12. FAQ
Do I need to buy a safecreative.org plan? No. You only need a safecreative.org account, which is your identity to sign in: any type works, the free one included, and you don't have to buy any plan. This service is contracted and billed separately, and grants (and receives) no safecreative.org services.
Does my event content leave my perimeter? Only if you choose the content modality. With hash-only, you send the cryptographic digest and the data never leaves your systems; if one day you must produce the original, its sealed digest anchors it to its date.
Can I change the channel configuration? Yes: a new version is created, also sealed. No version is ever rewritten, and every certification states which version was in force for each segment. That is what turns your configuration into a commitment made before the facts.
What legal weight does this carry? In the EU, a qualified timestamp is presumed accurate in its date and time, and guarantees that what was sealed has not changed: whoever denies it has to prove it (eIDAS Regulation, art. 41.2). In Spain, when a qualified trust service is used, procedural law reinforces that presumption (art. 326.4 LEC) 🔒. Outside the EU there is no legal presumption for the qualified timestamp: the proof rests on its verifiable integrity and on custody by an independent third party. No rule forces you to use a third party: it is a solid way to be able to prove it.
White label? No. Reports carry Safe Creative's brand and signature — precisely the value neither you nor your customer can manufacture.
How does a third party verify my report? On the public verification page: with the code printed on the report, or by uploading the file (which additionally confirms it has not been altered). No account, no cost.
How is this different from an audit trail signed by my own system? In who attests. "Tamper-evident" audit trails that sign receipts with the operator's key, chain digests and add an RFC 3161 timestamp from a free or commercial authority are verifiable — but they are attested by the interested party itself, and a non-qualified timestamp carries no legal presumption under article 41.2 of the eIDAS Regulation. Here Safe Creative, a third party independent of the parties, holds and chains your declarations; the timestamp is issued by an eIDAS qualified provider, the configuration is committed before the facts, and the report is signed by Safe Creative. If you already run your own chain, keep it: declare the digest of each receipt or of each checkpoint to the channel and turn it into third-party evidence.
Can an AI agent declare directly, or send OpenTelemetry traces? Today, through the REST API from the agent's code or via a receiver (§11.1, route 3). An MCP server (so the agent declares as a tool call) and an OpenTelemetry trace receiver are planned as later layers on the same API; they do not change the contract.