For insurance SIU, fraud ops, adjusters and defense counsel
Claimant posted something that contradicts the claim? Seal it before it comes down.
ProofSnap turns a publicly visible profile, post or listing into a sealed evidence package: every file hashed with SHA-256, the manifest signed with RSA-4096, the hash anchored in Bitcoin, and an ISO/IEC 27037 style chain of custody attached. About 41 seconds per capture.
Workers comp, disability, auto, property, liability. The screenshot in the file is the part claimant's counsel attacks first, and two federal courts have already refused screenshots for want of authentication.
The report leaves under your own firm's branding, and the carrier, the state fraud bureau or opposing counsel can verify the package offline, without you and without us.
Want to see the deliverable first? Download a sample evidence package and run the verification script yourself before you sign up.
A better capture does not widen what you may collect. ProofSnap captures what your browser is lawfully displaying. Public surface only: no friend requests, no pretext accounts, nothing behind a privacy setting.
$18.99 per seat per month · minimum two seats, no upper limit · no sales call
D. Miller
Public post · 3 days ago
Back on the water at last. Hauled the boat out solo this morning, shoulder held up fine. Best weekend in months.
Saved as screenshot.png
No source URL
No verified capture time
No server response, no integrity record
Illustrative example. The same public post, captured twice: once as pixels, once as a record that carries its own proof of where it came from and when.
Every package can be verified by anyone, for free, in the open Trust Verifier.
Quick answer
How does an SIU desk preserve claimant social media so it holds up?
Capture the publicly visible page as a sealed package rather than an image. ProofSnap records the page, the response headers, the DNS resolution, the WHOIS record and the TLS certificate, verifies the time against NTP and hashes every file with SHA-256. An ISO/IEC 27037 style chain of custody travels with it, under your firm's branding. $18.99 per seat.
What it proves: that the page existed in that exact state at that time, and that the package has not changed since it was sealed. What it does not prove: who controls the account. Authorship is built from admissions, discovery and device evidence, not from the capture. ProofSnap is an evidence tool, not legal advice, and it does not widen what an investigator may lawfully collect.
Why the screenshot in the claim file keeps losing.
The investigator finds it, screenshots it, drops the PNG into the file, and writes the referral memo. Nine times out of ten nobody objects, because the claim settles. The tenth time, claimant's counsel asks the only question that matters: how do we know this image reflects what was actually on that page, on that date? Under Federal Rule of Evidence 901(a) the proponent has to produce evidence sufficient to support a finding that the item is what it is claimed to be, and a bare image supports nothing. It has no source URL, no server response, no verified capture time, and it is trivially editable by anyone with a browser's developer tools before the capture is even taken.
Two federal decisions are worth keeping in the file for anyone who thinks this is theoretical. In Moroccanoil, Inc. v. Marc Anthony Cosmetics, Inc., 57 F. Supp. 3d 1203 (C.D. Cal. 2014), the court would not admit Facebook screenshots because there was no way to establish that they were an accurate representation of the live page. In Linscheid v. Natus Medical Inc., 2015 WL 1470122 (N.D. Ga. Mar. 30, 2015), a printed LinkedIn profile failed authentication because no adequate effort had been made to authenticate it at all. Neither case turned on the content being false; both turned on the form in which it was offered.
“Data copied from an electronic device, storage medium, or file, if authenticated by a process of digital identification, as shown by a certification of a qualified person that complies with the certification requirements of Rule 902(11) or (12).”
The rule you want to be arguing under
Rule 901(b)(4) lets an item be authenticated by its distinctive characteristics, taken together with all the circumstances. That is the door a forensic capture walks through: the URL as requested, the HTTP response the server actually returned, the DNS resolution at that moment, the TLS certificate, the capture time verified against NTP, and a hash of every artifact. Rules 902(13) and 902(14) then allow that record to be self-authenticating on a certification, removing the need for live foundation testimony. Getting to 902 is not about the tool being clever. It is about the capture producing facts a qualified person can certify.
What a screenshot carries
- • Pixels
- • A file creation date the operating system will happily change
- • The investigator's word about where it came from
What a ProofSnap capture carries
- • Full page screenshot plus the page HTML as served and the DOM text
- • The requested URL, the HTTP response headers, the TLS certificate detail
- • DNS resolution cross-checked against two independent resolvers, plus WHOIS or RDAP for the domain
- • Capture time verified against NTP, not the workstation clock
- • SHA-256 of every file, an RSA-4096 signed manifest and the public key
- • A Bitcoin OpenTimestamps anchor, and optionally an eIDAS qualified RFC 3161 timestamp
- • A chain of custody document whose log entries are linked in a hash chain
The number the desk already knows
Fraud volume is not the constraint. Evidence quality is.
