Proving when as well as what: trusted timestamps and preservation evidence
A signature shows what was agreed, but its algorithms age. Essence keeps long-term evidence apart, can have it dated by an outside authority and renewed, and exports it for anyone to check offline.
Say a tenancy agreement signed this year is disputed in 2046. Showing what was agreed is the easier half of the problem. The harder half is showing that the record existed on a given date and has not changed since.
A signature does not settle that on its own. It rests on certificates that expire and algorithms that age: one that is strong today may be deprecated in ten years. Evidence that was sound when it was made can become impossible to check because nobody looked after it.
In our September release we built the parts of the Essence platform that look after it.
A record kept for the long term
The platform already keeps an audit log of events, and purges it after seven years. Evidence a person may need decades later has a different lifetime, so it is kept as its own record. The jobs that move and purge audit entries cannot read or change it, and while a retention obligation on a record is live, that record is exempt from purging.
What is kept is a fingerprint, which we call a commitment, over the encrypted content and the descriptive details the server already holds. It is never the readable content. Where a person's own device has fingerprinted the readable version, the record can refer to that, and the server never sees what it covers.
A witness for the date
A date that only we vouch for proves little. The platform can attach a timestamp from an outside time-stamping authority to each preserved item, in the RFC 3161 format: a signed statement from someone other than us that a given fingerprint existed at a given moment.
Each country instance names its own authorities in its own configuration, so the choice of witness sits with the jurisdiction that holds the record. An instance can list several in order and fail over between them. It can also keep the revocation data for each timestamp certificate alongside the timestamp, so an old timestamp can be checked years later without going back to the authority that issued it. Authorities, like algorithms, do not last for ever.
Renewal before algorithms age
Which algorithms count as trusted is held as policy data, not written into the code. For each algorithm the policy records whether it is trusted, deprecated or disallowed, and from when. Where authorities set different dates, the strictest applies and is recorded. A change of policy puts the affected evidence back up for review without a software release.
Each preserved item builds up a chain of timestamps, each one covering the last. A renewal job reads the policy. Before a timestamp's algorithm, key or certificate reaches the end of its trusted life, less a safety margin, the job adds a new timestamp to the chain. Before a hash algorithm reaches its end, the job can fingerprint the content again under a newer algorithm and bind the old and new fingerprints together.
For the move to post-quantum cryptography there is also a composite witness, which pairs a classical signature with ML-DSA, the post-quantum signature standard published as FIPS 204. The renewal job adds it to a chain before any classical algorithm on that chain is deprecated, so the evidence is ready before the change arrives.
A result anyone can check
Verification reports each link in the chain: its algorithm, whether the witness is an outside authority or the platform itself, its time, and the algorithm's status at that time. The overall answer is one of five: preserved, preserved with declared gaps, renewal overdue, unsupported algorithm, or broken. An algorithm the verifier does not recognise is reported as unsupported, never as tampered and never as verified.
A chain exports as a self-contained bundle that verifies with no network access to any Essence instance. New chains also export in the evidence record form defined by RFC 4998, a published standard for long-term evidence. A court, a regulator or the other side of a dispute can check the evidence without access to our systems.
The evidence itself stays on the country instance that holds the record's jurisdiction. Only fingerprints and witness digests may cross between instances.
If your organisation keeps agreements, filings or consent records for years, the useful question is whether a record can still be shown to be genuine after today's algorithms are retired. If that question matters to you, we would be glad to walk you through how the platform answers it.
Published 2 October 2026