Your processes leave proof of date and time with a qualified timestamp.
Your systems declare each fact over an API the moment it happens. Safe Creative, as a trusted third party, numbers it, chains it and covers it with a qualified timestamp. When you need the proof, it will be there.
“An intact sequence of declarations — no insertions, no deletions after the fact — under a configuration declared and sealed before the events, certified by a trusted third party.”
Self-service signup with a free Safe Creative account · free test environment.
Illustrative example
Your records hold up until someone challenges them
Many processes produce facts over time: an AI agent completes an action, a whistleblowing channel acknowledges receipt of a report, a technician closes the inspection of an installation, a security tool confirms a vulnerability, a system applies a configuration change. While everything runs smoothly, nobody cares about those facts.
The problem shows up months or years later, when you have to prove that it happened and when — before a regulator, a customer, an insurer or a judge. And that is where your own records fall short: data kept in systems controlled by whoever presents it can be altered without leaving a trace.
What your own systems can never give you: a declaration contemporaneous with the fact, prior to any dispute, and in the custody of a third party independent of the parties.
Three moments, three tempos
Create the channel — once
One channel per type of process: name, mode (content or digest-only) and who certifications will be issued to. The configuration is sealed and dated at creation: a commitment made before the facts that nobody can rewrite. If it changes later, it is versioned — never overwritten.
Your systems declare — continuously
One call per event, with an immediate acknowledgement. Safe Creative computes its digest, assigns it a sequence number and chains it to the previous one. Within minutes, the event is covered by the qualified timestamp of its segment. Retries never duplicate.
Request certification — when you need it
Recording and certifying are separate moments: the proof accumulates quietly, like insurance. When it is needed, you pick a channel and a date range and get a report signed by Safe Creative plus the evidence archive — verifiable by anyone, without access to anyone’s systems.
curl -X POST https://platform.safecreative.org/v1/events \ -H "Authorization: Bearer sc_live_************" \ -H "Content-Type: application/json" \ -d '{ "client_ref": "wo-48211-closed", "hash": "6b1f0c6e2d417a90c35f8be1d0a67c2419f5ab7e803c6d1f42b98e05c3d94a7d", "hash_alg": "sha-256" }'
{
"event_id": "evt_01j9zm3t7q8kx2ab",
"channel_id": "ch_3f9k2dq7w1xm5tpa",
"client_ref": "wo-48211-closed",
"sequence": 18327,
"received_at": "2026-09-14T09:41:07.318204Z",
"hash": "6b1f0c6e2d417a90c35f8be1d0a67c2419f5ab7e803c6d1f42b98e05c3d94a7d",
"modality": "content",
"chain_hash": "a94fb02c5e18d7b3c06a92f4e71d8b5a3c2e9f60d4b17a8e5c3f2d1b0a977c1e",
"status": "registered",
"timestamp": { "type": "pending" },
"config_version": 1,
"mode": "live"
}
This is the real API contract. Try it in the playground with a test key: free and with no evidential value.
We certify declarations. And that is the strength.
Safe Creative attests that your declaration was received, at exactly what moment, and that nobody has touched it since — not that the declared fact is true. The same logic as registered mail: it proves what was said and when, not that it was true.
That perimeter is what makes the certification solid: it promises exactly what it can uphold. The report always keeps the two voices apart: what Safe Creative attests (dated, intact reception; unbroken sequence) and what you declare (what the data means and on whose behalf it is declared).
Where internal logs are not enough
The common pattern: system-generated events, high legal stakes, and rules that demand provable integrity and date — without prescribing how.
Vulnerabilities and incidents · CRA, NIS2, DORA · SEC
Your security tooling — agents that scan and fix code, autonomous penetration testing, automated security operations — produces facts with legal deadlines: finding, validation, patch, verification, notification. If you manufacture products with digital elements, the Cyber Resilience Act requires you to report within hours and days from 11 September 2026. Digest-only mode: you declare the digest of each result from your continuous integration, and the details never leave your perimeter.
AI agents · EU AI Act
The EU AI Act will require high-risk systems to keep automatic logs of events (from December 2027 for those in Annex III). Each agent action is declared the instant it happens — in content mode: whenever needed, you can produce what the agent did, with its date covered by a qualified timestamp.
Whistleblowing channels
The law sets deadlines you must be able to prove — acknowledgement within seven days, response within three months — but the content is confidential by law. Digest-only mode: you declare the digest of each milestone and the content never leaves your company.
Maintenance and periodic inspections
Lifts, fire-protection systems. Each closed work order is declared to the channel. When a claim arrives, you don’t produce a loose sheet with a debatable date: you produce the full sequence of inspections, at its cadence, sealed by a third party.
Changes in critical systems · DORA · SOC 2, ISO 27001
DORA requires protecting ICT change and incident logs. Every deployment and every relevant configuration change is a declared event. Your internal log still exists; it just no longer depends on the word of whoever keeps it.
The content, or just its digest: your choice
- What you send
- The data itself: a token generated by your own process, or a file.
- What is proved
- The certification is self-contained: the data itself is held and sealed by the third party.
- When it fits
- When producing the data is part of the value: you want to show what was declared, not just that something was.
