Deployment and integration
Define the workflow. Then price the work.
Use the free evidence tools today. Supplier Workspace is planned at €499/month excluding VAT; optional assisted setup starts from €4,950. Workspace is not on sale yet. Stamp subscriptions are a separate purchase.
Start with one supplier request, one reviewer and a measurable handover. Build a workflow brief to record the volume, current effort and success criteria before using the detailed estimator below.
Proposed work must name the deliverables, responsibilities, acceptance checks, support and price in a written scope. Shared supplier profiles, team permissions and automatic reminders are planned capabilities, not included features today. The estimator is indicative; it does not book work or create a service commitment.
Answer it as a procurement or compliance department would, and the figure moves as you answer — with a line under it saying which answer moved it, and by how much. Every rate it uses is printed below. Every line shows its working. Nothing is posted until you send the scope at the last step. What we would actually do, if you send it, is laptop work: a written scope, environment keys if you already hold them, and a call if you ask. There is no factory visit, no named engineer on a plane, and no second product. If Plant covers the count, buy Plant.
◔not checkedNobody has established this number. It is arithmetic run on answers only you have seen, until you send the scope.
Indicative, for the entity you name.
—
Fill the form in and this becomes a band.
Article 25, and it is your number rather than ours.
—
Put your Union-wide turnover in and this prints the floor of the maximum fine a member state must be able to impose on you.
EUDR Article 25(2) requires member states to provide for fines whose maximum is at least 4% of total annual Union-wide turnover in the preceding financial year, increased where necessary to exceed the economic benefit gained; plus confiscation of the products, confiscation of the revenue gained from the transaction, and temporary exclusion of up to 12 months from public procurement and public funding. A member state may set its maximum higher than 4%; none may set it lower.
Send posts a summary to us. Download is built in this tab. The e-mail opens in your own mail program. Nothing is posted until you choose.
The rate card, so the sum can be done on paper.
| Line | Rate | Charged against |
|---|---|---|
| The deployment — once, in year one | ||
| Standing it up | €48,000 | every engagement, once. The form declines to quote it at all unless at least two of these are true: more than one country of production, more than forty supplier sites, more than a hundred product lines, more than one entity filing in its own name, more than a hundred thousand units a year, or a supply base you do not own |
| Countries of production | €14,000 | each country. Each origin is its own legality stack under Article 3(b) |
| HS headings | €9,000 | each heading after the first. A second heading is a second set of record shapes and floors |
| Product lines | €900 · €360 · €140 | the first 100, the next 900, and each one after that |
| Supplier sites | €700 · €280 · €110 | the first 50, the next 450, and each one after that |
| Supplier programme | €340 | each site, and only where the supply base is not yours to instruct |
| Trader rather than operator | × 0.6 | the whole deployment. Article 5 is a lighter obligation than Article 8 |
| Seats | €0 | nothing. You are not buying seats, at any number of them |
| The year — every year, the first one included | ||
| Filing runtime | €24,000 | a year, for each legal entity that files in its own name against its own credentials |
| The meter | 11.9c · 9.8c · 8.9c · 8.4c | a closed stamp: the first 100,000 a year, to one million, to ten million, and above it |
| Your deadline | €0 | nothing, ever. It changes what can be in scope, never the rate |
| The shape of the total | ||
| Year one | D + Y | the deployment, plus the year |
| Each year after | D ÷ 4 + Y | a quarter of the deployment carries the configuration forward; the year is the year |
| The band printed above | −10% to +25% | around year one. It is not symmetrical, because scope found later goes up more often than it goes down, and a symmetrical band would be a flattering lie |
Indicative, and not an offer. Binding terms are in a written scope signed by both sides, and this table creates none. Every line is remote configuration of the published product — never a factory visit. It is published here so the arithmetic can be checked, argued with and taken away — including by somebody who decides on the strength of it that a €20,000 Plant year is the better purchase, which for most operators it is.
