The best RFC 3161 timestamp services for EU compliance (2026)

If you need to prove a document existed at a point in time and has not changed since, an RFC 3161 timestamp is the standard mechanism. But “get an RFC 3161 timestamp” hides a real choice. Some providers hand you a raw timestamp token. Some give you a legally qualified one under eIDAS. Some give you a complete, court-ready evidence artifact. This guide compares the options that matter for EU compliance, and tells you which one to pick for what.

If you want the mechanics of how trusted timestamping works, read our explainer on RFC 3161 timestamps and when they are legally required first. This article is about choosing a provider.

Four things that actually matter

1. Qualified or basic? Under eIDAS (Regulation (EU) 910/2014), a qualified electronic timestamp from a Qualified Trust Service Provider (QTSP) carries a legal presumption of accuracy and integrity. A basic RFC 3161 timestamp is technically valid but carries no special presumption. For high-value or regulated evidence, qualified matters. For internal integrity checks, it often does not.

2. EU-based or not? For sovereignty-sensitive work, where the provider is established and where your data lands can matter as much as the timestamp. A Belgian QTSP owned by a non-EU parent is not the same sovereignty story as an EU-owned provider.

3. How you integrate. Some providers expose a plain RFC 3161 endpoint, which is ideal for signing pipelines, OpenSSL, and PDF tools. Others add a REST or JSON API. Match it to your stack.

4. Token or evidence artifact? A timestamp token proves exactly one thing: this hash existed at this time. A complete evidence artifact bundles that token with a hash chain, an audit trail, and a verifiable package you can hand to a court or auditor. Decide which you actually need before you shop.

Qualified EU trust service providers

Pick one of these when you need a legally qualified timestamp token with the strongest legal weight, and you want your provider inside the EU.

• Evidency (France). API-first qualified timestamping, sealing, and archiving from a QTSP qualified by ANSSI. Best for EU teams that want qualified eIDAS timestamps over a clean REST API. Pricing starts from around 500 euro per month, with no free tier. See evidency.io.
• D-Trust / Bundesdruckerei (Germany). The QTSP of Germany’s state-owned Bundesdruckerei group. Its qualified timestamps are guaranteed verifiable for up to 30 years, with a time source synchronised to the German DCF77 signal. Best for long-term, legally binding evidence from a state-backed provider. See d-trust.net.
• Certum / Asseco (Poland). An audited certificate authority since 2002, offering qualified timestamping plus a free public basic TSA (time.certum.pl) for private and non-profit use. Best for EU teams that want a qualified provider with an easy free option to start testing. See certum.eu.
• SK ID Solutions (Estonia). Qualified timestamps over standard RFC 3161, built for high enterprise volumes. Access is RFC 3161 over HTTP rather than a REST API, at enterprise-tier pricing. Best for high-volume qualified timestamping. See skidsolutions.eu.
• Utimaco Timestamp-as-a-Service (Germany). Qualified timestamps from an established HSM and PKI vendor, over an RFC 3161 interface, with a 30-day trial rather than an ongoing free tier. Best for teams already living in the HSM and PKI world. See utimaco.com.

Global CAs with EU-qualified entities

If you already use a large certificate authority, two of them run EU-qualified timestamping, with one caveat: the qualified entity is European, but the parent company is not.

• GlobalSign. Its EU qualified timestamping runs through the Belgian entity GMO GlobalSign NV/SA, a recognised QTSP. The parent, GMO Internet Group, is Japan-based, so it is not an EU-owned provider despite the Belgian QTSP. Best for organisations already standardised on GlobalSign certificates. See globalsign.com.
• DigiCert. Runs a widely used free code-signing RFC 3161 TSA (timestamp.digicert.com) that is not eIDAS qualified, plus a separate paid qualified eIDAS timestamp through its DigiCert Europe and QuoVadis entities on the EU Trusted List. The parent, DigiCert Inc., is US-based. Best for teams already using DigiCert for certificates. See digicert.com.

Free and developer options

For testing, prototypes, or non-critical integrity checks, you do not need a qualified provider.

• FreeTSA. A free, community-run RFC 3161 TSA that works with OpenSSL and curl. Its practice statement names no legal entity and offers no warranty, uptime guarantee, or qualified status, so treat it as a technical proof, not legal evidence. See freetsa.org.
• DigiCert’s free code-signing TSA and Certum’s time.certum.pl are also free, and also basic.

The caveat is the same for all three: a basic timestamp answers “did this file change?” but carries no eIDAS legal presumption. Do not lean on it where you may need to prove integrity in court or to a tax authority.

Different models: blockchain anchoring and aggregators

Not everything in this space is an RFC 3161 QTSP.

• OriginStamp (Switzerland). Instead of issuing RFC 3161 tokens, it anchors document hashes to public blockchains such as Bitcoin and Ethereum as proof of existence, over a REST API. It is Swiss-based, outside the EU and EEA, and makes no eIDAS qualified claim. Best for developers who want simple blockchain anchoring rather than a qualified trust service. See originstamp.com.
• eID Easy (Estonia). Not a TSA itself. It is a single API that routes timestamp requests to multiple third-party QTSPs, with automatic failover if one is down. Best for developers who want one integration to reach many qualified providers. See eideasy.com.

Where SealDoc fits

SealDoc is not a raw TSA, and it is honest about that. It applies RFC 3161 timestamping through a trusted, EU-based Time Stamping Authority (a qualified TSA is configurable on the Enterprise plan), and wraps it in what a timestamp token alone does not give you: a tamper-evident SHA-384 hash chain, a court-ready Legal Evidence Pack, and EU e-invoicing (Factur-X, ZUGFeRD, XRechnung, and Peppol). Everything runs in the EU, with no US hyperscaler dependency.

The difference is the unit you get back. The providers above hand you a timestamp token. SealDoc hands you the complete evidence artifact: the document, the timestamp, the hash chain, and the audit trail, bundled and independently verifiable. And it never claims more than it can prove: each guarantee in the pack is asserted only when its backing proof is actually present.

Pick SealDoc when you need the whole evidence artifact and EU compliance in one, not just a timestamp. If you need a bare qualified timestamp token and nothing else, one of the QTSPs above is the more direct fit. See what the legal proof layer adds.

How to choose, in one screen

• Need a legally qualified timestamp token and nothing more: an EU QTSP (Evidency, D-Trust, Certum, SK ID Solutions, Utimaco).
• Already standardised on a global CA: GlobalSign or DigiCert’s qualified service, keeping the non-EU-parent caveat in mind.
• Just testing or non-critical: FreeTSA or Certum’s free TSA, which are basic and not qualified.
• Want a complete, court-ready evidence artifact plus EU e-invoicing, kept EU-sovereign: SealDoc.

Whatever you pick, verify two things before you commit. First, that the timestamp is genuinely qualified if your use case needs it, by checking the EU Trusted List rather than marketing copy. Second, that you can still verify the timestamp years from now, independently of the provider. That second point is the whole reason RFC 3161 tokens are self-contained: the evidence you file today has to hold up in 2035, whether or not the provider is still around.