Timestamped. Traceable. Verifiable.
SealDoc adds a cryptographic proof layer to your documents: RFC 3161 timestamps from an independent Time Stamping Authority, chain of custody, and a Legal Evidence Pack for audits and disputes.
What is an RFC 3161 timestamp?
Like a notary stamp, but cryptographic and independently verifiable.
An RFC 3161 timestamp is a cryptographic proof that a specific document existed at a specific point in time and has not been altered since. SealDoc submits a hash of your document to a trusted RFC 3161 Time Stamping Authority (TSA), which signs the response. The result is embedded in your Evidence Pack and can be independently verified by any party.
Why it matters: if a document is ever disputed in court or during a regulatory audit, the timestamp proves it existed before the dispute arose and has not been tampered with since.
# Upload a document, fetch its Evidence Pack
POST /api/jobs (multipart/form-data)
file=@contract.docx
timestampRfc3161=true (default)
GET /api/jobs/{id}/evidence-pack
# The pack holds:
# - the PDF/A-3 document
# - the RFC 3161 token, when timestamped
# - the audit trail and a manifest of hashes Retention categories
SealDoc enforces retention: documents cannot be deleted before their retention period expires.
| Category | Period | Applicable law | Countries |
|---|---|---|---|
| OPERATIONAL_1Y | 1 year | Internal policy / best practice | EU-wide |
| BUSINESS_7Y | 7 years | Commercial law / tax regulations | NL, BE |
Legal Evidence Pack: what is inside
One ZIP file for an audit, a tax inspection or a dispute.
- PDF/A-3 document (ISO 19005-3)
- Audit trail: who, what, when, IP address
- RFC 3161 timestamp token, when the document was timestamped
- Manifest hash-chain
- For audits, tax inspections and disputes
GDPR compliance layer
Art. 17: Right to erasure
DELETE /api/jobs/{id}/data removes all blobs and database rows. The audit trail entry is preserved (required by law) but the document content is gone. Erasure requires a signed-in user, not an API key alone.
DELETE /api/jobs/:id/data Art. 20: Data portability
GET /api/tenant/export returns a ZIP of your account data: account, jobs, audit trail, users, webhooks and billing, as JSON. No vendor lock-in.
GET /api/tenant/export Art. 28: Data processing agreement
A DPA is available on request. Contact privacy@sealdoc.eu.