Procurement answers
Procurement answers — why there is nothing to migrate, SOC 2, ISO 27001, SSO, SLA, sub-processors, continuity Folded on purpose. The quiz above is the page.
Enterprise
There is nothing to migrate off.
That is not a feature. It is the shape of the thing you would be buying, and it decides how much the rest of this page has to carry.
The format is published.
The readable specification, the envelope text, the furniture profile and the conformance vectors are published documents, served from this site. The specification text is CC BY 4.0. The intended patent covenant remains a draft until given by the applicant; what is open and what is not is written down. Anyone can write a reader from them without asking us.
⚠ What is not given yet: a patent non-assert covenant. One is drafted and has not been reviewed by counsel, so nothing here is a patent grant and no page of ours describes one as in force. The US provisional is 64/125,042, rights not granted.
The reader runs offline.
Checking happens on the checker's own device, against the bytes in hand. It reaches no server of ours, so it cannot be metered, cannot be logged and cannot be switched off.
Both edges are third parties.
The lower edge is a drand beacon round. The upper edge is a signed RFC 3161 token from an independent authority. Neither is issued by us, and neither needs us to be readable.
A new envelope binds to a beacon round. A signed timestamp adds evidence that the committed bytes existed by its stated time; older content may appear in that envelope. Timestamp capacity is sold on the published plans. Deployment work, if agreed, is separately scoped. A recipient can check a downloaded stamp without our server.
Four rungs are bought without us. This one is scoped.
The plans page sells a ladder with a card and no conversation in it, on purpose. This page is about the one thing that ladder cannot sell — and about doing the scoping and the pricing here, in your browser, so that what is left of the conversation is a yes.
Bought with a card, by you, today.
Trial at €0, Maker at €39, Studio at €149, Works at €499 a month — twelve months for the price of ten if you pay the year — and blocks of 500, 5,000, 25,000 or 100,000 closed stamps that are bought once and never expire. Nobody speaks to a human to buy any of them, and nobody is going to have to.
If your scope fits there, buy it there. It is cheaper, it is faster, and the quiz on this page will say so plainly rather than route you here. The whole ladder.
Scoped, then bought.
A deployment is not a bigger allowance. It is a configuration against a defined problem: your commodities and HS headings, your countries of production and their legality stacks, your supplier sites — including the ones that do not work for you — and a filing runtime holding your Information System credentials, per legal entity.
That work does not follow a headcount and it does not follow a month, so it is not sold by either. It follows the scope, the scope is different every time, and that is the honest reason this card carries no monthly figure.
The tension, since a page that hid it would deserve to be caught hiding it. The metered ladder exists so that the founder is not the bottleneck — so that a buyer at half past eleven at night can price the thing, buy it and start, with nobody to wait for. A rung that is scoped puts a person back into the middle of that. The resolution is the quiz at the top of this page: the scoping and the pricing happen before the conversation, not in it. You fill the form in yourself, it prices itself on screen with the arithmetic printed line by line, you take away a written scope you built, and the first e-mail either of us sends is already scoped. What is left to say is yes or no.
What leaves, and only when you choose. The quiz prices itself in this tab. At the last step you can send the scope to us (it becomes a Lead in the CRM we operate in the EU), download the document, or open it in your own mail program. Until you press one of those, nothing is posted. The form itself still has nowhere to submit: this page is served with form-action 'none', so a browser would refuse an HTML submission. The send button is a same-origin fetch to /api/crm. Plots, stamps, desk bundles and Information System keys are never in that payload.
What the number is not. It is indicative, it is arithmetic run on your own answers, and it is not an offer. Binding terms are in a written scope, signed by both sides. Nothing on this page — not the rate card, not the band, not this sentence — creates one.
Why that is a procurement requirement, not a story.
Two pieces of European law already ask the question this page answers. One sets the horizon; the other sets the exit.