- What you send
- Only the cryptographic digest. The content never leaves your perimeter.
- What is proved
- Existence, date and integrity of something you keep.
- When it fits
- When confidentiality is involved. If one day the original must be produced, its sealed digest anchors it to its date.
The mode is chosen per channel, depending on what you need to prove.
Why it holds up as evidence
Legal presumption of the qualified timestamp
A qualified timestamp is presumed accurate in its date and time, and guarantees that what was sealed has not changed. Whoever denies it has to prove it.
In Spain, reinforced in court
When a qualified trust service is used, procedural law reinforces that presumption.
A third party independent of the parties
Records kept by whoever presents them can be altered without a trace. Here the evidence is held by Safe Creative, unrelated to the parties, and the timestamp is issued by an eIDAS qualified provider.
Versus audit trails that attest themselves. Receipts signed with the operator's key, digest chains and RFC 3161 timestamps from a free authority are verifiable — but they are attested by the interested party, and a non-qualified timestamp carries no legal presumption. Here Safe Creative, a third party independent of the parties, holds and chains your declarations; the timestamp is issued by an eIDAS qualified provider, the configuration is committed before the facts, and the report is signed by Safe Creative. Already running your own chain? Declare the digest of each receipt to us and turn it into third-party evidence.
And something we would rather tell you ourselves: no regulation requires you to hire a trusted third party. What regulations require is demonstrable integrity and date, without prescribing how. It is not a legal requirement: it is a solid way to be able to prove it, with legal presumption in the EU and in the custody of an independent third party. Outside the EU there is no legal presumption for the qualified timestamp: the proof rests on its verifiable integrity and on custody by an independent third party.
Docs, a price, and an afternoon to test
You don’t need a demo: the docs are public, testing is free and the price is on the page. Need a custom contract? Talk to us.
Public, complete documentation
API reference, guides and integration recipes per use case. It is the storefront of the service, not support material.
Transparent, published pricing
No “request a quote”. The price is on the page, like the rest of the terms.
Self-service signup
Open a free account, create a channel and start testing.
Free test environment
Validate your integration end to end, free and with no commitment, before you buy. In an afternoon.
Public verification page
Whoever receives a report — an auditor, an expert witness, a court — checks its authenticity without being anyone’s customer.
Availability is part of the product
Separate ingestion, immediate acknowledgement and a published retry guide.
Prepaid packs, with the price in plain sight
Net prices: VAT is added at payment according to your billing details.
- Prepaid: you buy a credit pack and each live event uses one.
- No plans, no lock-in: you pay for events, not subscriptions.
- On-demand certification, whenever you need it.
- Free test environment: test keys consume nothing.
The platform bills separately from safecreative.org: Safe Creative issues the invoice for each purchase with your billing details.
Frequently asked questions
What exactly does Safe Creative certify?
That your declaration was received, at exactly what moment, and that nobody has touched it since — not that the declared fact is true. It is the registered-mail logic: what is proved is that it was said, and when. The report keeps the two voices apart: what Safe Creative attests (dated, intact reception; unbroken sequence) and what you declare (what the data means and on whose behalf it is declared), expressly presented as your statement.
Does my content leave my perimeter?
Only if you choose to send it. In digest-only mode you declare the cryptographic digest and the content never leaves your systems: what is proved is the existence, date and integrity of something you keep. If one day the original must be produced, its sealed digest anchors it to its date.
Do I need to buy a safecreative.org plan?
No. You only need a safecreative.org account, which works as identity to sign in to the platform: the free one is enough and you don't have to buy any plan. They are independent lines of business: the account carries no plans, balances or discounts across. Platform balance pays for events — not for works, trademarks or evidence registrations.
Is there a white-label option?
No, and it is deliberate. Certifications are always issued under Safe Creative’s brand and signature: that independent third-party signature is precisely the value neither you nor your client can manufacture. White-labelled, the product would lose its reason to exist.
How does a third party verify a report?
On the public verification page. Whoever receives a report — an auditor, an expert witness, a court — checks its authenticity and integrity without being anyone’s customer and without access to anyone’s systems.
What happens if I run out of balance?
Your events keep being received, sealed and chained as unpaid, up to a limit, and are settled automatically when you buy credits. The sequence never breaks because of an administrative oversight; while there are unpaid events, though, certifications cannot be requested.
What if I already run an audit trail signed by my own system?
Keep it, and declare the digest of each receipt or checkpoint to the channel. What your chain cannot give itself is what the channel adds: custody by a third party independent of the parties and a timestamp issued by an eIDAS qualified provider, with legal presumption in the EU.
Does it work outside the European Union?
Yes, though with a different weight. The legal presumption of the qualified timestamp is European. Outside the EU, the certification is worth what anyone can check: an intact sequence of declarations made when the facts happened, held by an independent third party, with evidence verifiable through open standards (cryptographic digests and RFC 3161 timestamps). Its admissibility depends on each country’s rules. In the US, for example, the Federal Rules of Evidence allow electronic records to be authenticated by their digital fingerprint.
Read. Test. Decide.
That is how this service is meant to be evaluated: the docs are public, the test environment is free and the price is on the page.