Signature Preservation
Signed documents, provable for 30 years
An electronic signature can be checked as long as its certificates, revocation data and trusted lists can be found and its algorithms are trusted. Years later they are gone. TrustBeat keeps the evidence: each signature with its validation data, validated with EU DSS on the day, under RFC 4998 evidence records on eIDAS-qualified timestamps.
Your file never leaves your machine
The trustbeat-signature extractor reads the signed file locally and sends only its signatures and the digests that bind them to it. TrustBeat never receives the document — not even in memory.
Every EU signature format
PAdES (PDF), XAdES (XML), CAdES (.p7s / .p7m) and ASiC-E / ASiC-S containers, with several signatures per file and timestamps.
Validated with EU DSS on the day
Each signature is validated with the European Commission's EU DSS: signer, level, indication and qualification are recorded as found — TrustBeat records, it does not judge.
Validation data and trusted lists kept
Certificates, OCSP responses and CRLs from preservation time, and the signed EU trusted lists in force that day, so the signature can still be validated when live sources are gone.
Evidence records, renewed
Everything is bound into a Preservation Evidence Object under an RFC 4998 evidence record on an eIDAS-qualified timestamp, renewed before its timestamp expires, for 30 years.
Verifiable without TrustBeat
Download the package and check a file offline with the extractor, or get an eight-step verification report (JSON or PDF) that runs EU DSS again on the preserved data.
Why a valid signature stops being provable
A signature is checked against its certificate chain, the certificate's revocation status and the trusted list that said the issuer was qualified. Certificates expire after a few years, OCSP responders and CRLs are switched off, trusted lists move on, and algorithms are retired. A contract signed today may be impossible to validate in ten years — even though nothing about it changed.
Signature Preservation collects that evidence while it still exists and keeps it provably unchanged. Years later, the original file plus its package show that the signature existed, as validated on the day, no later than the time of the first evidence record.
How it works
Extract, on your machine
The extractor finds every signature, checks that the file still matches what was signed, and writes a small JSON submission. Nothing is sent.
trustbeat-signature extract contract.pdf \ --out contract.submission.json
Preserve
Send the submission with the extractor or the API (all five SDKs). TrustBeat checks it, validates each signature with EU DSS and stores the Preservation Evidence Object.
trustbeat-signature preserve contract.pdf --client-ref contract-17 # or: POST /v1/signature-preservation (body: the submission)
Evidence record
The object's digest is anchored in the next cycle and gets an RFC 4998 evidence record over an eIDAS-qualified timestamp — renewed before it expires.
GET /v1/signature-preservation/{id}
→ "status": "preserved",
"preservation": { "profile": "…/pds-wst-v1", "preserve_until": "2056-…" }Verify, years later
Present the original file: offline with the package, or with the eight-step report — file, binding, signature, chain, timestamps, qualification, evidence record.
trustbeat-signature verify contract.pdf --package package.zip
# or: POST /v1/signature-preservation/{id}/verify?format=pdfWhat it is — and what it is not
- Preservation of electronic signatures and their validation data, for 30 years
- Proof that the signatures, as validated on the day, existed unchanged no later than a qualified timestamp
- For businesses, through the extractor (Linux, macOS, Windows) and the REST API
- Built on eIDAS-qualified timestamps from SK ID Solutions and EuroCert
- A qualified preservation service: it is not one, and does not claim to be
- A document archive: TrustBeat never holds your file — keep it next to its package
- A verdict on your signature: EU DSS's findings are recorded as they were, valid or not
- Signature creation: you sign with your own provider; TrustBeat preserves the result
Standards
Questions
Does TrustBeat see my document?+
No. The extractor runs on your machine and sends the signatures and digests only. The signed content is never part of the submission, and the API rejects a signature that still carries it.
What happens when the signer's certificate expires?+
Nothing changes for the preserved evidence: the certificates, revocation data and trusted lists of preservation time are kept, and the evidence record proves they existed unchanged since then.
My documents are signed through a signing platform or with our company's own certificate. Can I preserve them?+
Yes. Every PAdES, XAdES, CAdES or ASiC signature is preserved, whoever issued its certificate. Validation uses the EU trusted lists as its only trust anchors, so a signature whose issuer is on none of them — a commercial signing platform's own certificate authority, or your organisation's — is recorded as indeterminate (no chain to a trust anchor), not as invalid. The record still proves that the signature, its certificates and the validation data collected existed unchanged since preservation, and the verification report shows whether the signature value itself verifies.
The file was signed again after I preserved it. Is it still covered?+
A record covers the signatures it was made with. A file signed by someone else afterwards is a different file: verification reports the new signature as not part of the record. Preserve the file again after its last signature.
Can I verify without TrustBeat?+
Yes. The package holds the evidence object, signatures, validation data, trusted lists and the evidence record in standard formats; the extractor's verify command checks a file against it offline, and each step can be repeated with standard tools.
What does it cost?+
Starter is €19 a month for 100 preserved files, Business €299 a month for 2,000; each file over the allowance costs €0.30 on Starter and €0.20 on Business, and Enterprise is by contract. Prices exclude VAT. There is no free trial: preservation starts once the first payment has succeeded. Each file is paid once and stays preserved for the full 30 years, also if you cancel later.
Do I have to keep paying to keep my files preserved?+
No. Each file is paid once, in the month you preserve it. After that it stays preserved, renewed and verifiable for the full 30 years at no further cost, also if you switch plans or cancel your subscription. Cancelling only stops new submissions; you keep access to your records, their packages and verification.
Ready to anchor your first document?
Start free. No credit card required. Your first 100 hashes are on us.
eIDAS Regulation (EU) No 910/2014 · Art. 41 legal presumption · EU Trusted List QTSP