

Tove is for investigators.

It shows who a recording is credited to, how well the sources cover it, and who wrote and published the song. When several artists share the same name, Tove lists them all so the investigator can choose the right one.

Vinga is for the other side of a deal or a dispute.

Give it an artist's name, and it returns a ready-made document with the artist's registration, the Bitcoin block where it was recorded, the artist's best-known recordings, and simple steps to check each line yourself.

Antifraud is for distributors and streaming services.

It checks whether a release credits the same artist the registry lists for that recording. If an artist is missing from the registry, the answer is "no pre-generative record found." That statement is about the registry and says nothing about the artist.

PlaceProfile

describes what a venue feels like, based on the music it plays. It reads the venue's own playlist and sums up the atmosphere in a short phrase. An AI assistant can sort venues by time of day, so a quiet café in the afternoon and the same place at night show up as two different moods. It can also sort by the country where the recordings were registered.

Parla helps an AI assistant pick the right records for a question.

Someone looking for a calm bar early in the evening needs different information from someone checking the age of a song, and Parla matches each question to the records that answer it.

The records are the evidence.
Parla only points to them, because its choices come from an AI model.

What a timestamp proves

A Bitcoin timestamp proves that a record existed, in exactly this form, at a certain time. It does not prove who wrote a song, who owns it, when it was recorded, or whether a human made it.
None of our tools claim otherwise.

The music's age comes from the sources the records were built from, and all of them predate 2022, before AI music services appeared. If a recording is in an artist's registered catalog, it existed before the date shown beside it. If a recording is missing, it may just have been released later. A missing recording tells you nothing about how it was made.

Security update of 21 October

On 21 October, the PHP project disclosed two serious flaws in software that runs a large share of the web, including the servers behind ProofProfile. Either flaw could let a single anonymous request take over a server. If an attacker did take over a server, they still could not rewrite a registry record without breaking its Bitcoin proof, which is why the proof exists. We guard the servers as though they could.

We checked every machine the same day.

We patched each server that answered and confirmed it by inspecting every running process instead of relying on the version number the software reports.

That turned out to matter.

Our servers run Ubuntu, which patches PHP without changing its main version number, so tools that read only the number listed patched machines as unsafe.
Thor calls this his Honey trap (and by saying so publicly we hope to reduce the stress on our servers the last 24 hours, as there's no point in trying. We know who you are…)

Tighter defences

Every public ProofProfile site already sat behind a filtering network that inspects traffic before it reaches the server. Four servers could still be reached directly. All of them now accept web traffic only through that filter, so the request gets inspected first.

An AI agent carried out much of the investigation.

Thor approved each step and ran every change on the servers beyond the primary one.

We now assess exposure based on firewall settings and internal security measures (our secret).