Utimaco's Timestamp as a Service has successfully completed its eIDAS conformity assessment

Utimaco's Timestamp as a Service has successfully completed its eIDAS conformity assessment a milestone built on more than two decades of qualified electronic timestamping experience. 

Utimaco has been operating a Qualified Electronic Timestamp service since 2001 and today provides a qualified electronic timestamp service under eIDAS.

The infrastructure has since been further strengthened through migration to FIPS 140-3 Level 3 certified HSMs and a geo-redundant service architecture. The service has been assessed against the requirements for qualified electronic timestamps under eIDAS Regulation (EU) No 910/2014, in particular Article 42, and against ETSI EN 319 401, ETSI EN 319 421, and ETSI EN 319 422. Article 41 of eIDAS defines the legal effect of qualified electronic timestamps.

What Is eIDAS, and Why Does It Matter?

eIDAS — Electronic Identification, Authentication and Trust Services - is the EU's legal framework for electronic identification[PK1.1] and electronic trust services. Established under Regulation (EU) No 910/2014, it created unified standards for electronic signatures, seals, timestamps, and identity credentials across EU member states.

What Is a Qualified Electronic Timestamp?

A qualified electronic timestamp is a cryptographically secured record binds specific data to a defined date and time in a manner that makes subsequent changes detectable.[PK2.1] Under eIDAS, qualified electronic timestamps benefit from a legal presumption of the accuracy of the date and time. They indicate the integrity of the data to which that date and time are bound. They are issued by a qualified trust service provider and recognized as qualified electronic timestamps across EU member states.

Importantly, a timestamp fills a gap that an electronic signature alone cannot. A signature confirms who signed and whether content was modified but does not necessarily provide independent and verifiable evidence of when the signature, document, or transaction existed. Trusted timestamping provides independent, verifiable time evidence.

Key Business Use Cases

Qualified electronic timestamps apply across a broad range of industries and workflows. Utimaco's Timestamp as a Service supports:

• Regulated gambling records — Verifiable evidence for player activity, bets, and regulatory reporting
• Maintenance and change evidence — Timestamped records for deployments and system-state documentation
• Incident and audit trails — Trusted evidence for detection, escalation, and resolution timelines
• Compliance reporting — Proof that submissions were created or filed at a specific point in time
• Software and system integrity — Evidence for source code, releases, and build artifacts
• IP protection — Establishing prior existence of designs, technical documents, and research
• Digital evidence and dispute prevention — Protecting contracts, invoices, and customer-facing records

Why Choose an eIDAS-Certified Provider?

The qualified status [PK3.1]carries consequences beyond technical compliance. An eIDAS-qualified trust service provider has been independently assessed against strict organizational, operational, and security requirements including ETSI standards for trust service providers. Timestamps from a non-qualified service do not benefit from the specific legal presumption granted to qualified electronic timestamps, although they cannot be denied legal effect or admissibility as evidence solely because they are electronic or non-qualified.

Timestamps from Utimaco's qualified service benefit from the legal presumption defined by eIDAS and are recognized as qualified electronic timestamps. The service operates on FIPS 140-3 Level 3 certified HSMs within a geo-redundant infrastructure, ensuring cryptographic integrity and high availability. Integration is supported via the RFC 3161 standard interface with TLS-encrypted data traffic.

Utimaco’s Timestamping Solutions 

Timestamping solutions are provided as part of Trust as a Service portfolio. Utimaco’s cloud hosted and fully managed cybersecurity solutions. 

Timestamp as a Service provides eIDAS-qualified electronic timestamps, offering legally recognized evidence of time and data integrity. It enables the generation and validation of timestamps so that subsequent changes to timestamped data can be detected.
It embeds compliance, efficiency, and long-term trust into digital records and workflows while enabling high availability and seamless integration.

Learn more about Timestamping as a Service

About the Author

Peter Czempas

Product Marketing Manager, Utimaco