The horizon: EUDR. Regulation (EU) 2023/1115 requires due-diligence documentation to be retained and producible for at least five years. The obligations begin on 30 December 2026 for large and medium operators and on 30 June 2027 for micro and small ones. A statement filed in 2027 must still be readable, and its evidence still checkable, in 2032. So a reader prints, beside every stamp's bracket, the date on which that stamp stops being independently checkable by an ordinary PKI verifier — a date read from the reader's own recorded copy of the timestamp authority's certificate, never from the stamp itself, since a date a stamp carried about itself would be the stamp vouching for its own shelf — together with any renewal timestamp that extends it: a renewal the format carries beside the envelope, and one the desk issues as a side-car, so the record's identity never moves. That is a longer horizon than most compliance startups live, ours included, and a buyer who does not plan for the vendor's absence has not finished the assessment.
The exit: the Data Act. Regulation (EU) 2023/2854, applicable since 12 September 2025, requires a data-processing provider to support switching, to complete the transition in at most 30 days, and — from 12 January 2027 — to charge nothing at all for it.
Our transition period is zero days and our switching charge is zero. Not out of generosity, and not as a concession we could withdraw: you never handed us the thing you would otherwise have to get back. The records are sealed on your device, in a published format, and they are already in your storage. There is no export to schedule because there is no import to undo.
Everything below this line is smaller than that. It is written down anyway, because a procurement department is entitled to the small answers too, and because answering them in public is cheaper for both of us than answering them one inbox at a time.
The procurement checklist, answered in public.
This is the list that usually arrives as a spreadsheet. It is answered here instead, in the four outcomes the product uses on evidence, so you can read our answers about ourselves the way a reader reads a stamp.
not refuted — nothing contradicted itnot checked — nobody has established itrefuted — we do not have itproduced — a thing exists; nothing was judged
| What procurement asks for | Outcome | What is actually true |
|---|---|---|
| Certifications and audits | ||
| SOC 2 Type II report | ✕refuted | None. We have never held one, none is commissioned and none is scheduled. Nothing on this site should be read as implying otherwise. |
| ISO/IEC 27001 certification | ✕refuted | None. No certification body has assessed us against 27001 or anything else. |
| Independent penetration-test report | ✕refuted | None commissioned. What exists instead: the format, the reader and the conformance vectors are public, so the part worth attacking can be attacked before you sign. Findings go to security@openstamps.com. |
| Customer references and case studies | ✕refuted | None to give. We would rather you check a stamp than telephone a reference: one is evidence and the other is a person we chose. |
| Security questionnaire returned privately | ✕refuted | We will not send one set of answers in private and publish another. This table is the answer; copy it into your form, and hold us to it in public. |
| Identity and access | ||
| SAML single sign-on | ✕refuted | Not built. When it is built it will be on every plan at no extra price. Single sign-on is a baseline security control, not an upsell — the position argued at sso.tax, which we agree with. Charging for it would mean selling the smaller customers a weaker account on purpose. |
| SCIM provisioning or directory sync | ✕refuted | Not built. The same commitment applies: it will not carry a price of its own when it exists. |
| API keys you issue and revoke yourself | ◆produced | Any account makes one, in the account page, with no plan condition. Only a SHA-256 hash of the key is stored, never the key; a revoked key keeps its row as the trail. |
| Seat limits enforced by the software | ◔not checked | Seats are printed on the plan and are not policed by the code. A deployment does not count them at all — they are not a line on its quote and not a term in its scope — so nothing here turns on it; it is written down because it is true of the self-serve ladder below you, whose seat numbers are honour-system. |
| Support and service levels | ||
| Named account manager or support contact | ✕refuted | None, deliberately. There is nobody to be escalated to because there is no queue you are standing in: what you would have asked is published, and what is not published is not privately better. |
| Support response-time commitment | ✕refuted | None, on any plan. pilot@openstamps.com and security@openstamps.com are read by people; neither carries a promise about when. |
| Uptime SLA with service credits | ✕refuted | None promised, on any plan, and none is implied by anything below. What exists instead is narrower and is in the code rather than in a paragraph: a draw the relay could not turn into a token goes back to your balance. Its edges — including what it cannot detect and therefore cannot refund — are under Availability below. |
| Timestamping and legal effect | ||
