Almost every record a development team already keeps was dated by the team itself. Git commits carry the clock of the machine that made them, and that date can be rewritten. To show that code existed in a specific form on a specific date, the record has to come from somewhere you do not control.
Provlyn hashes the code, has the hash timestamped by an accredited trust service provider, and anchors the result to the Bitcoin blockchain. The code itself never leaves your possession, and the certificate can be checked by anyone without asking us.
| Record | What it establishes | Where it is challenged |
|---|---|---|
| Git commit history | How the work developed, in sequence | Dated by your own machine, and rewritable by rebase or force push |
| CI and build logs | That a build ran on a date | Held and attested by a vendor you pay, subject to their retention policy |
| Public repository or release | That the code was public from a date | Requires disclosure, which forfeits novelty and trade secret protection |
| Qualified timestamped deposit | That code with this exact fingerprint existed on this date | Says nothing about who wrote it, which other evidence must establish |
The last row has a limitation as real as the others, and it is worth stating plainly: a timestamp says nothing about authorship. What it removes is the argument about dates, which is usually the argument that has to be won first.
A competitor files a patent on a method you built first. The United States has run a first-inventor-to-file system since the America Invents Act took effect in 2013, so building it first counts for nothing unless you can show you built it first. The evidence has to establish what the implementation contained, not merely that a project existed. This is covered in more depth in our post on software prior art.
A contractor or departing employee disputes ownership. The dispute is usually about which code existed at handover and which was written afterwards. A snapshot recorded at the handover date settles the first half of that question without either side relying on the other side's repository.
You are about to disclose, and disclosure is one-way. Under the European Patent Convention there is no grace period: a conference talk, a public repository or a demo before filing destroys novelty in every EPC state. A trade secret is gone the moment it stops being secret. Recording the position before the disclosure preserves evidence of what existed while it was still confidential.
Most tools in this space issue a certificate and stop there, which handles the case where the code stays private. It leaves out the case that comes up more often in practice, which is being asked to show the code to someone: an acquirer's technical due diligence, an escrow arrangement, a licensee's audit, a contractor being handed a module to work on.
Provlyn shares from a vault rather than by sending copies. Access runs through a controlled link, every view is logged against a timestamp, and access can be withdrawn. Where the material is a document rather than a repository, each recipient can be issued an individually watermarked copy, so a leaked file identifies the recipient it was issued to.
The access log is the part people underestimate. In a dispute about what a party knew and when, a dated record of who opened which file answers a question that no amount of correspondence settles.
One automated sequence, each step taking the output of the one before it. The file is hashed with SHA-256. That hash is timestamped under RFC 3161 by an accredited trust service provider. The timestamped hash is anchored to the Bitcoin blockchain through OpenTimestamps. Because only the hash travels, the code stays where it is.
eIDAS qualification is a separate option on top of that sequence. With it, the timestamp comes from a qualified trust service provider and carries the presumption under Article 41(2) that the date and time are accurate and the data intact. Without it the record is still valid and still checkable, but you would have to argue for its accuracy rather than having the burden sit with the party disputing it. The difference is set out in blockchain timestamps compared with qualified timestamps.
Every certificate can be checked without us. Run SHA-256 over your file and compare, verify the timestamp with OpenSSL, check the issuing authority against the European Commission's trusted lists, and confirm the anchor with any OpenTimestamps client. Our timestamp validator is open source and checks any provider's timestamp, not only ours.
Record your first deposit →By creating a dated record of the code before the question arises, held somewhere neither you nor the other side controls. The code is hashed with SHA-256, the hash is timestamped by an accredited trust service provider under RFC 3161, and the timestamped hash is anchored to the Bitcoin blockchain. The result is a portable certificate showing that code producing exactly that fingerprint existed on that date. It proves existence and integrity at a point in time, which is the element a dispute usually turns on.
Rarely, because the timestamp comes from the machine that made the commit rather than from an independent clock. An interactive rebase, an amended commit or a force push can rewrite the recorded date, and any developer can do it. Opposing counsel who raises this is technically correct. Git history remains useful as supporting evidence of how work developed, but it is not a record a third party dated.
It does not establish who wrote the code, who owns it, or who submitted it for deposit. A timestamp establishes that particular data existed in a particular form at a particular time and has not changed since. Authorship and ownership are separate questions, decided on employment contracts, contributor agreements, assignments and the wider factual record. Any service claiming a timestamp proves authorship is overstating what the mechanism does.
No. Only the SHA-256 hash is timestamped and anchored, and a hash cannot be reversed to recover the code it came from. The source stays private. This matters where publication would itself cause harm, since under the European Patent Convention any public disclosure before filing destroys novelty, and a trade secret loses protection once it stops being secret.
Whatever a dispute would be about. For a patentable method, the module implementing it plus the design note describing how it works. For an ownership dispute with a contractor or departing employee, a snapshot of the repository at handover. For a release, the built artefact and its manifest. Recording an archive of the whole repository at milestones works, and so does recording individual files. Each deposit produces its own certificate, so a sequence of them establishes how the work developed rather than a single moment.
Share it from a vault rather than by sending a copy. The recipient opens the files through an access-controlled link, every view is logged with a timestamp, and access can be withdrawn. Where a document is the deliverable, each recipient can receive an individually watermarked copy, so a leaked file can be traced to the person it was issued to. Due diligence, code escrow arrangements and contractor handovers all involve showing the work to someone, which is the point at which a record of what was shown and to whom becomes the useful thing.
It depends on where the dispute is heard. In the EU a qualified electronic timestamp carries a presumption under Article 41(2) of Regulation 910/2014 that the date and time are accurate and the data intact. That presumption is rebuttable: it shifts the burden to the party disputing it. It applies across all EU member states, and the EEA states recognise qualified timestamps through the EEA Agreement. The UK retains an equivalent framework including the presumption, though UK and EU qualified timestamps are no longer mutually recognised as qualified between the two regimes. The United States has no equivalent statutory presumption, so the record is assessed under ordinary rules of evidence as technical proof.
It establishes an outer bound rather than a moment. A blockchain records inclusion in a block, which can lag submission by anything from seconds to hours, so the anchor shows the data existed no later than that block. It also carries no eIDAS presumption, because the presumption under Article 41(2) attaches to a qualified electronic timestamp issued by a qualified trust service provider under Article 42, which a blockchain transaction is not. Used together the two answer different questions: the qualified timestamp records the moment and carries the presumption, the anchor puts the record beyond the reach of any single operator.
In both directions. If you are filing, a dated record of what existed before any public disclosure supports the invention disclosure and establishes what preceded the priority date. If a competitor files on a method you built first, a dated record of your implementation establishes the foundational element of a prior art challenge, which is that the method existed in a specific form before their priority date. What it cannot do is remove the need for a patent attorney to assess whether the disclosure is enabling for the claims at issue.
This page gives general information about evidence of software authorship and priority. It is not legal advice. For a specific matter, consult a qualified lawyer or patent attorney in your jurisdiction.