Published figures, cite-ready
$308.6B
Annual cost of insurance fraud to the US economy, Coalition Against Insurance Fraud, 2022 study
£1.16B
Fraudulent UK general insurance claims detected in 2024, Association of British Insurers
98,400
UK fraud-related claims uncovered in 2024, up 12% from 2023 (ABI)
9,400+
Public fraud reports to the IFB CheatLine in 2024, the highest annual figure on record
The post disappears
The moment a claimant senses that a post is a problem, it comes down. Preservation on the day of discovery is the whole game, and a screenshot taken in a hurry is exactly the artifact that will be attacked later. The capture that seals itself at the moment of discovery removes that argument entirely.
The file travels
An SIU file rarely stops at the desk. It goes to the carrier's counsel, to a state fraud bureau referral, to the NICB, and sometimes to a prosecutor. Each hop is a chance for someone to ask who handled the evidence and when. A hash-chained custody log answers that in writing rather than from memory.
The vendor delivers
If you are an SIU vendor, an independent adjuster or a PI on carrier assignment, the report is your product. A report carrying a capture tool's branding tells the client which tool you bought. A report carrying yours tells them what you do.
Claim intake to referral
5 steps. About 41 seconds per capture.
-
1
Open the publicly visible page
The claimant's public profile, a specific post, a marketplace listing, a race result, a team roster, a tagged event photo, a fundraiser page, a contractor's promotional post. Whatever the file references, in your own browser, without any request to connect.
-
2
Capture
One click in the side panel. The extension scrolls and stitches the full page, saves the HTML as served and the DOM text, records the HTTP response headers with authentication and cookie headers stripped, resolves DNS against two independent resolvers and flags any disagreement, pulls WHOIS or RDAP, reads the TLS certificate and anchors the clock to NTP rather than trusting the workstation. Sticky headers, cookie banners and infinite recommendation feeds are neutralized for the capture and every one of those interventions is disclosed in the chain of custody.
-
3
Seal
Every file is hashed with SHA-256. The manifest listing those hashes is signed with a freshly generated RSA-4096 key and the public key ships alongside it. The manifest hash is anchored to the Bitcoin blockchain through OpenTimestamps. On Enterprise and Company plans the package also carries an eIDAS qualified RFC 3161 timestamp from Disig a.s., a Qualified Trust Service Provider on the EU Trusted List, which matters for any claim with a European leg.
-
4
Attach to the claim file
One ZIP, 11 to 15 files depending on plan and options, including the evidence PDF under your own branding and a verification folder with scripts and a written guide. Attach it in the carrier's claims system alongside the referral memo. It is a single artifact, so nothing gets separated in transit.
-
5
Refer or litigate
Cite the capture in the SIU referral, the NICB submission, the state fraud bureau referral or the pleading. Whoever receives it can verify the hashes, the signature and the timestamp offline using python3, openssl and an OpenTimestamps client, or in the browser at the Trust Verifier. Nothing in that verification runs through ProofSnap, so nobody has to take the investigator's word for it, and nobody has to call the investigator to the stand to establish the basics.
Whitelabel reporting
The report reaches the carrier under your name, not ours.
On the Enterprise plan, and for the administrator on the Company plan, the evidence PDF is generated with your logo, your primary color, your firm name, your address and your contact email in place of the default ProofSnap header. Everything cryptographic inside the package stays exactly the same. Only the document the client actually reads changes.
SIU vendors and IA firms
The deliverable to the carrier is your investigative report. The capture tool is your production line, and there is no reason for the client to be reading its brand name on every page of your work product.
In-house carrier SIU
The report goes out under the carrier's own identity into the claim file, the referral packet and, when it gets that far, the exhibit list. A consistent document header across a thirty-investigator desk is a small thing that reviewers notice.
Defense counsel
The exhibit carries the firm's letterhead, and the underlying package carries the hash, the signature and the timestamp that make the exhibit stand on its own under Rules 902(13) and 902(14).
Branding is configured once in the extension under Whitelabel settings: logo upload up to 2 MB, primary color, firm name, address, contact email. The structured JSON files inside the package stay in their standard form, because they are read by verification tooling rather than by people.
Collection limits
A better capture does not widen what you are allowed to collect.
This is worth being blunt about, because a capture tool that quietly implies otherwise creates liability for the investigator and the carrier. ProofSnap captures whatever your browser is lawfully displaying. The constraint sits on you, not on the software, and it does not move.
