Glossary

The vocabulary used across the registry and its documentation, including the legal terms of the EU AI Act and the technical terms behind the content hash, defined in plain language and in alphabetical order.

The Spanish Agency for the Supervision of Artificial Intelligence, the national authority with sanctioning power over the AI Act in Spain. The Human Behind is not part of it and is not endorsed by it.

Software powered by AI that acts with some autonomy on someone’s behalf: answering messages, negotiating, executing tasks. Agents can be registered with type agent.

The quality of having existed at an earlier point in time. A record’s immutable registered_at timestamp and its content_hash together give it evidential value as proof that a given declaration existed on a given date, before anything that came after. It is why the sealed fields can never be edited.

The transparency article of the EU AI Act. In short: people must be told when they are interacting with an AI system (50.1); providers of generative AI tools must mark AI-generated content in a machine-readable way (50.2); and whoever publishes a deepfake, the deployer, must disclose visibly that the content is artificial (50.4). Note that 50.2 and 50.4 fall on different actors: the tool maker and the publisher, respectively. Breaching these transparency obligations can carry fines of up to €15 million or 3% of worldwide turnover (the lower figure applies to smaller firms). Some deadlines for the machine-readable marking of 50.2 are under legislative review (see Digital Omnibus).

A digital character that represents a person or brand: a synthetic presenter, a virtual influencer, a digital twin. The most common record type in the registry.

The Coalition for Content Provenance and Authenticity, an open technical standard for attaching signed provenance metadata to images, video and audio (“where this content comes from and how it was made”). Relevant as one of the industry paths for the AI Act’s machine-readable marking.

A single, unambiguous way of writing data so that everyone produces exactly the same bytes. The content hash uses the canonical text form of a JSON object: keys sorted by length then by byte value, with fixed separators. It removes the ambiguity that would otherwise make two people compute different hashes for the same record. See Records.

The procedure for linking an existing record to the person it belongs to, or for flagging a record that misuses your identity. See Claims.

A SHA-256 digest of a record’s registration snapshot, computed by the database and recomputed whenever the record’s content changes, so it always describes the record as it stands today. Every previous version is archived permanently in an append-only ledger. Anyone can recompute it with the exact public recipe; a matching hash proves the record has not been altered since it was sealed.

Cross-Origin Resource Sharing, the browser mechanism that decides whether a web page may read a response from another domain. The public API sends access-control-allow-origin: *, so any website can fetch a record directly from the browser. See Public API.

AI-generated or AI-manipulated image, audio or video that resembles real people, places or events and could deceptively appear authentic. Under Article 50.4 of the AI Act, whoever publishes a deepfake must disclose that the content is artificial.

In AI Act terms, the person or company that uses an AI system, for example a creator publishing content made with a generative tool. The visible deepfake disclosure of Article 50.4 is the deployer’s obligation.

A European legislative package, pending publication at the time of writing, that may adjust some AI Act transparency deadlines, including the timing of the machine-readable marking under Article 50.2 for systems already on the market. Because it is still moving, any specific date for 50.2 should be read as provisional.

The public, searchable index of VERIFIED records. Free records are private and never appear in it. Free to consult, no account needed. See Directory.

Regulation (EU) 2024/1689, the European law on artificial intelligence. Its general application begins on 2 August 2026, including the transparency obligations of Article 50. The law does not create any public registry of avatars, and registering in TheHumanBehind is not a legal requirement: THB is an independent, private registry that helps put accountability on the record.

The status code the human-readable record page returns when a record has been unpublished. Unlike a plain 404, a 410 says “this existed and was intentionally removed”, so the page keeps a dated notice and the trace is preserved. The THB number is never reused.

The property that certain fields are protected by a database rule that rejects any change, including from the owner or an administrator. In a record, registry_code, registered_at, content_hash and slug are immutable, enforced by database triggers. It is what turns a record into durable evidence rather than an editable profile.

The date-and-time format used for every timestamp, for example 2026-07-14T09:21:33.481205Z. The trailing Z means Coordinated Universal Time (UTC), so a timestamp means the same instant everywhere, with no timezone ambiguity. The content hash uses exactly six microsecond digits.

PostgreSQL’s binary JSON type. Its canonical text form (keys ordered by length then bytes, fixed separators) is what the content-hash recipe reproduces, which is why the recipe is precise enough for anyone to match byte for byte.

“Know Your Customer”, the family of identity checks used to confirm that someone is a real, identifiable person. The registry’s Verified level uses a KYC check performed by Stripe Identity; the registry itself never stores your ID document. See Verification.

A signal embedded in AI-generated content (such as a watermark or provenance metadata) that software can detect automatically. Article 50.2 places this obligation on the provider of the generative tool. C2PA is one common way to implement it.

The recorded origin and history of a piece of content: what made it, when, and how it was changed. Provenance standards like C2PA aim to make this travel with the file.

In AI Act terms, the company that develops or markets an AI system, for example the maker of a generative tool. The machine-readable marking of Article 50.2 is the provider’s obligation, not the user’s.

The single database view that every public surface reads from (the directory, the record page and the API) only ever exposes verified records. By construction it contains only public fields, so it is structurally impossible for it to leak an email, an account identifier or any verification detail.

The entry created when an avatar, a voice clone, an agent, an image, a video or a piece of music creation is registered: numbered, dated and sealed with a content hash. See Records.

The free level of the registry, shown with the green fingerprint seal: a dated, PRIVATE self-declaration, visible only to its owner, that a real person answers for the avatar. The free level is never called “verified”.

The identifier of every record, in the format THB-<year>-<number> (e.g. THB-2026-00117). Sequential within each year, gapless, and never reused.

A PostgreSQL feature that enforces, at the database level, which rows each caller may read or write. It is one of the mechanisms that guarantees an anonymous visitor only ever sees public records, and that an owner can only edit their own. Security lives in the database, not only in the application.

The domain an avatar operates in: general, or a sensitive scope (health, finance, legal). Sensitive scopes signal higher stakes to whoever reads the record. The scope is declared by the owner: the registry shows it, it does not check it. level.

The fingerprint mark shown on a record: green for Registered, gold for Verified. It is TheHumanBehind’s own trust mark, not an official certification. See The seal.

A statement someone makes about themselves, here: “this avatar is mine and I answer for it”. The Registered level is a dated, private self-declaration. It is a statement of responsibility, not an external certification.

A cryptographic hash function that turns any input into a fixed 64-character hexadecimal fingerprint. Change one byte of the input and the output changes completely, and you cannot work backwards from the fingerprint to the input. It is the function behind every content_hash.

The short identifier in a record’s public URL (/r/<slug>), also used by the public API. Immutable once assigned.

The specialised identity-verification provider that runs the Verified level’s check. The verification happens entirely on Stripe’s side; TheHumanBehind keeps only whether you passed, the date and a session reference, and never your ID document.

A property of data whose alteration is always detectable. A record is tamper-evident because any change to its sealed values would produce a different content hash, so a mismatch immediately reveals that something was altered.

The duty under Article 50 to be open about AI: to tell people they are dealing with AI, and to disclose or mark AI-generated content. It is about disclosure, and it falls on providers and deployers, not on any registry.

A record that exists but is not yet linked to its owner. It is public and can be taken over through a claim. See Claims.

The paid level of the registry, not open yet, shown with the gold fingerprint seal: on top of the declaration, an identity check confirmed that a real human is behind the record. The seal is TheHumanBehind’s own trust mark, not an official certification.

A synthetic voice built to sound like a specific person. Registerable with type voice_clone.

Back to the documentation overview →