Deloy
Back to the blogCompliance

Deloy DNA: why every track signs its own authorship

The AI Score and the HMAC-SHA256 certificates aren't a technical feature — they're the foundation everything else rests on.

The most uncomfortable question we get when we explain Deloy is always the same: how do I know that what I produced with your tool is mine? It's the right question. If you can't answer it, you don't have a serious product.

What Deloy DNA is

Every time you export a track from Deloy, we generate a certificate signed with HMAC-SHA256 that contains four things: the SHA-256 hash of the final export, the AI Score (the percentage of AI contribution measured at session time), the timestamp and the signature. That signature is validated with a key that lives on the server side — it can't be forged by editing the file's metadata.

Why it matters

In the era of generative AI, "I made this" stops being a claim you can defend with your word. Labels, platforms, regulators and partners need to be able to verify it. If your track has 24% AI contribution, it's better that this number is recorded immutably — it protects the producer, it protects the label, it protects the artist whose references trained the virtual Producer.

How the AI Score is measured

It's not a number we estimate at the end. While you produce, Deloy records every suggestion accepted vs. rejected, every parameter the virtual Producer proposes vs. the ones you choose, every block generated vs. the ones you write by hand. The AI Score visible in the plugin is the honest aggregation of those decisions. When you accept more suggestions, the number goes up. When you work from scratch, the number goes down.

What we don't do

We don't sign things we can't verify. If a producer imports stems from outside, we can't know whether those stems were generated with another AI. The Deloy DNA certificate covers what Deloy sees inside the session. It's honest about what it claims and honest about what it doesn't.

How labels use it

The labels we're working with integrate the certificate into their publishing and sync pipelines. When a track goes through their legal flow, the certificate is one of the inputs. If the AI Score exceeds a threshold, an additional review is applied. If it's below, it follows the normal flow. But the decision is made with verifiable data, not the producer's word.