Proof-of-Location (POL) system is used to issue a proof-of-location token (pol) to a user who has been present at a location oc, such that it can be later presented to a verifier to assure the presence of the user at oc. Basic POL security requirements are unforgeability of pol, and its non-transferability (a pol issued to user u 1 cannot be used by u 2). An additional important property of POL systems is user privacy against the issuers and verifiers. We make two contributions. First, we formalize the POL security and privacy properties, and construct the first system providing provable security and privacy against the issuer and the verifier, both. Second, we introduce a geo-tampering attack that completely breaks POL system security, by simply changing the location of a pol issuing node. The attack applies to portable infrastructure nodes that are not continually monitored. We propose an algorithm that is used by a pol issuer to provide a location integrity "proof", that will be embedded in a pol to protect against this attack. The proof relies on a novel application of Euclidean Distance Matrices. We implemented our POL on an off-the-shelf Android smartphone to show the practicality of the proposed algorithms.