ProofLabel documentation
Version 1.1.0-beta.2 · Controlled beta. Start on a staging copy, with a backup of your database and media.
Install and configure
- Download the ZIP from your private subscription account after a verified payment, or use the beta package supplied by the product owner.
- In WordPress, choose Plugins → Add New → Upload Plugin. Upload the ZIP, install and activate on an individual site.
- Open Settings → ProofLabel. Review the settings before enabling a chatbot notice. A detected widget may be a human-operated chat, so confirm that it is AI first.
- For optional updates and downloads, open Settings → ProofLabel subscription. Enter your license and consent to sending the site URL to SaaSNivo.
- Open public pages in a logged-out browser, test the labels on mobile, and clear your WordPress/CDN caches after configuration changes.
A practical publishing workflow
Text: use the AI transparency assessment in the post or product editor. Record AI involvement, the public-interest purpose and any qualifying editorial review. The result depends on your answers. Voluntary labelling remains available.
Placement: automatic labels prepend selected singular post content. For controlled placement use the ProofLabel block or [prooflabel type="full"] / [prooflabel type="partial"]. Do not combine automatic and manual placement at the same point. Test page builders that bypass the standard content filter.
Images: run Media scan, then review flagged attachments in the Media Library. The scanner reads up to 256 KB of each local file and matches metadata strings. It neither authenticates metadata nor detects AI from image pixels. A C2PA string alone never triggers a label. Manually reviewed decisions are preserved by later scans.
WooCommerce: check shop/category thumbnails, the single-product gallery and every variation. Theme overrides, lightboxes, headless storefronts, custom blocks, background images and external media may bypass the supported hooks. Add and verify appropriate disclosure where automatic output is absent.
Chat: auto mode looks for known or configured selectors for up to 60 seconds. It cannot inspect a cross-origin iframe or enforce disclosure before an interaction. Test delayed widgets and use the widget’s own first-interaction notice where needed. Always mode shows the notice on every page.
Audit: assessment and scan events are stored locally with linked hashes. Verification checks up to 50,000 rows and explicitly reports incomplete verification beyond that limit or after a failed audit write. CSV export contains the most recent 5,000 rows. Export regularly and record the head hash outside WordPress if stronger evidence is needed. A database administrator can rewrite or truncate the chain.
Article 50: roles and boundaries
Article 50 obligations are scenario-specific. ProofLabel provides implementation aids; it does not decide whether you are a provider or deployer, give legal advice or guarantee compliance.
| Scenario | What ProofLabel supports | What remains your responsibility |
|---|---|---|
| Direct AI interaction · Article 50(1) | Configurable visible notice for recognised chat widgets or selected pages via always mode. | Provider classification, applicability, timing at first interaction and accessibility in the actual interface. |
| Provider output marking · Article 50(2) | Experimental page-level JSON-LD and inspection of existing image metadata strings. | Robust, detectable, interoperable machine-readable marking. ProofLabel does not watermark or sign content. |
| Emotion recognition / biometric categorisation · Article 50(3) | No dedicated implementation. | The relevant notices, other data-protection requirements and assessment of whether the system is permitted. |
| Deepfakes and public-interest text · Article 50(4) | Editor-assisted text and image assessments, voluntary labels and supported frontend placement. | Accurate classification, qualifying exceptions, appropriate disclosure for your audience, and audio/video workflows. |
| Timing and accessibility · Article 50(5) | Text-based badges and notice output that you can inspect. | Clear, distinguishable disclosure by first interaction/exposure, including theme, device, language and assistive-technology testing. |
The Commission FAQ describes three cumulative deepfake criteria. The plugin’s image form splits the subject question into two prompts; all prompts support a review decision, not a different legal test. Unchecked boxes are not proof that an obligation is absent. Artistic-work treatment and the public-interest text editorial-control exception require a contextual assessment.
Official sources reviewed on 25 October 2026: European Commission Article 50 FAQ, Commission transparency guidelines and Regulation (EU) 2024/1689. The binding regulation takes precedence over summaries. Check subsequent guidance and obtain advice where applicability is uncertain.
Compatibility and release validation
The source declares WordPress 6.0+ and PHP 7.4+. Basic labels do not require WooCommerce. Product image and variation integration require WooCommerce. MySQL/MariaDB advisory locks are required for the audit log; SQLite is not a supported launch database. Network-wide activation is disabled; each site is a separate activation.
PHP OpenSSL and outbound HTTPS to SaaSNivo are required only for subscription activation and updates. A WordPress salt rotation requires re-entering the license. Staging and production URLs consume separate seats. Site migrations require releasing the old URL and activating the new one.
This beta is not a blanket certification for every WordPress, PHP, WooCommerce, theme or browser version. Release checks and any remaining gaps are maintained in the repository’s docs/prooflabel/VALIDATION.md. Verify your exact stack before public use.
Update after a backup through WordPress’s normal plugin updater. Update packages require a valid activated subscription; the updater refreshes a short-lived download ticket and checks the package checksum. Deactivation leaves settings and records in place. Uninstall removes local license credentials; content/audit data is retained unless “delete on uninstall” was enabled. Release remote site activations from your subscription account if the site has been removed.
Subscription and recovery
Purchases remain disabled until merchant setup, approved plans and payment validation are complete. Once available, checkout uses PayPal-hosted approval. Returning from PayPal is not proof of payment: the account page asks the server to verify the subscription and payment.
Save your private recovery code before checkout. It restores account access without collecting an additional password or email address. Never share it or include it in support messages. Your account supplies the license key, download link and activation list after verification.
Cancel through the account page or PayPal’s automatic-payment controls. Cancellation stops future billing; paid access remains until the paid period ends. Active/suspended subscriptions with a previous payment receive a three-day renewal grace period. A temporary verification outage can use a previously verified entitlement for at most three days, bounded by the entitlement’s expiry. Existing disclosure tools keep working regardless.
Refunds and reversals place downloads and updates on hold for support review. For a lost recovery code, contact partners@saasnivo.com with the PayPal subscription reference only. Ownership must be verified before any recovery; never send passwords, card details, license keys or recovery codes.
Data and privacy
Content, image scans, editor answers and audit records remain in WordPress. Audit records contain WordPress user IDs, timestamps, actions and object references; the responsible-person field is local post metadata. Protect backups and choose a retention schedule appropriate to your organisation.
Optional licensing sends a license key and canonical WordPress home URL over HTTPS. SaaSNivo stores a hash of the license, hashes of recovery codes, plan/subscription references, status and payment-period timestamps, site activations and processed webhook identifiers. It does not store card details or full PayPal webhook payloads. The WordPress license is encrypted using the site’s authentication salt. PayPal handles its own payment/customer data under its policies.
Account cookies are Secure, HttpOnly and SameSite=Lax. Private endpoints use no-store and noindex. No new third-party analytics script is installed. Optional product event hooks run only after analytics consent and contain event names/billing period, not identity or payment data. Read SaaSNivo privacy and the product subscription terms.