Accepted practice
- • Passive review of publicly visible content, with no interaction of any kind
- • Capturing a public post, profile, listing, roster, review or event page as you find it
- • Capturing pages behind a login you are personally entitled to use, such as a carrier portal or a claims system
- • Documenting the date, the URL and the method for every item collected
Do not, whatever the tool allows
- • Send a friend or connection request to a claimant, under your own name or any other
- • Operate a pretext or sock-puppet account to reach restricted content
- • Attempt to access anything behind a privacy setting or a password that is not yours
- • Ask a third party to do any of the above on your behalf
The exposure here is real and it is not only evidentiary. The Stored Communications Act restricts access to stored electronic communications, several states have specific statutes on impersonation and pretexting, state licensing boards discipline investigators for it, and platform terms of service prohibit it outright. Beyond the direct liability, a single pretext contact gives claimant's counsel a clean argument to exclude everything the investigator collected, including the parts that were gathered properly. The most defensible position is also the simplest one: capture the public surface thoroughly, and use lawful process for anything else.
The deliverable
11 to 15 files, one ZIP, verifiable without us.
Always in the package
- screenshot.jpeg
- page.html
- domtextcontent.txt
- metadata.json
- evidence.pdf (your branding)
- forensic_log.json
- forensic_log_summary.txt
- chain_of_custody.json
- manifest.json
- manifest.sig
- publickey.pem
- verification/verify.sh
- verification/verify.ps1
- verification/VERIFICATION_GUIDE.txt
Added by plan or option
- manifest.json.ots Bitcoin OpenTimestamps anchor on the manifest hash
- rule_902_certification.pdf a fill-in declaration template for a US filing, with every fact populated and the declarant identity and signature left blank
- manifest.json.tsr and eidas_validation.json eIDAS qualified RFC 3161 timestamp with the TSA chain, root CA, OCSP and CRL for offline long-term validation
- c2pa.json Content Credentials sidecar for the screenshot
- capture_video.webm screen recording of the capture itself
- tabs/<page>/ a full per-page bundle for each tab when a multi-tab session is captured
The verification scripts are generic. They read manifest.json at runtime rather than hard-coding anything, they verify themselves before verifying the package, and they work on a multi-tab capture as well as a single page. Verification needs python3, openssl and an OpenTimestamps client, none of which is ours.
Against the tools SIU desks already look at
Same defensibility, self-serve, and the only price you can actually read.
| ProofSnap | Page Vault | WebPreserver (Pagefreezer) | Hunchly (Maltego) | |
|---|---|---|---|---|
| Price you can read without a sales call | $18.99 per seat per month, or $190 per seat per year | Not published. Quote only. Outsourced capture from $199 per website, $349 per social profile | Quote only | About $130 per year |
| How you buy it | Self-serve, 7-day trial (card required) | Sales process, demo | Sales process, demo | Self-serve |
| Cryptographic hash and digital signature | SHA-256 on every file, RSA-4096 signed manifest | Yes | Yes, SHA-256 | Hashing, no signed evidence package |
| Independent time anchor | Bitcoin OpenTimestamps, plus eIDAS qualified RFC 3161 on Enterprise and Company | Vendor timestamp | Vendor timestamp | Local capture time |
| Verification without the vendor | python3, openssl and an ots client, plus a browser verifier | Vendor platform | Vendor platform | Local case file |
| Report under your own firm branding | Yes, on Enterprise and for the Company admin | Vendor-branded | Vendor-branded | Not applicable |
| EU statutory weight | eIDAS qualified timestamp from Disig a.s., a Qualified Trust Service Provider on the EU Trusted List | US-oriented | Not a qualified timestamp | No |
What a year of capturing costs one investigator
Page Vault publishes no subscription price at all. Its browser packages are listed as Solo, Team, Professional and Enterprise with a Request Pricing button and the line “for higher-limit plans, please contact sales.” The only figures it does publish are for outsourced capture: websites start at $199 and social media profiles start at $349, per project. So the honest comparison is not between two subscription prices, because only one of them exists in public. It is this: a full year of ProofSnap for one investigator costs $190, which is less than a single outsourced website capture from Page Vault, and it covers every capture that investigator makes in those twelve months. A ten-investigator desk is $1,900 a year, reachable with a credit card and no negotiation. Figures read from page-vault.com/pricing in August 2026; its subscription tiers may well be competitive, but a buyer cannot find out without a sales call.
Honest framing: Page Vault and WebPreserver are mature, court-oriented products with long track records and features ProofSnap does not have, including managed capture services and large-scale archiving. Many desks will keep them. The argument here is narrower: for the specific job of preserving a claimant's public page so the capture survives an authentication challenge, ProofSnap does it with the same cryptographic backing, adds an independent blockchain anchor and an EU qualified timestamp, ships the report under your branding, and does not require a procurement cycle to start.