| eIDAS-qualified timestamp authority | ◔not checked | The anchor set today is freetsa.org, a volunteer service, and timestamp.digicert.com, a courtesy service for DigiCert's code-signing customers. Neither is a qualified trust service provider, so no legal presumption under eIDAS Article 41 may be implied from a token either one signs, by us or by anyone quoting us. A paid qualified authority is needed before commercial volume, and it is the next thing this money buys. Since 2026-09-05 the engine pins six of SK ID Solutions AS's production time-stamping units, as listed on the Estonian eIDAS trusted list (sr.riik.ee, sequence 73); a token signed by one of those six checks offline once a contract is configured, and a token signed by any other key reads not checked; a contract with any other qualified authority needs that authority pinned from its own trusted list first, or its tokens read not checked. Until a deployment carries such a contract this row stays not checked. |
| More than one authority behind a closed stamp | ◆produced | Two free legs are attempted on every stamp — and a qualified third where this deployment has contracted one — and that is the honest word. The relay posts the same imprint to every leg at once and the record carries every token that came back — so a stamp closes on one token when another authority does not answer, and it is charged the same: the meter draws once per stamp and once per renewal, never once per token. A two-token bracket survives an authority disappearing. A one-token bracket rests on that one signature, and the record says how many it holds. |
| A qualified token added later, without re-stamping | ◆produced | A record carries more than one token. A closing edge bought next year still closes a bracket opened this year, so nothing already sealed has to be made again when the anchor set improves. |
| Verification without contacting the vendor | ◇not refuted | The reader checks a stamp on your device, against the published format, and reaches no server of ours. Test it with the network off — that is the only version of this claim worth anything, and it is the one we would rather you ran than believed. |
| Data protection | ||
| Customer files uploaded to us for stamping | ✕refuted | Files are hashed in the browser. On the desk, at the plot and in the checking tool the bytes never leave the device: what travels is a digest, and a digest cannot be read back into a document. |
| Any customer bytes at all on our storage | ◆produced | One place, and this page describes it two sections down: the hand-off mailbox. A grower's phone posts a sealed record into the mailbox a buyer opened, where it waits 1 to 30 days at that buyer's own choosing, 14 by default, stored as posted, in the clear. That is a store of customer evidence, held for a bounded time, and it is the reason the row above is written narrowly instead of as "nothing is ever held". |
| Data-processing agreement | ◆produced | Data-processing terms attach to the order. Protosonic is processor for the hand-off mailbox and for filing deployments, where you are the controller, and controller for the website, accounts and payments. |
| Named sub-processor list | ◆produced | Named with role and country under Sub-processors below, and in the privacy notice. |
| Retention schedule, surface by surface | ◆produced | Published per surface: hand-off deposits 14 days by default and 1 to 30 at the buyer's own choosing, the farmer's phone 90 days, the meter counts only. A revoked API key's row is kept on purpose, and that is not a retention we can shorten for you: the hash, the label and the hour it was retired stay on the account as the audit trail, and so that the same string can never be minted twice. What revocation deletes is the index that makes the key usable, so the key stops working at once. The row goes when the account is closed. |
| Record of processing, or a data map | ◆produced | The controller-and-processor table in the privacy notice is the map: every surface, who is responsible for it, where it is stored and for how long. |
| Exit and continuity | ||
| Proprietary format needed to read your records | ✕refuted | The envelope, the furniture profile and the conformance vectors are published. A third party can write a reader without asking us, and one already runs in your browser. |
| Source-code escrow agreement | ✕refuted | None. Escrow exists so a customer can still read its records after a vendor fails, and you can already read yours without anything of ours being released: the format, the furniture profile and the conformance vectors are published, and the reader runs on your device. Our server source is not published today — the terms reserve the software and the hosted service, all rights reserved. What is open is the format, which is the half you would have needed. |
| Migration or export tooling at exit | ✕refuted | None, because there is nothing to migrate. You already hold every record, in the open format, on your own storage, and a copy of a sealed record is the record. |
| Notice before the service is shut down | ◔not checked | 90 days is written under Continuity below — on this page and nowhere else. It is not in the terms, which reserve the right to change or withdraw free tools at any time and contain no shutdown clause at all. Read it as an intention the founder has published and has not yet put into a contract, because that is what it is. |
How to read the middle column. It answers the claim that we have the thing named on the left, and it uses the product's own grammar: ◆ produced is a thing that exists and was not judged, ◇ not refuted is a claim you can test that nothing has contradicted, ◔ not checked is a gap nobody has closed, and ✕ refuted is a plain no. None of them is a pass, here or anywhere else on this site. That is also why there is no column of ticks: a tick is a claim in a costume, and a row of them tells a reader nothing about who checked.
