Key points to keep in mind when choosing a qualified timestamping provider
- eIDAS Qualification: Verify that the timestamping service is included on an official European trusted list and that its qualification is active.
- Technical guarantees: Request the timestamping policy and verify the standards, cryptographic mechanisms, and time synchronization requirements.
- Service continuity: Review availability commitments, response times, and incident management procedures.
- Privacy: Identify the data that is actually transmitted, the information that is retained, and the security measures that are in place.
- Evidence retention: Ensure that timestamps can be preserved and verified independently of the service provider, even after several years.
- Terms and Conditions: Compare liability provisions, reversibility clauses, support terms, and the overall cost of the service.
1. How can you verify that a service provider is truly eIDAS-compliant?
The first check concerns the supplier's regulatory status and, more specifically, the classification of the service being offered.
Article 41 of the eIDAS Regulation provides that a qualified electronic timestamp is presumed to accurately reflect the date and time indicated, as well as the integrity of the relevant data. This presumption facilitates the presentation of evidence in the event of a dispute.
To benefit from these guarantees, you must ensure that the service you are using is indeed qualified. The status of qualified trusted service provider (PSCo) does not mean that all of the services offered by that company are qualified.
Where can I verify the service's qualifications?
In France, ANSSI publishes the national trusted list. The European Commission also provides a tool for viewing trusted lists.
It allows you to search for a provider and verify the type of qualified service as well as its status.
Point to check: The certification must correspond exactly to the intended timestamping service and be valid at the time of use.
2. What technical documents should you request before making a decision?
A qualified time-stamping service provider must be able to document the conditions under which its service is provided.
The timestamping policy serves as a reference document in this regard. In particular, it specifies the rules governing the generation of time-stamping tokens and the conditions under which the service operates. It is also important to review the service provider’s statement of practices and the technical standards with which it complies.
Items to be checked include the RFC 3161 protocol, compliance with applicable European standards, the cryptographic algorithms used, and the methods for synchronizing with Coordinated Universal Time (UTC). This information helps determine whether the proposed safeguards meet the company’s requirements, particularly when it must provide evidence during an audit, a regulatory review, or legal proceedings.
Point to check: The service provider must be able to provide up-to-date technical documentation and explain the conditions under which the tokens are produced and verified.
3. How can we assess the reliability and continuity of the service?
For a company that uses timestamping in its business processes, a service interruption can have immediate consequences: the inability to date certain operations, delays in document production, or a break in the traceability of a process.
Operational reliability must therefore be evaluated separately from regulatory qualification. It is recommended to review contractual availability commitments, which are generally formalized in an SLA (Service Level Agreement). This document must specify, in particular, service availability commitments, incident handling procedures, and any contractual compensation.
Special attention must be paid to business continuity and disaster recovery procedures.
Point to check: Can the provider maintain service in the event of a technical failure? What recovery times does it commit to?
For companies that generate a large number of timestamps, performance and processing capacity will also need to be tested before going live.
4. What safeguards should be required to ensure data confidentiality?
Timestamps may apply to sensitive information, such as commercial contracts, intellectual property files, financial documents, or personal data. It is therefore important to determine precisely what information is transmitted to the service provider.
The RFC 3161 protocol allows, among other things, for the transmission of a cryptographic fingerprint of the document without disclosing its content. This method limits the exposure of confidential information.
However, the conditions under which metadata, technical logs, and user-related information are processed must also be reviewed. The company must verify the security measures in place, the retention periods for the information, and—when personal data is processed—the safeguards provided for under the GDPR.
Point to check: The contractual documentation must specify the data collected, the purpose for which it is collected, how long it will be retained, and any subcontractors involved.
5. How can we ensure that the evidence will remain verifiable over time?
The period during which evidence is used may far exceed the term of the contract entered into with the service provider.
A timestamp associated with a contract, an intellectual property document, or a financial transaction may need to be produced several years after it was issued. It is therefore necessary to plan ahead for the conditions under which it will be verified over the long term.
