Deployment in progress at Maspex
A photo attached to a complaint has stopped being evidence.
FormFlow is a contact-form platform for consumer brands where every attached photo is examined for authenticity before Quality Management makes a decision. The whole system runs inside your infrastructure — consumer photos never leave it.
or write to [email protected]
A product of Applied AI sp. z o.o. Built within the KPT ScaleUp Booster programme, co-financed by the European Union.
- Generated imagery
- no signal
- Manual retouching
- 2 edited regions
- Metadata
- metadata stripped
A problem no company has measured in its own operation
Not because it isn't there. Because there is nothing to measure it with — a submission with a photo moves through the organisation without a single point where anyone examines the attachment.
36% of consumers would consider altering a photo to strengthen their own claim Verisk study, March 2026, 1,000 consumers in the US. Among Generation Z the figure is 55%.
Being straight about the sources: the Verisk studies cover the US market and were commissioned by a vendor of detection technology. The Polish Chamber of Insurance and Signicat figures cover insurance and finance, not consumer complaints. Photo-bearing consumer complaints are measured by nobody — which is exactly the point: no brand currently knows the scale of this in its own operation.
What this looks like in practice
Three patterns reconstructed from cases reported publicly. The illustrations are our own — they show what a reviewer would see in the FormFlow panel in each case.
The removed topping
A customer orders food, edits part of the toppings out of the photo and demands a refund for an incomplete order. Cloning a patch of the base takes seconds on a phone.
Stage 2 marks the regions copied from elsewhere in the same photo.
Damage that never happened
The packaging in the photo is crushed and the product looks spoiled. Except the entire photo was generated — the product was never in that state.
Stage 1 recognises the generation, stage 3 the total absence of camera data.
The same photo, a second case
A photo that closed a complaint six months ago turns up in a new submission — different name, different address, same defect. Nobody connects the two, because there is no way to.
Comparison against your whole submission history — an outside detector cannot do this, because it cannot see it.
The first two patterns match types of case reported publicly during 2026 — both concerned refunds for food orders, and both edits were made with widely available image-editing tools. Every illustration on this page is our own schematic drawing, not material from any specific case.
The form and the attachment in one process
Today these are two separate worlds: marketing owns the form, and the attachment lands in a shared Quality Management mailbox. FormFlow joins them into a single flow — which is precisely why it can compare each photo against your entire submission history. An external detection tool cannot see that history.
Overview
Brands
Configuration
Product complaint
PublishedConsumer complaint form. Submissions are routed to the Velano Foods quality management team.
Last edited 12 May by —
- Full namerequired
- Email addressrequired
- Product concernedrequired
- Batch number / best-before daterequired
- Description of the problemrequired
- Photos of the product and packagingverify
- Consent to data processing (GDPR)required
A new form field takes a minute, not another sprint
A field editor that does not need IT
Short and long text, dropdown, file upload, date, consent. Adding fields, reordering, required rules, validation and helper text — all from the panel, by someone non-technical.
Draft and publish
The public form always serves the published version. Submissions filed earlier keep the schema they were filled against, so a case can still be reconstructed a year later.
Brand, topic, recipients
Each brand has its own forms and its own recipient addresses. Brand and topic travel in the message headers, so triage happens before anyone opens the mailbox.
Forms on your brands' own domains
A dedicated address on the brand's domain, or embedded in an existing page. The certificate and routing entry are issued from the panel, without a ticket to the infrastructure team.
Panel and forms in English and Polish
Both languages as standard, on the admin side and on the consumer side.
An examination, not just a score
Every attachment goes through three independent stages of analysis. The aggregate verdict takes the strongest severity found, and next to each result the reviewer gets material they can look at and judge for themselves — the marked regions, the signals, the facts recovered from the file — not a bare number.
Generated imagery
The system determines whether the image came out of a generative tool. Provenance signals are checked separately — the digital signature applied by a camera, and watermarks embedded by generators. A valid signature settles the case immediately, with no probability estimate involved.
Retouching and content tampering
Detection of fragments copied within the photo and of areas painted in, with a map of regions drawn over the image. The reviewer sees where the photo was altered, not merely that something is off. Supporting analyses go into the report as material for the reviewer, never as a verdict on their own.
Metadata and file history
Stripped metadata, traces of re-encoding by a messaging app, a file posing as a phone photo, the name of an image editor left in the file, a thumbnail that disagrees with the image, a mismatch between location and capture date. The facts recovered — camera, date, place — go straight onto the report.
