For special investigations units, SIU vendors, independent adjusters and insurance defense counsel. General investigator and OSINT page →

For insurance SIU, fraud ops, adjusters and defense counsel

Claimant posted something that contradicts the claim? Seal it before it comes down.

ProofSnap turns a publicly visible profile, post or listing into a sealed evidence package: every file hashed with SHA-256, the manifest signed with RSA-4096, the hash anchored in Bitcoin, and an ISO/IEC 27037 style chain of custody attached. About 41 seconds per capture.

Workers comp, disability, auto, property, liability. The screenshot in the file is the part claimant's counsel attacks first, and two federal courts have already refused screenshots for want of authentication.

1Open the public page 2Capture, about 41 seconds 3Attach the ZIP to the claim file

The report leaves under your own firm's branding, and the carrier, the state fraud bureau or opposing counsel can verify the package offline, without you and without us.

Want to see the deliverable first? Download a sample evidence package and run the verification script yourself before you sign up.

A better capture does not widen what you may collect. ProofSnap captures what your browser is lawfully displaying. Public surface only: no friend requests, no pretext accounts, nothing behind a privacy setting.

$18.99 per seat per month · minimum two seats, no upper limit · no sales call

Illustrative example. The same public post, captured twice: once as pixels, once as a record that carries its own proof of where it came from and when.

By Radim Motycka, Founder and Lead Engineer, ProofSnap Updated August 15, 2026
$18.99
per seat per month
41 sec
per sealed capture
902(14)
self-authentication ready
27037
ISO/IEC chain of custody
SHA-256 and RSA-4096 on every capture Offline verification, no vendor lock-in Disig a.s., QTSP on the EU Trusted List Bitcoin OpenTimestamps anchor

Every package can be verified by anyone, for free, in the open Trust Verifier.

Quick answer

How does an SIU desk preserve claimant social media so it holds up?

Capture the publicly visible page as a sealed package rather than an image. ProofSnap records the page, the response headers, the DNS resolution, the WHOIS record and the TLS certificate, verifies the time against NTP and hashes every file with SHA-256. An ISO/IEC 27037 style chain of custody travels with it, under your firm's branding. $18.99 per seat.

What it proves: that the page existed in that exact state at that time, and that the package has not changed since it was sealed. What it does not prove: who controls the account. Authorship is built from admissions, discovery and device evidence, not from the capture. ProofSnap is an evidence tool, not legal advice, and it does not widen what an investigator may lawfully collect.

Reviewed by digital-evidence practitioners · Reading time: about 7 minutes

Why the screenshot in the claim file keeps losing.

The investigator finds it, screenshots it, drops the PNG into the file, and writes the referral memo. Nine times out of ten nobody objects, because the claim settles. The tenth time, claimant's counsel asks the only question that matters: how do we know this image reflects what was actually on that page, on that date? Under Federal Rule of Evidence 901(a) the proponent has to produce evidence sufficient to support a finding that the item is what it is claimed to be, and a bare image supports nothing. It has no source URL, no server response, no verified capture time, and it is trivially editable by anyone with a browser's developer tools before the capture is even taken.

Two federal decisions are worth keeping in the file for anyone who thinks this is theoretical. In Moroccanoil, Inc. v. Marc Anthony Cosmetics, Inc., 57 F. Supp. 3d 1203 (C.D. Cal. 2014), the court would not admit Facebook screenshots because there was no way to establish that they were an accurate representation of the live page. In Linscheid v. Natus Medical Inc., 2015 WL 1470122 (N.D. Ga. Mar. 30, 2015), a printed LinkedIn profile failed authentication because no adequate effort had been made to authenticate it at all. Neither case turned on the content being false; both turned on the form in which it was offered.

“Data copied from an electronic device, storage medium, or file, if authenticated by a process of digital identification, as shown by a certification of a qualified person that complies with the certification requirements of Rule 902(11) or (12).”
Federal Rule of Evidence 902(14), Legal Information Institute, Cornell Law School. Hashing is the process of digital identification the rule contemplates.

The rule you want to be arguing under

Rule 901(b)(4) lets an item be authenticated by its distinctive characteristics, taken together with all the circumstances. That is the door a forensic capture walks through: the URL as requested, the HTTP response the server actually returned, the DNS resolution at that moment, the TLS certificate, the capture time verified against NTP, and a hash of every artifact. Rules 902(13) and 902(14) then allow that record to be self-authenticating on a certification, removing the need for live foundation testimony. Getting to 902 is not about the tool being clever. It is about the capture producing facts a qualified person can certify.

