Introducing the TrustBeat blog
TrustBeat provides eIDAS-qualified RFC 3161 timestamps as a plain REST/JSON API. Instead of negotiating a contract with a Qualified Trust Service Provider and speaking ASN.1, you send a SHA-256 hash and get back a qualified timestamp proof — batched through a Merkle tree, so a single qualified timestamp can anchor thousands of hashes.
This blog is where we write down what we learn building that infrastructure. The intersection of cryptography and EU regulation is full of questions with surprisingly hard-to-find answers, and most of what exists is either vendor marketing or the raw legal text. We aim for the missing middle: technically precise, legally grounded, and readable by the engineer who has to implement it.
What to expect here
- RFC 3161 in practice — how timestamping actually works on the wire, and how to verify a token yourself with nothing but
openssl(we already keep a full manual verification guide). - What is legally valid in the EU — qualified vs. non-qualified timestamps, the eIDAS Article 41 presumption, and how alternatives like Sigstore or blockchain-based timestamping compare when the question is "will a court accept this?"
- Compliance evidence — what NIS2 and DORA auditors actually ask for when they say "log integrity", and how to produce it without building a trust infrastructure team.
- Engineering notes — Merkle batching, long-term validation, and the design decisions behind the service.
One thing we keep repeating
TrustBeat does not use a blockchain. Anchoring is done with qualified electronic timestamps from EU-supervised trust service providers — the mechanism the eIDAS regulation gives legal effect to. Merkle trees are just efficient cryptography; they predate and do not imply a blockchain.
If you want to try the service, you don't even need an account — the public endpoint accepts a few anchors per day:
# hash anything (here: the string "hello world")
printf 'hello world' | sha256sum
# b94d27b9934d3e08a52e52d7da7dabfac484efe37a5380ee9088f7ace2efcde9
# anchor it — no account needed (3 anchors/day)
curl -X POST https://api.trustbeat.eu/v1/public/anchor \
-H "Content-Type: application/json" \
-d '{"hash":"b94d27b9934d3e08a52e52d7da7dabfac484efe37a5380ee9088f7ace2efcde9"}'The response is a tracking ID; about ten minutes later the batch is anchored and the inclusion proof is ready. For more than a few hashes a day there is a free plan — sign up, get an API key, and keep going. Or start with the live demo and the SDKs. New posts will land in the RSS feed.