Paying, and exactly what the code does.
Two shapes, and the difference between them is most of this page. Four rungs and every block are bought through Stripe Checkout with nobody telephoned. A deployment is not bought that way at all, and what that means in practice is printed here rather than discovered in a fortnight.
A deployment, and what actually happens.
You scope it above and you get a band. If you want it, you send the scope you built. What comes back is a written scope: the entity, the headings, the origin countries, the sites, the filing runtimes, the rate card, a term and a price. Signed by both sides, that document is the binding one — and nothing on this page is, including the number the panel printed for you.
It is invoiced by transfer, outside this software. There is no checkout for it, no card, no direct debit, no subscription to cancel and no dunning: an invoice from Protosonic OÜ against a signed scope. Prices exclude VAT.
And the disclosure that costs us something to make. No code in this repository has ever invoiced a deployment, because none has been sold. The relay, the meter and the filing routes are built and tested; the commercial machinery around a deployment is a person, a document and a bank transfer. If you need a vendor whose enterprise billing is a running system rather than an intention, this is where you find that out — before signing, which is the only useful place to find it out.
The self-serve rungs, and the blocks.
Bought in the account, monthly or annually in advance, through a Stripe Checkout session. Prices exclude VAT; Stripe determines and adds it from your country and your VAT number, and Stripe issues the invoice. Nobody is telephoned to arrange any of it.
The 100,000 closed stamps block at €22,900 is bought once and never expires. Being a one-off payment rather than a subscription, it is the one purchase Stripe raises a full invoice for by itself, and it renews nothing, duns nobody and cannot be cut off — often the fastest thing to get through a purchasing department, and it matches what you are buying: closing edges, held by you. Four of those carry one fully bracketed finished item, so a piece of furniture costs about 92 cents in evidence at that overflow rate. The block is dearer per stamp than a year on Studio or Works: it is a purchase order, not a cheaper subscription.
A large operator can buy blocks and never read this page. That is not an oversight in the offer. If your scope does not need configuring against origin countries, sites you do not own and your own filing credentials, blocks are the cheaper and the faster purchase — and the form above says so itself, in place of the band, rather than leaving you to work it out.
- Supplier
- Protosonic OÜ, Estonia, trading as OpenStamps
- Registry code
- 16344167
- VAT number
- EE103014252
- Currency
- EUR. Prices exclude VAT; on the rungs Stripe determines and adds it
- The self-serve rungs
- card, through Stripe Checkout, in the account
- Blocks
- a one-off payment; Stripe raises the invoice by itself
- A deployment
- by transfer, against a signed written scope, outside this software
- Enquiries
- pilot@openstamps.com
Two live unknowns, since this page would rather be dull than wrong. No code in this repository has ever talked to Stripe — the billing function is built against the published API and tested against a fake, so the first real purchase is the first live test of it. And the meter still carries a subscription plan under this rung's name, which the account still lists. It is an allowance, not a deployment; buying it would not get you one; it is to be removed. Its figure is deliberately not reprinted here.
What is still not offered, so that nobody spends a fortnight discovering it. On the self-serve rungs: no negotiated discounts, no redlines, no master agreement of your drafting, no custom terms, no custom retention, no custom SLA. The terms are the same for everyone on the ladder, from the free trial to the top of it.