What a screenshot carries

  • • Pixels
  • • A file creation date the operating system will happily change
  • • The investigator's word about where it came from

What a ProofSnap capture carries

  • • Full page screenshot plus the page HTML as served and the DOM text
  • • The requested URL, the HTTP response headers, the TLS certificate detail
  • • DNS resolution cross-checked against two independent resolvers, plus WHOIS or RDAP for the domain
  • • Capture time verified against NTP, not the workstation clock
  • • SHA-256 of every file, an RSA-4096 signed manifest and the public key
  • • A Bitcoin OpenTimestamps anchor, and optionally an eIDAS qualified RFC 3161 timestamp
  • • A chain of custody document whose log entries are linked in a hash chain

The number the desk already knows

Fraud volume is not the constraint. Evidence quality is.

Published figures, cite-ready

$308.6B

Annual cost of insurance fraud to the US economy, Coalition Against Insurance Fraud, 2022 study

£1.16B

Fraudulent UK general insurance claims detected in 2024, Association of British Insurers

98,400

UK fraud-related claims uncovered in 2024, up 12% from 2023 (ABI)

9,400+

Public fraud reports to the IFB CheatLine in 2024, the highest annual figure on record

01

The post disappears

The moment a claimant senses that a post is a problem, it comes down. Preservation on the day of discovery is the whole game, and a screenshot taken in a hurry is exactly the artifact that will be attacked later. The capture that seals itself at the moment of discovery removes that argument entirely.

02

The file travels

An SIU file rarely stops at the desk. It goes to the carrier's counsel, to a state fraud bureau referral, to the NICB, and sometimes to a prosecutor. Each hop is a chance for someone to ask who handled the evidence and when. A hash-chained custody log answers that in writing rather than from memory.

03

The vendor delivers

If you are an SIU vendor, an independent adjuster or a PI on carrier assignment, the report is your product. A report carrying a capture tool's branding tells the client which tool you bought. A report carrying yours tells them what you do.

Claim intake to referral

5 steps. About 41 seconds per capture.

  1. 1

    Open the publicly visible page

    The claimant's public profile, a specific post, a marketplace listing, a race result, a team roster, a tagged event photo, a fundraiser page, a contractor's promotional post. Whatever the file references, in your own browser, without any request to connect.

  2. 2

    Capture

    One click in the side panel. The extension scrolls and stitches the full page, saves the HTML as served and the DOM text, records the HTTP response headers with authentication and cookie headers stripped, resolves DNS against two independent resolvers and flags any disagreement, pulls WHOIS or RDAP, reads the TLS certificate and anchors the clock to NTP rather than trusting the workstation. Sticky headers, cookie banners and infinite recommendation feeds are neutralized for the capture and every one of those interventions is disclosed in the chain of custody.

  3. 3

    Seal

    Every file is hashed with SHA-256. The manifest listing those hashes is signed with a freshly generated RSA-4096 key and the public key ships alongside it. The manifest hash is anchored to the Bitcoin blockchain through OpenTimestamps. On Enterprise and Company plans the package also carries an eIDAS qualified RFC 3161 timestamp from Disig a.s., a Qualified Trust Service Provider on the EU Trusted List, which matters for any claim with a European leg.

  4. 4

    Attach to the claim file

    One ZIP, 11 to 15 files depending on plan and options, including the evidence PDF under your own branding and a verification folder with scripts and a written guide. Attach it in the carrier's claims system alongside the referral memo. It is a single artifact, so nothing gets separated in transit.

  5. 5

    Refer or litigate

    Cite the capture in the SIU referral, the NICB submission, the state fraud bureau referral or the pleading. Whoever receives it can verify the hashes, the signature and the timestamp offline using python3, openssl and an OpenTimestamps client, or in the browser at the Trust Verifier. Nothing in that verification runs through ProofSnap, so nobody has to take the investigator's word for it, and nobody has to call the investigator to the stand to establish the basics.

Whitelabel reporting

The report reaches the carrier under your name, not ours.

