A record that only its issuer can confirm is not evidence. It is a claim about evidence. Every proof Provlyn produces can be checked by someone who has never heard of us, using tools we do not control.
This page sets out exactly how, and what each check does and does not establish.
| What is checked | Tool | Who controls it |
|---|---|---|
| The file matches its fingerprint | Any SHA-256 tool | NIST standard, no vendor involved |
| The timestamp is intact and unaltered | OpenSSL | Open-source, independently maintained |
| The issuer is a qualified EU trust service | Our open-source validator, or the Commission’s | European Commission trusted lists |
| The record is anchored to Bitcoin | Any OpenTimestamps client | Public blockchain, no operator |
None of these require a Provlyn account, and none of them ask you to take our word for anything. The validator we built for the third check is open source, so you can read what it does rather than trust that it does it.
Most verification tools offered by a provider check that provider's own issuance. That answers a narrower question than it appears to: it confirms the record came from them, not that the record has any standing.
Our validator checks any RFC 3161 timestamp from any provider against the European Commission's List of Trusted Lists. Run a Provlyn certificate through it and it reports two timestamps: the qualified eIDAS one as qualified, and the freetsa one as valid but not on the trusted lists. It gives Provlyn no special treatment, because it has no way to.
That is the point of publishing the source. A verification tool whose workings are hidden asks for the same trust it claims to remove.
Validate any timestamp →Because a record that only its issuer can confirm carries the issuer’s reliability as a precondition. If the other side disputes when a document existed, and the only answer is that the vendor says so, the dispute becomes about the vendor. Independent verification removes that step: the person checking reaches the same conclusion from sources neither party controls.
Four things, each from a different source. That the file matches its recorded fingerprint, using any SHA-256 tool. That the RFC 3161 timestamp is intact, using OpenSSL. That the issuing authority is on the EU Trusted Lists, using our open-source validator or the European Commission’s own. That the record was anchored to the Bitcoin blockchain, using any OpenTimestamps client.
Run SHA-256 over your file and compare the result to the fingerprint on the certificate. On Windows: certutil -hashfile yourfile.pdf SHA256. On macOS or Linux: shasum -a 256 yourfile.pdf. If a single byte of the file has changed, the fingerprint will not match. Provlyn is not involved in this check and cannot influence it.
A Provlyn certificate carries its timestamps as attached .tsr files. Extract them in any PDF reader, then verify with OpenSSL against the issuing authority’s certificate: openssl ts -verify -in timestamp.tsr -digest <your file hash> -CAfile ca.pem. OpenSSL is open-source software maintained independently of Provlyn.
Provlyn submits the fingerprint to OpenTimestamps, which writes it into the Bitcoin blockchain. Any OpenTimestamps client can confirm the anchor against the public ledger. Neither Provlyn nor any other party can alter a Bitcoin block once it is confirmed, and the record remains checkable whether or not Provlyn continues to exist.
The certificate, the timestamps and the blockchain anchor keep working. They rely on the issuing trust service provider, OpenSSL and the Bitcoin network, none of which depend on Provlyn. This is why the certificate is a portable file rather than a page on our website.
That a file existed in a particular form at a particular time, and has not changed since, is what these checks establish. They do not establish who created the file, who owns it, or who submitted it. Authorship and ownership are separate questions, decided on other evidence.