Detesia
Detesia is a German platform that detects deepfakes and AI-generated media in images and video. It returns region-level heatmaps, confidence scores and exportable forensic reports, and runs as a web app, a REST API or an on-premise deployment.
What is Detesia?
Detesia is a deepfake and synthetic-media detection platform for images and video, built by Detesia GmbH in St. Ingbert, Germany. It was founded at the CISPA Helmholtz Center for Information Security and is funded by the German federal research ministry, and the product reads like a research tool turned into infrastructure rather than a consumer novelty. The analysis covers three families. Deepfake detection targets face swaps, reenactments and lip-sync manipulation. Synthetic media detection looks for fully AI-generated content from diffusion models, GANs and similar frameworks. Forensic analysis hunts for inpainting, splicing and post-processing. Several specialised models run in parallel, and the platform's stated differentiator is that it explains itself: instead of a bare score, it returns region-level heatmaps, frame-by-frame indicators and technical reasoning. Around the models sits a genuine analyst workbench. It offers error level analysis and noise analysis with adjustable parameters, a vanishing-lines tool for checking perspective consistency, geolocation prediction from visual content alone, reverse image search through Google, Bing and TinEye, metadata extraction via ExifTool and ffprobe, and an eighteen-point investigator checklist. C2PA watermarks are verified with the signing certificate's status, including tampered and revoked cases. Google's SynthID is discussed but cannot be checked automatically, because Google publishes no verification API. Verdicts come in three levels, Little Evidence, Uncertain and Substantial Evidence, and an analyst can override them manually. Video is scored frame by frame and classified as fully fake, partially fake or real against published thresholds. Cases, notes, tags and history support ongoing investigations, and results export to PDF or CSV with file hashes. Detesia is candid about its limits. A public model card names the versions in production, gives a June 2026 training cut-off, and lists the generators it does not yet reliably detect. The vendor also states plainly that a result is decision support, never proof or expert testimony. Access is by web app, REST API, or on-premise deployment on a Kubernetes cluster, including air-gapped.
What it does
- Detect face swaps, reenactments and lip-sync manipulation in images and video
- Identify fully AI-generated media produced by diffusion models and GANs
- Show region-level heatmaps that explain which part of the frame triggered the verdict
- Check C2PA watermarks and read the file's provenance chain
- Run manual forensics: error level analysis, noise analysis, vanishing lines, geolocation
- Export court-oriented reports as PDF or CSV, with SHA256 and MD5 hashes
- Call detection from your own systems through a documented REST API
When to use Detesia / When not to
A quick filter to help you decide if Detesia is the right fit.
When to use Detesia
- Police, defence and intelligence teams that must check the integrity of image and video evidence in an investigation
- Insurance claims handlers and fraud investigators screening damage photographs before a payout
- Newsrooms and fact-checkers authenticating source material before publication
- Banks and financial institutions verifying identity documents and submitted media against synthetic forgeries
- Organisations under strict data-sovereignty rules, which need German hosting or an air-gapped on-premise install
When not to use Detesia
- Anyone who needs audio deepfake detection: the platform covers image and video only
- Buyers who require a published price list, since no rate is disclosed anywhere and every upgrade goes through sales
- Teams expecting a legally binding verdict, as the vendor explicitly rules out any evidentiary or expert value
- Mobile-first users, because no iOS or Android application exists
- Anyone needing reliable detection of the newest generators, which the vendor itself lists as current blind spots
How to use Detesia
A typical end-to-end flow, from setup to results.
