Timestamping on Security Reports
Every scan report can be certified with an RFC 3161 timestamp: cryptographic proof that the document existed at a precise date and time, and has not been modified since. No notary. Automatic.
What is a Timestamp?
Think of it as a digital postmark applied by an independent certified authority. When SecureScan generates your PDF report, it calculates a unique fingerprint (SHA-256 hash) and sends it to a Time Stamping Authority (TSA). The TSA binds an official date and time (UTC-based) and returns a cryptographically signed token — the international standard RFC 3161. The result: anyone can verify in a mathematically unbreakable way that the report existed at that exact moment and has not been altered. Used in ISO 27001, GDPR, eIDAS, NIS2, PCI DSS, and any context where a security analysis must be documented with a certified date.
When is a Timestamp useful?
ISO 27001 Certifications
Prove to auditors that security analyses were performed on specific dates and that reports have not been altered.
GDPR and NIS2 Compliance
Document security verification activities with a certified date — an accountability requirement under GDPR art. 24 and the NIS2 directive.
Legal Disputes
In disputes, the Aruba (eIDAS) timestamp constitutes legal proof that a vulnerability was known or unknown on a specific date.
Public Procurement
Attach security reports with a certified date to technical specifications. Required for AgID accreditations and public sector contracts.
PCI DSS Audits
Documents the frequency of mandatory security testing for organizations handling credit card payments.
Intellectual Property
Certifies the date of existence of a technical analysis, configuration, or confidential document — an economical alternative to notarial deposit.
Aruba Timestamp
Legal Value — eIDASAruba PEC S.p.A. is a Qualified Trust Service Provider (QTSP) accredited by AgID and recognized across the EU under the eIDAS regulation. The Aruba timestamp has full legal evidentiary value, is enforceable against third parties, and enjoys the legal presumption of accuracy under European law. It costs a fraction of what a notary charges for the same service.
- Issued by AgID-accredited QTSP (Italian Digital Agency)
- eIDAS compliant — recognized across the European Union
- Full legal value enforceable against third parties in court
- Compliant with ETSI EN 319 421 and ETSI EN 319 422
- SHA-256 hash of the document — integrity guaranteed
- RFC 3161 token included in the PDF and available for download
- Valid for ISO 27001, GDPR accountability, NIS2, PCI DSS
- Valid for AgID/ACN certifications and digital preservation
- Cost: a few cents — vs. tens of euros for a notary
- Optional: add to any scan
FreeTSA Timestamp
Included FreeFreeTSA.org is a public, free Time Stamping Authority implementing the RFC 3161 standard. It is not an eIDAS-accredited QTSP, so it does not have the automatic legal presumption of the Aruba stamp — but it provides solid cryptographic proof of the document's existence, suitable for internal use, technical audits, and operational documentation.
- Included free in all scans when selected
- RFC 3161 standard — cryptographic proof of document existence
- SHA-256 hash — report integrity verifiable
- No extra cost — zero additional credits
- Suitable for internal documentation and technical audits
- RFC 3161 token included in the PDF and available for download
- Not an eIDAS QTSP — no automatic legal value
- Verifiable with OpenSSL and standard tools
Comparison between the two options
| Feature | Aruba (Legal) | FreeTSA (Free) |
|---|---|---|
| Standard | RFC 3161 + eIDAS QTSP | RFC 3161 |
| Legal value | ✅ Full — enforceable against third parties | ⚠️ Internal / technical use |
| eIDAS certification | ✅ EU-accredited QTSP | ❌ Not accredited |
| AgID recognition | ✅ Accredited | ❌ Not accredited |
| Court use | ✅ Legal presumption | ⚠️ Requires additional evidence |
| Use case | ISO 27001, GDPR, NIS2, PCI DSS, CAD, eIDAS | Internal audits, technical documentation |
| Cost | A few cents (vs notary: €50–150) | Free — included in scan |
Which one to choose?
If you need to prove something to an external body, a judge, an ISO auditor, or a government agency: choose Aruba. The cost is negligible compared to the legal value it provides — and infinitely less than a notary. If you are documenting for internal use, for your team, or for informal technical audits: the free FreeTSA is more than sufficient. Either way, activating a timestamp is always better than not having one.