A deployment is scoped, and scoping is not negotiating. What moves in a written scope is the SCOPE — which entities, which headings, which origins, which sites, which term. The rate card does not move, and it is printed above where your competitors can read the same figures you were given. That is the difference between a price that follows the work and a price that follows how badly you need it by December, and it is why the form has no field asking when your board meets.
It is also why there is still no call to book, no calendar and no chat. A call can only settle a thing that is negotiable, and everything a first call would have settled — what it is, what it costs, what it does not include, whether you need it at all — is on this page, in writing, before you write to us.
What a deployment includes, and what it does not.
What it is.
- A configuration against your own problem — your HS headings, your countries of production and their legality stacks, your supplier sites, your record shapes and your product lines
- A filing runtime for each legal entity that submits in its own name, holding that entity's own EU Information System credentials and no other entity's
- The meter, at the rate card above, running beside the deployment for as long as it runs
- Seats, uncounted and unpriced, for as many people as the work needs
Two things that are not additions, said before somebody plans around them. The evidence is identical to the free trial's: the same envelope, the same two edges, the same published profile, the same offline reader, the same four floors. And a filing deployment is not exclusive to this rung — Studio and Works can have one. A deployment buys configuration, origin coverage and the work of standing it up. It does not buy a better stamp, and no amount of money on this page does.
What it does not include.
- No SLA of any kind, and no service credits — at any price on this page
- No named contact and no support response time
- No SSO and no SCIM — they are not built, and when they are they will be free on every rung
- No private answers: the checklist above is the one every buyer gets, and it is public
- No better continuity promise than the free trial gets, for the reason set out at the foot of this page
- Everything a smaller rung gets is already here; nothing is withheld from them to make room for this
Why the meter costs what it costs, since the question is fair. One closed stamp is priced as two RFC 3161 tokens, because the imprint goes to two independent free authorities — and, where a deployment has contracted one, to a qualified third that rides the same single draw: a bracket anchored to a single one is a bracket that ends when that authority does. Renewing a stamp's timestamps is the same draw again — the meter draws once per stamp and once per renewal, never once per token, however many authorities answer either. Published list prices for qualified EU timestamps run about €0.043 a token at 10,000 and €0.035 at 100,000, so a closed stamp costs roughly eight euro cents fully loaded at medium volume and about fourteen at low volume. The self-serve ladder runs 32.5, 24.8, 20.8, 16.7 and 14.3 cents an included stamp, and yearly 27.1, 20.7, 17.3, 13.9 and 11.9. Overflow blocks sit above those yearly rates so topping up a cheaper rung is not a shortcut to the next. The deployment meter opens at 11.9 — the same rate as a year on Plant, cheaper than any self-serve block — and steps to 9.8, 8.9 and 8.4 as the year passes 100,000, one million and ten million closed stamps — each band above what a token costs at the volume that reaches it.
And why the deployment is a second number rather than a bigger first one. The meter pays for tokens, and tokens scale with stamps. The deployment pays for the work that has to happen before a token is worth buying: an origin country's legality stack read and encoded, a supply base that does not work for you brought to the point of stamping, a filing runtime standing up under one entity's credentials. None of that scales with stamps, so charging for it per stamp would overcharge a high-volume operator with one origin and undercharge a low-volume one with fourteen. Two numbers, each following the thing that actually drives it, is the honest shape — and both are printed above rather than quoted in a room.
Four closed stamps make one fully bracketed finished item, at the four events the furniture profile puts a floor under: harvest, work order, unit ordinal and filing hand-off. The plans page has the whole self-serve ladder, and it is worth reading before you scope anything here — most operators, including some large ones, do not need a deployment, and the form above will tell you so in place of a band.
Security, answered as an architecture.
We have no certificate to show you. What we have instead is a design in which the interesting thing is not here to be taken.