On the Enterprise plan, and for the administrator on the Company plan, the evidence PDF is generated with your logo, your primary color, your firm name, your address and your contact email in place of the default ProofSnap header. Everything cryptographic inside the package stays exactly the same. Only the document the client actually reads changes.

SIU vendors and IA firms

The deliverable to the carrier is your investigative report. The capture tool is your production line, and there is no reason for the client to be reading its brand name on every page of your work product.

In-house carrier SIU

The report goes out under the carrier's own identity into the claim file, the referral packet and, when it gets that far, the exhibit list. A consistent document header across a thirty-investigator desk is a small thing that reviewers notice.

Defense counsel

The exhibit carries the firm's letterhead, and the underlying package carries the hash, the signature and the timestamp that make the exhibit stand on its own under Rules 902(13) and 902(14).

Branding is configured once in the extension under Whitelabel settings: logo upload up to 2 MB, primary color, firm name, address, contact email. The structured JSON files inside the package stay in their standard form, because they are read by verification tooling rather than by people.

The deliverable

11 to 15 files, one ZIP, verifiable without us.

Always in the package

  • screenshot.jpeg
  • page.html
  • domtextcontent.txt
  • metadata.json
  • evidence.pdf (your branding)
  • forensic_log.json
  • forensic_log_summary.txt
  • chain_of_custody.json
  • manifest.json
  • manifest.sig
  • publickey.pem
  • verification/verify.sh
  • verification/verify.ps1
  • verification/VERIFICATION_GUIDE.txt

Added by plan or option

  • manifest.json.ots Bitcoin OpenTimestamps anchor on the manifest hash
  • rule_902_certification.pdf a fill-in declaration template for a US filing, with every fact populated and the declarant identity and signature left blank
  • manifest.json.tsr and eidas_validation.json eIDAS qualified RFC 3161 timestamp with the TSA chain, root CA, OCSP and CRL for offline long-term validation
  • c2pa.json Content Credentials sidecar for the screenshot
  • capture_video.webm screen recording of the capture itself
  • tabs/<page>/ a full per-page bundle for each tab when a multi-tab session is captured

The verification scripts are generic. They read manifest.json at runtime rather than hard-coding anything, they verify themselves before verifying the package, and they work on a multi-tab capture as well as a single page. Verification needs python3, openssl and an OpenTimestamps client, none of which is ours.

Against the tools SIU desks already look at

Same defensibility, self-serve, and the only price you can actually read.

  ProofSnap Page Vault WebPreserver (Pagefreezer) Hunchly (Maltego)
Price you can read without a sales call $18.99 per seat per month, or $190 per seat per year Not published. Quote only. Outsourced capture from $199 per website, $349 per social profile Quote only About $130 per year
How you buy it Self-serve, 7-day trial (card required) Sales process, demo Sales process, demo Self-serve
Cryptographic hash and digital signature SHA-256 on every file, RSA-4096 signed manifest Yes Yes, SHA-256 Hashing, no signed evidence package
Independent time anchor Bitcoin OpenTimestamps, plus eIDAS qualified RFC 3161 on Enterprise and Company Vendor timestamp Vendor timestamp Local capture time
Verification without the vendor python3, openssl and an ots client, plus a browser verifier Vendor platform Vendor platform Local case file
Report under your own firm branding Yes, on Enterprise and for the Company admin Vendor-branded Vendor-branded Not applicable
EU statutory weight eIDAS qualified timestamp from Disig a.s., a Qualified Trust Service Provider on the EU Trusted List US-oriented Not a qualified timestamp No

What a year of capturing costs one investigator

Page Vault publishes no subscription price at all. Its browser packages are listed as Solo, Team, Professional and Enterprise with a Request Pricing button and the line “for higher-limit plans, please contact sales.” The only figures it does publish are for outsourced capture: websites start at $199 and social media profiles start at $349, per project. So the honest comparison is not between two subscription prices, because only one of them exists in public. It is this: a full year of ProofSnap for one investigator costs $190, which is less than a single outsourced website capture from Page Vault, and it covers every capture that investigator makes in those twelve months. A ten-investigator desk is $1,900 a year, reachable with a credit card and no negotiation. Figures read from page-vault.com/pricing in August 2026; its subscription tiers may well be competitive, but a buyer cannot find out without a sales call.

