EU legal framework
Web evidence under eIDAS: from screenshot to legal presumption
Regulation (EU) 910/2014 gives data sealed with a qualified electronic timestamp a legal presumption of integrity — recognized in every member state. This page explains how that framework applies to capturing web content as evidence, and how GetProofAnchor implements it end to end.
Qualified timestamps issued by an EU-accredited QTSP (SK ID Solutions, Estonia) · ISO/IEC 27037-aligned methodology · Independently verifiable with the open-source gpa-verify CLI
What the regulation actually says
Three provisions of eIDAS carry the weight for web evidence. They are short, precise, and directly applicable law in all 27 member states — no national implementation needed.
Article 41(2)
Presumption of integrity
A qualified electronic timestamp enjoys a legal presumption of the accuracy of the date and time it indicates, and of the integrity of the data it is bound to. In practice: the burden of proof shifts to whoever disputes the evidence.
Article 41(3)
Recognition across the EU
A qualified timestamp issued in one member state is recognized as a qualified timestamp in all member states. Evidence sealed in Estonia carries the same presumption in a Czech, German or Spanish courtroom.
Article 42
What makes a timestamp qualified
The timestamp must bind date and time to the data so that any subsequent change is detectable, be based on an accurate time source, and be issued by a qualified trust service provider under state supervision, listed on the EU Trusted List.
How this applies to a web capture
The page is captured
Full-page screenshot, complete HTML, network traffic (HAR) and metadata are collected with a documented, repeatable methodology aligned with ISO/IEC 27037 principles for digital evidence acquisition.
Everything is hashed
Every asset receives a SHA-256 hash, recorded in a manifest and linked into an append-only hash chain. From this moment, changing a single byte anywhere is mathematically detectable.
A qualified timestamp seals it
The hash structure is sent to an EU-accredited qualified trust service provider, which issues an RFC 3161 qualified timestamp meeting Article 42 — activating the Article 41(2) presumption for the entire capture.
Anyone can verify it
The resulting Evidence ZIP is verified offline with the open-source gpa-verify tool using open standards only — no account with us, no trust in us. A Bitcoin anchor additionally makes the proof verifiable even if we cease to exist.
For the full technical and legal treatment of qualified timestamps, see our complete guide to eIDAS qualified timestamps.
Compared with traditional approaches
Plain screenshots
No hash, no trusted timestamp, no source data. Fabricating a pixel-perfect fake takes minutes in any browser's developer tools, and courts across Europe increasingly treat unsealed screenshots with corresponding skepticism.
Notarial records
A recognized traditional route — but slow, expensive, and limited to what the notary saw on screen at that moment. No source data, no network traffic, no cryptographic verifiability, and scheduling a notary rarely matches the speed at which web content disappears.
Public web archives
Useful when nothing else exists, but crawls are irregular, coverage is patchy, snapshots carry no qualified timestamp, and their authenticity has been successfully challenged in litigation. An archive is a library, not an evidence system.
Built for institutional requirements
GetProofAnchor is designed for legal, compliance and public-sector use across the EU — which shapes requirements beyond the timestamp itself:
- ✓Documented, repeatable acquisition methodology aligned with ISO/IEC 27037 — the answer to "how was this evidence obtained?" is a process description, not an improvisation.
- ✓Vendor-independent verification: the open-source gpa-verify CLI validates every proof offline. Opposing experts, courts and auditors never need to trust or contact us.
- ✓Complete chain of custody in every Evidence ZIP: SHA-256 manifest, append-only hash chain, the qualified timestamp token itself (RFC 3161), and a Bitcoin anchor for long-term survivability.
- ✓EU data processing, transparent security documentation, and custom plans for authorities including scheduled monitoring with institutional monitor limits.
Frequently asked questions
Is a web capture with a qualified timestamp admissible in EU courts?
Admissibility is always decided by the court, but the legal starting position is defined by eIDAS: Article 41(1) prohibits denying legal effect to an electronic timestamp solely for being electronic, and a qualified timestamp adds the Article 41(2) presumption of date accuracy and data integrity. The practical effect is that the burden shifts to the party disputing the capture.
What is the difference between a qualified and an ordinary timestamp?
Any server can issue an ordinary timestamp — its trustworthiness is whatever the issuer's reputation is worth. A qualified timestamp must meet Article 42: verifiable binding to the data, an accurate time source, and issuance by a state-supervised qualified trust service provider on the EU Trusted List. Only the qualified variant carries the legal presumption.
Does the presumption apply in every EU member state?
Yes. eIDAS is a regulation, directly applicable in all 27 member states without national transposition, and Article 41(3) explicitly requires each member state to recognize qualified timestamps issued in any other. A capture sealed by an Estonian QTSP carries the same presumption in Prague, Berlin or Madrid.
Do I still need a notary to certify a web page?
In most situations, no. A notarial record remains a valid traditional route, but the qualified electronic timestamp was created precisely to provide equivalent — and in integrity terms stronger — assurance electronically: it is available in seconds, preserves the underlying source data, and its presumption is codified in directly applicable EU law.
How can the opposing party or the court verify the evidence?
With the open-source gpa-verify command-line tool: it runs fully offline, recomputes all SHA-256 hashes, validates the RFC 3161 qualified timestamp against the QTSP certificate, and checks the Bitcoin anchor — using open standards only. No account, no API, no trust in GetProofAnchor is required, which removes an entire category of objections.
What happens to my evidence if GetProofAnchor ceases to exist?
It remains verifiable. The Evidence ZIP is self-contained, the verification tool is open source, the qualified timestamp validates against the QTSP's certificate chain independently of us, and the Bitcoin anchor proves existence-in-time forever. Evidence for disputes that can run for years must not depend on any vendor's survival — including ours.
This page is general information about the EU legal framework, not legal advice. The assessment of evidence in a specific proceeding always rests with the competent court.
Assisted Capture
Don't want to do it yourself?
Send us the URL and our team creates the forensic capture for you — full Evidence ZIP with eIDAS qualified timestamp, delivered to your inbox. From €49 per capture.