Files are hashed in the browser and never uploaded. The declared record, the photographs, the delivery notes — on the desk, at the plot and in the checking tool the bytes stay on the device that made them. What travels is a digest, and a digest cannot be read back into a document. Nothing on those three paths posts a file to us. One path does hold customer bytes, it is not an exception we would rather you missed, and it is the next paragraph.
Hand-off deposits and account workspaces have different storage rules. An account can store a workspace backup; that is not a shared team workspace. See the privacy notice for account data and retention. When a buyer asks a grower for a record, the grower's phone posts the sealed record into a mailbox we run for that buyer, where it waits to be collected. It is held for 1 to 30 days at the buyer's own choosing, 14 by default, and the request and everything in it are deleted on the next touch after expiry. Said plainly, because it matters: deposits are stored as posted, in the clear. "We do not read them" is a promise, not a lock, until deposits are encrypted to a key carried in the request link.
What else exists on our side is small and named. An account holds an e-mail address, a signed session cookie, the plan, the period's counts and the top-up balance. An API key is stored as a SHA-256 hash, never as the key, and a revoked key's row is kept as the audit trail. The meter keeps counts and nothing else — no record, no fingerprint, no content. Card, Revolut Pay and bank details are entered on Stripe's own hosted pages: we never see a card number, Revolut credentials or an IBAN, and no payment page is served from here.
One credential here is larger than everything above it, and it is not ours. A filing deployment holds the operator's own EU Information System credentials — the username and the Authentication Key — in the deployment's environment configuration. That is the credential that lets a due-diligence statement be submitted, amended or retracted in the operator's name, and it makes this server a party rather than a pipe: the timestamp relay forwards bytes it cannot forge, and this does not. It is never sent to a browser, never logged and never in a response body; every filing route is same-origin, rate-capped and reached only by a person pressing a button that says File. It is also why filing by API is off unless an operator asks for it: with no such variables set, every filing route answers 503 and the desk tells the operator to upload the downloaded statement in their own Information System account instead. The Commission's conformance test has not been recorded as passed for this deployment, and until it is, treat every filing result as acceptance-grade.
The surface-by-surface controller map, every retention window and every legal basis are in the privacy notice, which is written to be read by your data protection officer rather than by us. Vulnerability reports go to the address in /.well-known/security.txt. The format is public to attack before you sign, and we would rather hear it from you than from a customer.
Sub-processors.
Everyone who touches anything, with what they do and where they are. If this list changes, it changes here.
| Party | Role | Country |
|---|---|---|
| Netlify, Inc. | Hosting, serverless functions and blob storage — the account record, the hand-off mailbox and the meter | United States, under EU Standard Contractual Clauses |
| Stripe Payments Europe, Ltd. | Payments, invoicing and VAT determination; holds the customer record. Stripe, Inc. is its own sub-processor | Ireland (Stripe, Inc.: United States) |
| Resend, when configured | Sends the one-time sign-in e-mail, and only that. It is named here because it is the only provider the account code can use — one implementation, chosen by an environment variable — and it becomes a sub-processor only on a deployment that has configured it, which is why the privacy notice holds the name until one does. Where it is not configured the account function answers 503 and no e-mail is sent | United States |
| FreeTSA | RFC 3161 timestamp authority for the closing edge. Receives a digest, never a file. A volunteer service, not a qualified trust service provider | Germany |
| DigiCert, Inc. | RFC 3161 timestamp authority for the closing edge. Receives a digest, never a file. A courtesy service for code-signing customers, not a qualified trust service provider | United States |
drand is not on this list, and that is the point. The drand beacon is a public randomness source operated by the League of Entropy. It receives nothing from us and holds nothing of yours: the lower edge of a bracket is a round number that already existed before your bytes did. It is named here so that it is not filed as a sub-processor by somebody being careful, and so that nobody mistakes it for a service we could lose.
Thirty days' notice of any addition to this list, published on this page. There is nothing to subscribe to: the page is the notice, and the line below is how you check that it is current. Read it the way the continuity cards are meant to be read — it is an intention published here, not a clause in the terms or the privacy notice, and neither of those documents carries it today.