The service provider must allow tokens to be retrieved in a usable format, along with the information necessary to verify their validity. Verification relies, in particular, on the integrity of the cryptographic fingerprint, the validity of the signature or seal associated with the token, and the elements used to determine the status of the service at the time of issuance. Advances in cryptographic algorithms must also be taken into account in the retention strategy.
Point to consider: Will the company be able to verify its evidence independently of the supplier, even after the contract is terminated or the supplier ceases operations?
This issue must be addressed as early as the selection of the service provider, particularly when documents are subject to long retention periods.
6. What contract terms should you review before signing on?
Regulatory requirements govern the provision of the service, but contractual obligations warrant a separate analysis.
In particular, the legal department must review the provisions regarding the service provider’s liability, service interruptions, incident reporting, and termination conditions. The terms governing data portability are particularly important. The company must retain the ability to retrieve its data and switch providers without compromising its operations.
It is also important to verify the commitments regarding technical support, request processing times, and service updates. Responsibilities must be clearly defined, particularly when timestamping is integrated into an application developed or operated by the client company.
Point to check: The contract must clearly define the service provider’s obligations, the limits of its liability, and the terms for returning the data at the end of the business relationship.
7. How can you compare the prices of qualified time-stamping providers?
Service providers can offer various pricing models: pay-as-you-go billing, annual flat rates, prepaid credits, or volume-based discounts.
However, the unit price alone is not a sufficient indicator for comparing offers. A company that wants to time-stamp a few documents on an occasional basis will not have the same needs as a software publisher that automatically incorporates time-stamping into several thousand daily transactions.
The comparison should take into account any integration costs, minimum volume requirements, support costs, verification features, and contract renewal terms. For automated use, the availability of a timestamping API, clear documentation, and a test environment can also impact deployment costs.
What to check: Request a pricing estimate based on the actual volumes you plan to use, including recurring fees and additional services.
Questions to Ask a Qualified Timestamping Provider Before Signing a Contract
To make it easier to compare multiple offers, the key criteria can be organized into an evaluation grid.
| Criterion | Question to Ask | Proof required |
|---|---|---|
| eIDAS Qualification | Is the service currently certified? | Inclusion in the Trusted List |
| Technical Compliance | What standards and policies govern token issuance? | Timestamping Policy and Technical Documentation |
| Availability | What are your availability and recovery commitments? | SLA and Business Continuity Plan |
| Privacy | What data do you process and store? | Security Policy and Data Protection Provisions |
| Verification of Evidence | Can the tokens be verified independently of your service? | Audit Documentation |
| Reversibility | What are the return and cancellation policies? | Contractual Provisions |
| Flat rate pricing | What is the total cost for the projected volumes? | Detailed Commercial Proposal |
This table can serve as a basis for a supplier consultation or a selection process conducted jointly by the legal, technical, and procurement departments.
Choosing a timestamping provider: a legal and operational decision
The choice of a qualified timestamping service provider should not be based solely on price or on whether the provider has eIDAS certification.
Service reliability, data confidentiality, the ability to verify evidence, and contractual commitments also determine its relevance to the company.
A documented evaluation makes it possible to select a vendor whose safeguards meet the requirements of the information system and the intended evidentiary purposes.
As a qualified trust service provider, Evidency offers an eIDAS-compliant electronic time-stamping service that is accessible via API and designed to be integrated directly into companies’ document management processes. We also provide a free sandbox environment for testing our solutions before deploying them in production.
Disclaimer of liability
The opinions, presentations, figures and estimates presented on the website, including the blog, are intended for information purposes only and should not be construed as legal advice. For legal advice you should contact a legal professional in your jurisdiction.
The use of the content of this website, including the blog, for commercial purposes, including resale, is prohibited without prior authorization from Evidency. The request for permission must specify the purpose and extent of reproduction. For non-commercial purposes, all material in this publication may be freely quoted or reprinted, but acknowledgement is required, together with a link to this website.