- Create an account and confirm your email address with the six-digit code or verification link
- Wait for administrator approval if your account requires it before uploads are enabled
- Open the dashboard and drag in images or video, up to fifteen files at a time
- Alternatively paste a YouTube URL, the only external source currently supported
- Let the multi-detector analysis run and watch the frame progress for video files
- Read the overall severity verdict, the confidence score and the region-level heatmap
- Check the watermark tab for C2PA credentials and the provenance chain
- Work through the manual tools: error level analysis, noise analysis, vanishing lines, geolocation
- Run a reverse image search on Google, Bing or TinEye to trace the original source
- Group findings into a case, add notes and tags, then export a PDF or CSV report
Pros & Cons
Pros
- Explains its verdicts with region-level heatmaps instead of returning an opaque score
- Publishes a model card naming the generators it cannot yet detect, which is rare honesty
- Hosts exclusively in German data centres, with on-premise and air-gapped options
- Commits that customer content is never used to train the models
- Publishes a complete Article 28 processing agreement in both English and German
- Adds real manual forensic tools for analysts who must justify a conclusion
- Rests on verifiable research credentials, being a CISPA spin-off with federal funding
Cons
- No price is published anywhere, so the cost of the service cannot be assessed in advance
- Audio is not covered: the platform handles image and video only
- The legal notice, privacy policy and terms exist in German only, though the product is sold in English
- No mobile application is available on either iOS or Android
- No security certification is claimed, neither ISO 27001 nor SOC 2
- No list of platform subprocessors is published
- Detection is acknowledged as unreliable for the most recent generators and small-area inpainting
Pricing & Plans
A permanent free tier is available: creating an account grants a quota of free credits, which reset on a rolling thirty-day basis, with an image costing fewer credits than a video. Beyond that quota, no price is published. There is no pricing page, no rate card and no amount anywhere on the site, and every upgrade path directs the user to contact the company. The on-premise edition is governed by a time-limited licence key that must be renewed. The lowest paid price point therefore cannot be stated, as it is not public.
- limited credit quota
- resetting on a rolling thirty-day basis
- image and video priced differently in credits
- available on request through the sales team
- with no published name or price
- the interface indicates that at least one unlimited-credit tier exists
- deployed on the customer's Kubernetes cluster under a renewable licence key
- priced on request
Data, GDPR & hosting
A consolidated view of how Detesia handles your data.
GDPR overview
GDPR compliance is claimed explicitly: the FAQ answers that Detesia complies with the GDPR and other data protection rules, and the structured data repeats the claim. The concrete mentions are unusually specific. Legal bases are named article by article: Article 6(1)(b) for delivering the service, 6(1)(f) for analytics, 6(1)(a) for consent. Data subject rights are set out in full, including access, rectification, blocking, erasure, portability in a machine-readable format and withdrawal of consent at any time. The competent supervisory authority is identified as the data protection commissioner of the Land where the company is based. Server logs are deleted after seven days at the latest, and traffic is encrypted with SSL/TLS. A complete Article 28 processing agreement is published. No Article 27 representative is named, which is correct for a company established in Germany, and no data protection officer is designated.
Who owns the data?
Customers keep ownership of everything they upload. Detesia publishes a full Article 28 GDPR data processing agreement, in English and German, under which it may process customer material only to run the service: uploading, storing, analysing and returning results. Disclosure to third parties and any use for Detesia's own purposes are excluded unless contract performance or the law requires it, and even anonymised reuse is barred beyond the annexes. Processing is confined to Germany, the EU or the EEA, and any transfer outside the EU needs prior written consent. On termination the customer chooses between return and irreversible deletion, confirmed in writing and open to on-site verification.
Reuse rights
Uploaded media stays the customer's to use as they wish: Detesia claims no licence over it and imposes no permission step for reusing analysis results, which are delivered as reports, heatmaps and exportable PDF or CSV files. The vendor's own room for manoeuvre is deliberately narrow. Customer content is never used to train the models, and it stays inside the EU. The one restriction worth noting runs the other way: the upload screen asks users not to submit confidential information and disclaims responsibility for whatever is submitted, so sensitive material should be weighed against the on-premise option rather than the shared cloud.