This list last changed on 5 September 2026.
Availability, split the way the product is built.
Three different things are usually bundled into one uptime number. They have genuinely different answers here, and not one of those answers is a percentage.
Checking and reading.
No SLA, because no server of ours is involved. A reader checks a stamp on the reader's own device, against the published format. Our being down cannot stop it. Neither can our being gone. There is no number we could promise here that would be as strong as the absence of a dependency.
The closing edge.
No SLA, because it depends on third parties. Closing a bracket means reaching independent timestamp authorities. We do not control their uptime and will not promise it with our name on it. What we will do is say exactly what happens when it fails, which is the next card.
What the meter gives back.
A draw the relay could not turn into a token goes back to your balance. The unit is taken before the call and returned when the authority does not answer with a usable token — a refusal, a timeout, a dropped connection, or a reply that carries a rejection instead of a token. It is a refund in the code, not a hope that the draw never landed, and nothing is queued behind it: the record still seals, one-sided, open at the top, honestly weaker, readable by everyone.
What the relay cannot see, it cannot give back. A token that leaves here well formed and is then refused by the reader on your device is charged. So is a stamp that closed on one authority when the second did not answer — one stamp, one draw, either way. And a refund landing after your month has rolled returns the top-up part in full but the included part only as far as the new month has been used, so a very late one is smaller. No SLA sits behind any of this, and none is implied.
A 99.9% figure is a number a vendor writes about itself, settled by a support ticket months later against credits you have to ask for. What is above is smaller than that promise and it is a behaviour you can watch in your own balance on the day it happens, including the parts of it that do not go your way. Narrower and real is the trade, and it is the one we would rather be judged on than a paragraph.
Continuity, and why it is not a tier.
Three intentions about the day we are not here. They are the same on every plan, including the free one — and they are written on this page and in no contract, which is the first thing to say about them.
Read all three as ◔ not-checked. None of them is in the terms, which carry no shutdown clause and reserve the right to change or withdraw free tools at any time. Nobody has established them, no auditor has seen them and no clause obliges us to keep them. They are what the founder intends and has published so it can be quoted back; a page that dressed them as terms would be selling exactly the kind of promise this product exists to replace. The one continuity promise that is a term is in § 6: every stamp already made stays checkable by anyone, permanently, after we stop selling and after we stop existing — and it costs nothing to keep, because checking never touched a server of ours.
◔not checked
Ninety days' notice.
The intention: if the service is to be shut down, notice is published here and sent to every account 90 days before it happens. Not thirty, and not a redirect to a holding page one morning. Not in the terms today.
◔not checked
The server halves, at shutdown.
The intention: at shutdown the two halves a static site cannot supply — the timestamp relay and the meter — are released under an open licence, so anyone can keep closing brackets. They are closed source today and the terms reserve them.
◔not checked
Mirrored, not hosted.
The intention: the specification, the reader, the test vectors and the conformance pack are mirrored to independent archives, so they outlive the domain, the company and this page. No mirror is named here yet, because none has been arranged.
What escrow is for, you already have; what escrow releases, we have not released. Escrow exists so a customer can go on reading its records after a vendor fails — and you can, without anything of ours changing hands: the format, the furniture profile, the record shapes and the conformance vectors are published under documented licences, and the reader runs on your device against the bytes in your own storage. Our server source is not published, and the card above is an intention rather than a release. That is the honest version, and it is still the reason there is nothing to sign: the half an escrow agreement exists to reach you already reached you.
Whatever these are worth, they are worth it to every rung and not to this one. A deployment buys configuration, origin coverage, filing runtimes and the work of standing it up. It does not buy a better promise about what happens when we are gone — because a continuity clause you can buy is a continuity clause somebody else can be denied, and a thing that can be denied is a thing that gets negotiated. This model exists to make that conversation unnecessary. Putting a price on the exit would put it straight back, and writing these three into a scope for you alone would be the same move wearing a lawyer's coat. They stand here for a free trial and for a twenty-country estate on identical terms, which is to say on none.