Comparison against the submission history
Every photo is matched against everything you have already received — regardless of how much time has passed, who filed the submission or which brand it concerned. This catches a photo reused under a different name. The mechanism is deterministic, so it does not depend on model accuracy, and it is the one item on this list an external tool cannot reproduce: it has no access to your history.
Three verdicts, and one the system refuses to fake
Authentic
No stage found a meaningful signal. The photo can be treated as reliable material when assessing the submission.
Suspect
Ambiguous signals — stripped metadata, double compression, a match against an earlier submission. The system recommends manual review.
Doctored
Tampering with the image content, or generation, was detected. The verdict comes with a region map and the list of signals that support it.
Inconclusive
A separate state, kept deliberately. On a weak signal the system will not issue a “doctored” verdict — it would rather say it does not know than make an accusation it cannot defend.
A refusal has to be defensible
Against an appeal, a consumer ombudsman, a court and a newsroom. “It looked suspicious to us” is not a position anyone can hold — which is exactly why paying out is currently the cheaper option.
Verification report as a PDF
An A4 document on every case: the result for each image, the signals detected, the aggregate verdict, the methodology applied and the pipeline version. Ready to attach to the file.
Map of altered regions
Marked regions drawn over the photo. Nobody has to take the system's word for it — you can see which part of the image is in question.
Audit trail
Who opened the case and when, who marked it reviewed, who re-ran the analysis. A re-run records the person who triggered it.
The form version as filed
A submission is assessed against the schema it was filed under. However often the form changes afterwards, the case stays reconstructable.
The original file, not a copy
We store the bytes exactly as the consumer sent them, before any processing. The analysis always works on the original.
A person makes the decision
The system never rejects a submission on its own. The decision stays with Quality Management, in line with Article 22 GDPR.
What your IT department will ask about
Consumer photos are personal data, and frequently evidence as well. The architecture was built on the assumption that they must not be sent to an external API — not as an option, but as a condition of entry.
| Where processing happens | Everything, models included, runs inside your infrastructure. Consumer photos are not sent to any external API. |
|---|---|
| Hardware requirements | The models run offline on CPU, with no graphics card. A Helm chart, queued workers and object storage — no dedicated AI hardware. |
| Sign-in | Your corporate identity provider over OIDC, deployed on Microsoft Entra ID among others. A single-use invitation link as the fallback path. Self-registration does not exist. |
| Roles | Administrator, reviewer, viewer — enforced at the API, not only in the interface. A user with no role assigned is refused. |
| Audit and retention | An event log for case operations, and configurable retention periods for submissions and attachments. |
| Data subject rights | An export and erasure path for a complainant's data, covering attachments and analysis results. |
| Integrations | Signed webhooks and a per-case verification API with access keys, to wire into a ticketing system or CRM. Routing rules based on form field values. |
| Keeping accuracy current | A quarterly model review, contracted. Detecting generated imagery is a moving target — every new generator weakens existing detectors — so the refresh cycle is part of the product, not an add-on. |
Two deployment models, one product
The choice depends purely on your organisation's security policy. The functionality is identical either way.
Inside your infrastructure
A full installation in your own environment. Submission data and consumer photos stay inside the organisation for the whole life of the case.
- A Kubernetes cluster via Helm, or virtual machines
- Integration with your corporate identity provider
- Compliance with your internal data retention policy
- Operates with no internet access
As a service in the Applied AI cloud
Start without infrastructure of your own, hosted within the European Union. Maintenance, updates and backups are on us.
- Live in days, not months
- Forms on your brands' own domains
- Monitoring and model updates included
- A migration path to your own infrastructure
A product, not a pitch deck
FormFlow is built at Applied AI sp. z o.o. together with a technology recipient, against live submissions and a real complaint process — not against mockups.
Deployment in progress
Maspex Group as the technology recipient. The test environment is running; the production one is being prepared.
KPT ScaleUp Booster
The Industry 4.0 track with a business partner — the programme's most demanding route, with a mandatory pilot deployment.
Hosted in the European Union
A Helm chart, object storage and queued workers — ready to run in your environment or in ours.
We will walk FormFlow through your own complaint process
The demo runs about forty minutes and covers the panel, the verification pipeline and the report. No commitment.
or write to [email protected]