Data retention & training
Hosting summary
Detesia hosts exclusively in German data centres and presents this as a design choice rather than a configuration option, stating that every byte lives in Germany and that content remains within the EU. The claim is corroborated technically: the site resolves to an IP operated by Hetzner Online GmbH in Falkenstein, Saxony, which is a real hosting facility and not a CDN edge node. Contractually, the data processing agreement limits processing to the territory of Germany, a member state of the European Union, or another EEA contracting state, and requires the customer's prior written consent plus compliance with Articles 44 to 49 GDPR before any transfer to a third country. Encryption is claimed both in transit and at rest. For organisations that cannot place material with a third party at all, an on-premise edition deploys onto the customer's own Kubernetes cluster, on site or in a private cloud, including air-gapped installations, keeping every file inside the customer's perimeter.
Things to keep in mind
Risks and trade-offs to weigh before adopting Detesia.
- A probabilistic verdict can be mistaken for certainty. The vendor states results are neither proof nor expert testimony, yet a confident-looking score invites exactly that error in a hurried investigation.
- False negatives are structural, not incidental. The model card lists recent generators and small-area inpainting as current blind spots, so a clean result never proves a file is authentic.
- The reverse can also bite: an authentic image flagged as suspicious can damage a reputation or a claim if the analyst does not corroborate the finding by other means.
- Deskilling is a real risk. Analysts who lean on the automated verdict may stop applying the manual checks the platform itself provides, which are what turn a score into a defensible conclusion.
- The upload screen warns against submitting confidential material and disclaims responsibility for it, so sensitive evidence belongs in the on-premise deployment rather than the shared cloud.
- Legal certainty is uneven: the legal notice, privacy policy and terms are published in German only, and the English data processing agreement states that the German version prevails.
- The processing agreement's header inverts the controller and processor roles relative to its own preamble, so any contractual fact drawn from it should be confirmed before being relied upon.
Setup & Integrations
Technical difficulty
Low for the web app: no installation, simply register, confirm your email and drag files in, though some accounts also wait for administrator approval. Moderate for the API, which needs a key generated from the dashboard and an X-API-Key header, with a public OpenAPI specification to work from. High for the on-premise edition, which requires a Kubernetes cluster and a licence key that must be renewed. Chrome is the recommended browser, and uploads are capped at fifteen files at a time.
Deployment
Integrations
Supported languages
Behind Detesia
Social
Resources
All the official URLs gathered for verification and reference.
Frequently asked questions
What exactly does Detesia detect?
How accurate is it?
Can I use the result as evidence in court?
Is there an API?
Where is my data hosted?
Will my uploads be used to train the models?
How much does it cost?
How long is my data kept?
What languages and platforms are supported?
Is there a minimum age?
Should you pick Detesia?
Detesia occupies a narrow and increasingly necessary niche: not just spotting a manipulated image, but showing why it looks manipulated. That emphasis on explainability is what separates it from a black-box classifier, and it is precisely what an investigator, a claims handler or an editor needs when a decision has to be defended afterwards. The research pedigree is verifiable rather than decorative, the company being a CISPA spin-off with German federal funding and substantial national press coverage. Two things stand out as genuinely unusual. The first is the published model card, which names the versions in production, gives a training cut-off and lists the generators the system does not yet catch. Vendors rarely advertise their blind spots. The second is the refusal to overclaim legally: the terms state that a result is decision support and never proof, which is the honest position for probabilistic detection. The reservations are practical rather than technical. Nothing about pricing is public, so the cost of adopting the tool cannot be judged without a sales conversation. The legal pages exist only in German although the product is sold in English, which is awkward for an international buyer. No security certification is claimed, and no subprocessor list is published, both of which a procurement team will ask about. Audio is out of scope, and there is no mobile app. It is also a very young company: the legal entity was only registered in October 2025, roughly eleven months after the domain first went live. That is worth knowing, though the team, the funding and the press record all suggest substance behind it. For organisations that need explainable media forensics under European data sovereignty, Detesia is a serious candidate, provided the commercial terms are clarified first.
- Choosing a selection results in a full page refresh.
- Opens in a new window.