Qualified timestamps for legal-grade evidence

Standard RFC 3161 timestamps are cryptographically sound and independently verifiable — for most engineering purposes they are exactly right. But some evidence ends up in front of a court, a regulator, or a counterparty's legal team, and there the eIDAS regulation draws a line: a qualified electronic timestamp from a qualified trust service provider enjoys a presumption of the accuracy of its date and time and of the integrity of the bound data across the EU.

sigill.ai makes that a parameter, not a project.

One flag, everywhere

Every operation that embeds a timestamp accepts qualified: true:

curl -s -X POST https://api.sigill.ai/tsa/stamp-hash \
  -H "Authorization: Bearer $SIGILL_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"hashHex":"'$HASH'","qualified":true,"label":"board-resolution.pdf"}'

The same flag works on document seals — POST /seal/sign, the hash-only endpoints, and the SDKs (qualified=True / Qualified = true). On a PDF seal it applies to every timestamp in the seal: the signature timestamp and the archival document timestamp both come from the qualified authority, so the artifact never mixes trust levels.

Where the qualification comes from

Qualified timestamps are sourced from providers on the EU List of Trusted Lists (LOTL) — the official register behind eIDAS — and our verifier reports the qualification with its source:

"timestamp": {
  "tsaName": "SK TIMESTAMPING UNIT 2026E",
  "qc": { "isEidasQualified": true },
  "qualificationSource": "lotl"
}

That lotl source means the qualification was established against the EU trust list itself, not a vendor claim — and it can be independently checked from the artifact alone with an eIDAS validator such as the EU DSS validator.

When to use which

• Standard (qualified: false, the default): CI artifacts, internal audit trails, development, high-volume machine evidence. Independent and verifiable, generous plan quotas.
• Qualified: contracts and signatures, IP filings, regulatory submissions, board documents, anything where you expect an adversarial reader with a lawyer. Qualified timestamps draw from a separate monthly quota (trial credits on free plans).

A common pattern is mixed: standard timestamps on every build, qualified on the release you actually ship to the customer.

Notes

• Qualification applies to the timestamp. Organisation seals bind your certificate and identity to the document as an advanced electronic seal; the qualified timestamp is what carries the statutory time claim.
• Nothing else changes: hash-only privacy, open formats, and independent verification all work identically — see Verify a seal without a Sigill account.