Last updated: October 2026
TrustBeat is operated by Trustbeat s.r.o., a company registered in the Czech Republic. We provide a digital trust anchoring infrastructure — a cryptographic service that proves the existence and integrity of data at a specific point in time, backed by eIDAS-qualified trust infrastructure.
Contact: hello@trustbeat.eu
By registering an account or using the TrustBeat API, you agree to these Terms of Service. If you are accepting on behalf of a company, you confirm that you have authority to bind that company.
TrustBeat provides cryptographic anchoring services via REST API. Customers submit cryptographic hashes of their data; TrustBeat batches these into a Merkle tree and anchors the root using eIDAS-qualified trust infrastructure. Each submission receives an inclusion proof that can be used to verify the existence and integrity of the original data at a specific point in time.
The following anchoring products are offered:
Document Anchoring
General-purpose cryptographic anchoring for documents, files, and data. Available under four plans:
Tamper-Evident Logs
Anchoring of security event logs for NIS2 compliance. Up to 50,000 log files/month. Includes canonical JSON normalisation, per-entry inclusion proofs, and 30-year archiving.
AI Decision Anchoring
Anchoring of AI system decisions for AI Act compliance. Up to 50,000 decisions/month. Includes input/output hash anchoring, decision metadata, and tamper-evident audit trails.
Audit Trail
Anchored audit trail for business events. Available under Starter (10,000 events/month), Business (100,000 events/month), Enterprise L1 (1,000,000 events/month), and Enterprise L2 (custom) tiers.
All products include a REST API, SDKs, inclusion proofs, and long-term retained anchor records; for document anchors, how long they are kept and what happens afterwards is set out in section 4. Quotas and features are as described on the pricing page at the time of subscription.
Document anchors (the Document Anchoring product) are operated as a preservation service designed to ETSI TS 119 511: preservation of general data (goal PGD), with storage (model WST), under the main preservation service policy, OID 0.4.0.19511.1.1. The service has not been assessed against that policy by a conformity assessment body, and it is not a qualified preservation service; the standard provides qualified status only for the preservation of qualified electronic signatures and seals.
The time-stamps in the evidence are qualified electronic time-stamps (Article 41) issued by qualified trust service providers on an EU Trusted List under Regulation (EU) No 910/2014 (eIDAS), as amended by Regulation (EU) 2024/1183. The preservation service itself is not a qualified trust service under that Regulation: it is neither a qualified preservation service, which the Regulation provides only for qualified electronic signatures and seals (Articles 34 and 40), nor a qualified electronic archiving service.
4.1 Policies and profiles
Document anchors are preserved under the preservation profile https://trustbeat.eu/preservation/profile/pgd-wst-v1. The current and all earlier profiles are listed at api.trustbeat.eu/v1/preservation/profiles and published, with the preservation evidence policy and the practice statement, at trustbeat.eu/preservation. The profile and the end of the preservation period of each anchor are returned by GET /v1/anchor/{id}/status.
A document anchor is covered when it was submitted on or after 14 September 2026 (UTC) and its batch has an RFC 4998 evidence record. Earlier anchors, Tamper-Evident Logs, AI decisions and Audit Trail events are not covered by this section.
4.2 Only the hash is preserved
You submit hash values, never the data itself. The preservation covers only the submitted hash. It proves that the data the hash was computed from existed at a given time only as long as the hash algorithm (SHA-256) remains strong enough to prevent two different data sets from having the same hash. Keeping your data, and computing its hash correctly, is your responsibility. We cannot re-hash data we never received; if SHA-256 is assessed as weakening, we will notify you by email and explain whether and how new hash values can be submitted.
4.3 Preservation period
Each covered anchor is preserved for 30 years from submission, on every plan including the Free plan, unless a written agreement with us states otherwise. During that period we keep the hash and its evidence and renew the evidence (RFC 4998 time-stamp renewal) before it stops being verifiable. Ending a subscription or closing your account does not end the preservation period: your anchors stay preserved and remain retrievable by their identifier from the public endpoints, but you lose authenticated access and notifications, so download an export-import package first.
4.4 Export-import package
You can request an export-import package at any time during the preservation period with GET /v1/preservation/export?from=…&to=… (API key or portal session), for anchors submitted in a window of up to 31 days. It contains, for each anchor, the hash and its metadata, the RFC 4998 evidence record with validation data and renewals, and the EU Trusted Lists needed to validate it. If you cannot use the API, ask hello@trustbeat.eu from the email address of your account. We record every package we release.
4.5 No deletion during the preservation period
Neither you nor we can delete a covered anchor before its preservation period ends, and we do not delete on request. Each evidence record is built from all the hashes in its batch, which belong to many customers; removing one hash would make the evidence of every other anchor in that batch unverifiable. The hash reveals nothing about your data. ETSI TS 119 511 expects a preservation service with storage to allow deletion (PRP-8.1-11); our practice statement records this deviation and its reason.
4.6 End of the preservation period
When an anchor’s preservation period ends, we stop renewing its evidence, email you at your account address and make its export-import package available. 30 days later we remove the anchor’s link to your account and its metadata and stop serving its evidence, whether or not you downloaded the package. Hash values and time-stamps shared with other anchors of the same batch are deleted once every anchor in the batch has reached that point.
4.7 Access and traces
Your covered anchors, their hashes and their evidence can be accessed by (a) you, through your account and API keys; (b) anyone who holds an anchor’s identifier, through the public proof and verification endpoints, so that a third party can verify the evidence without an account; and (c) our staff, only to operate and support the service. Share identifiers only with those who should be able to retrieve the evidence. The account holder may request a record of the actions performed on its anchors (submission, evidence creation, renewals and export releases) by writing to hello@trustbeat.eu from the email address of the account.
You are responsible for keeping your API key confidential. You must notify us immediately at hello@trustbeat.eu if you believe your key has been compromised. We are not liable for any unauthorised use of your account before notification.
Subscriptions are billed monthly in advance. Credit packs are charged as a one-time payment. All prices are in EUR and exclude VAT where applicable.
Paid plans include a 30-day free trial. You will not be charged until the trial period ends. You may cancel at any time before the trial ends without charge.
For refunds and cancellations, see our Refund & Cancellation Policy.
You agree not to:
You may resell TrustBeat services, or embed them in a product or service you offer to your own customers, provided both of the following conditions are met at all times:
You must not present TrustBeat’s infrastructure, or our relationships with qualified trust service providers, as your own. In particular, you must not attribute a qualified timestamp obtained through TrustBeat directly to the qualified trust service provider that issued it, or otherwise imply that the relationship with that provider is yours.
This section does not grant you any right to use the TrustBeat name or logo beyond the disclosure required above, nor to describe yourself as a partner, agent, or authorised representative of Trustbeat s.r.o.
We may suspend or terminate any account that resells in breach of this section.
We aim for high availability but do not guarantee uninterrupted service. Planned maintenance will be communicated in advance where possible. We are not liable for damages caused by service interruptions outside our reasonable control.
TrustBeat and its API remain the intellectual property of Trustbeat s.r.o. You retain ownership of all data you submit to the service. We do not store the content of your files — only cryptographic hashes.
To the maximum extent permitted by applicable law, Trustbeat s.r.o. shall not be liable for indirect, incidental, or consequential damages. Our total liability shall not exceed the amount you paid in the 12 months preceding the claim.
These terms are governed by the laws of the Czech Republic. Any disputes shall be resolved in the courts of the Czech Republic.
We may update these terms from time to time. We will notify registered users by email at least 14 days before material changes take effect. Continued use of the service after the effective date constitutes acceptance.