Honest framing: Page Vault and WebPreserver are mature, court-oriented products with long track records and features ProofSnap does not have, including managed capture services and large-scale archiving. Many desks will keep them. The argument here is narrower: for the specific job of preserving a claimant's public page so the capture survives an authentication challenge, ProofSnap does it with the same cryptographic backing, adds an independent blockchain anchor and an EU qualified timestamp, ships the report under your branding, and does not require a procurement cycle to start.

Pricing

Priced per seat, so the desk can budget it for the year.

Evaluate

$4.99

SnapPack, 10 captures

A one-time purchase with no subscription and no auto-renewal, bought inside the extension after sign-up. Enough to run a real case through the workflow before committing a team.

SIU teams

$18.99 per seat per month

Company plan, or $190 per seat per year

Minimum two seats, no upper limit. Shared company workspace, per investigator accounts, whitelabel branding managed by the administrator, and 5 eIDAS qualified timestamps per user per month.

Solo investigator

$28.99 per month

Enterprise, single seat

Whitelabel branding on a single account and 10 eIDAS qualified timestamps per month. The right fit for an independent adjuster or a PI taking carrier assignments.

Company plan cost by desk size
Desk size Monthly Annual license
2 investigators$37.98$380
5 investigators$94.95$950
15 investigators$284.85$2,850
30 investigators$569.70$5,700
50 investigators$949.50$9,500

All prices are charged in US dollars. The 7-day trial requires a credit card and can be canceled at any point during the trial at zero cost. Captures on subscription plans carry no per capture surcharge. Additional eIDAS qualified timestamps beyond the monthly allowance are available as one-time purchases from $6.99, and 10 for $49.99.

The tool itself

This is the whole interface.

No procurement cycle and no onboarding. A side panel in Chrome or Edge with one button that matters, deployable across an SIU desk through the same group policy you already use for every other extension.

The ProofSnap side panel in Chrome: capture page snapshot button, case and examiner details, evidence language selector, capture visible area only, record capture video, EU qualified eIDAS timestamp toggle, Trust Verifier and File Certifier

The side panel, actual size relative to a browser window.

Capture page snapshot

The one button that does the work. Scrolls and stitches the full page, saves the HTML as served and the DOM text, records the response headers, DNS, WHOIS and TLS, checks the clock against NTP, hashes everything and signs it. About 41 seconds.

Case and examiner details

Optional matter reference and examiner identity, written into the evidence PDF and the chain of custody so the package identifies the file it belongs to without a covering note.

Evidence language

The evidence PDF can be exported in a different language from the interface, which matters when the investigator and the tribunal do not share one. The structured JSON files stay in their standard form for verification tooling.

Whitelabel branding

A toggle, not a professional services engagement. Your logo, color, firm name, address and contact email replace the default header on the evidence PDF. Enterprise, and the administrator on the Company plan.

Record capture video

Records the capture as it happens and puts the recording inside the sealed package, which answers the question of what the operator did between opening the page and producing the file.

EU qualified timestamp

One toggle adds an eIDAS qualified RFC 3161 timestamp from Disig a.s., a Qualified Trust Service Provider on the EU Trusted List. The counter shows the remaining allowance on the plan.

Trust Verifier and File Certifier sit in the same panel. The verifier checks any ProofSnap package, including one somebody else produced, so the receiving side can validate without installing anything of their own. The certifier seals files you already hold, such as an export, a photograph or a PDF, rather than a web page. Nothing here needs configuration before the first capture.

Questions SIU desks actually ask

FAQ

Put the next claimant lead in a package that holds.

Install the extension, capture one public page, open the ZIP and run the verification script yourself. If the package does not do what this page says it does, you have spent nothing but seven days.

Start the 7-day trial

Credit card required. Cancel any time during the trial at zero cost. Or buy a $4.99 SnapPack for 10 captures with no subscription and no auto-renewal.

Disclaimer: This page provides general information about preserving publicly available social media content as evidence in insurance fraud investigations. It is not legal advice, claims handling advice, investigator licensing advice or fraud investigation training. ProofSnap is not a law firm and does not act as an expert witness. Admissibility of any item of evidence, and any claim-handling decision to settle, refer or deny, remain with the investigator, the carrier, counsel and the court on a case-by-case basis. Case citations are provided for orientation and should be read in full before being relied on. Published competitor prices and industry statistics are current as of August 2026 and should be verified before use.

Start 7-day trial →

$18.99 per seat per month · card required · cancel any time