Pricing
Priced per seat, so the desk can budget it for the year.
Evaluate
$4.99
SnapPack, 10 captures
A one-time purchase with no subscription and no auto-renewal, bought inside the extension after sign-up. Enough to run a real case through the workflow before committing a team.
SIU teams
$18.99 per seat per month
Company plan, or $190 per seat per year
Minimum two seats, no upper limit. Shared company workspace, per investigator accounts, whitelabel branding managed by the administrator, and 5 eIDAS qualified timestamps per user per month.
Solo investigator
$28.99 per month
Enterprise, single seat
Whitelabel branding on a single account and 10 eIDAS qualified timestamps per month. The right fit for an independent adjuster or a PI taking carrier assignments.
| Desk size | Monthly | Annual license |
|---|---|---|
| 2 investigators | $37.98 | $380 |
| 5 investigators | $94.95 | $950 |
| 15 investigators | $284.85 | $2,850 |
| 30 investigators | $569.70 | $5,700 |
| 50 investigators | $949.50 | $9,500 |
All prices are charged in US dollars. The 7-day trial requires a credit card and can be canceled at any point during the trial at zero cost. Captures on subscription plans carry no per capture surcharge. Additional eIDAS qualified timestamps beyond the monthly allowance are available as one-time purchases from $6.99, and 10 for $49.99.
The tool itself
This is the whole interface.
No procurement cycle and no onboarding. A side panel in Chrome or Edge with one button that matters, deployable across an SIU desk through the same group policy you already use for every other extension.
The side panel, actual size relative to a browser window.
Capture page snapshot
The one button that does the work. Scrolls and stitches the full page, saves the HTML as served and the DOM text, records the response headers, DNS, WHOIS and TLS, checks the clock against NTP, hashes everything and signs it. About 41 seconds.
Case and examiner details
Optional matter reference and examiner identity, written into the evidence PDF and the chain of custody so the package identifies the file it belongs to without a covering note.
Evidence language
The evidence PDF can be exported in a different language from the interface, which matters when the investigator and the tribunal do not share one. The structured JSON files stay in their standard form for verification tooling.
Whitelabel branding
A toggle, not a professional services engagement. Your logo, color, firm name, address and contact email replace the default header on the evidence PDF. Enterprise, and the administrator on the Company plan.
Record capture video
Records the capture as it happens and puts the recording inside the sealed package, which answers the question of what the operator did between opening the page and producing the file.
EU qualified timestamp
One toggle adds an eIDAS qualified RFC 3161 timestamp from Disig a.s., a Qualified Trust Service Provider on the EU Trusted List. The counter shows the remaining allowance on the plan.
Trust Verifier and File Certifier sit in the same panel. The verifier checks any ProofSnap package, including one somebody else produced, so the receiving side can validate without installing anything of their own. The certifier seals files you already hold, such as an export, a photograph or a PDF, rather than a web page. Nothing here needs configuration before the first capture.
Questions SIU desks actually ask
FAQ
Put the next claimant lead in a package that holds.
Install the extension, capture one public page, open the ZIP and run the verification script yourself. If the package does not do what this page says it does, you have spent nothing but seven days.
Start the 7-day trialCredit card required. Cancel any time during the trial at zero cost. Or buy a $4.99 SnapPack for 10 captures with no subscription and no auto-renewal.
Disclaimer: This page provides general information about preserving publicly available social media content as evidence in insurance fraud investigations. It is not legal advice, claims handling advice, investigator licensing advice or fraud investigation training. ProofSnap is not a law firm and does not act as an expert witness. Admissibility of any item of evidence, and any claim-handling decision to settle, refer or deny, remain with the investigator, the carrier, counsel and the court on a case-by-case basis. Case citations are provided for orientation and should be read in full before being relied on. Published competitor prices and industry statistics are current as of August 2026 and should be verified before use.
Related ProofSnap pages
- Evidence for investigators and OSINT general PI and DFIR page
- AI claim photo detection for SIU is the image in the claim generated
- Evidence for law firms self-authentication under FRE 902(14)
- Are screenshots admissible in court? the four hurdles, with case law
- Social media evidence case law 14 decisions, full citations
- How to preserve social media evidence seven step workflow
- Workers comp social media evidence
- Are screenshots admissible in court
- eIDAS qualified timestamps statutory weight across the EU
- Web page capture service we capture the URL for you
- Trust Verifier check any package in the browser