Preserve disclosures, policies, prices — exactly as they appeared on a given date.
An auditor asks what your website said last March — and the CMS only shows today’s version. GetProofAnchor turns each published version into a sealed Evidence ZIP and a public proof link with a qualified eIDAS timestamp — anyone can check the result: Match / Modified.
NEWNo time? We capture it for you — from €49 + VAT→
Audit-ready bundles
Standardized Evidence ZIP per published version — file it in the audit folder, retrieve it years later, verify offline.
Cryptographic integrity
Subsequent edits, file replacements, even whitespace reformatting — all detectable via the SHA-256 manifest.
Versioned timeline
Capture again whenever something changes. Each version gets its own public proof link and qualified eIDAS timestamp.
What this is: a record-keeping and integrity-verification workflow for compliance and audit — point-in-time capture, four-layer cryptographic integrity, EU-qualified timestamp, Bitcoin anchor, audit-ready Evidence ZIP verifiable offline by internal or external auditors.
What this is not: a compliance certification, a regulatory filing tool, or legal advice. Regulatory sufficiency in your specific case (GDPR, DSA, MAR, MiCA, ESG, sector frameworks) is a determination for your compliance counsel and your regulator.
Three steps, a few minutes
Compliance & audit workflow
Built for the “show me the published version on date X” audit request — and for proving you can answer that question every time, year after year.
Capture
Public URL via the dashboard, or behind-login content (internal control attestations, vendor portals, regulator dashboards) via the browser extension — exactly as published, captured at the moment of publication.
Seal and export the Evidence ZIP
Standardized, self-contained, offline-verifiable bundle: full-page screenshot + captured DOM + extracted text + SHA-256 manifest + hash chain entries + Bitcoin OpenTimestamps receipt + eIDAS qualified-timestamp kit + bilingual verification README. Drop into the audit folder for the relevant control.
Share and verify
When an auditor or regulator asks for the version on a given date, hand over the ZIP. Verification is reproducible: Match (intact) or Modified, with a per-layer report.
Works for: regulatory disclosures, T&Cs, privacy policies, cookie consent banners, pricing pages, marketing claims, product specs, ESG statements, MAR-relevant releases, MiCA whitepapers, internal-control attestations, vendor portals.
What compliance teams capture with GetProofAnchor
Built around the disclosures, policies, and statements where “the version published at the time” is the entire question.
Public disclosures & regulatory notices
MAR ad-hoc disclosures, MiCA whitepapers, prospectus updates, regulatory filings, sanctions notices — preserved at the version the market actually saw.
T&Cs, privacy policies, consent banners
GDPR-relevant policy versions, cookie consent banners, terms-of-service revisions, DPA versions — captured at the version each customer accepted.
Pricing pages & promotional offers
Published prices, advertised discounts, promotional T&Cs, time-limited offers — preserved with date-stamped evidence for consumer-protection and tax-compliance reviews.
Marketing & product claims
Performance claims, certifications, sustainability/ESG statements, comparisons, “as advertised” evidence — captured as published, defensible against later challenges.
Internal-control attestations
SOX-style control attestations, internal policy versions, intranet disclosures, vendor-attestation portals — preserved exactly as the control was performed and documented.
DSA / DMA / consumer-protection records
DSA transparency reports, content-moderation policy versions, dark-pattern audit evidence, consumer-rights disclosures — captured at the URL and version reviewed.
Why this evidence holds up under audit
An internal screenshot binder works until the auditor asks how you know it hasn't been edited. GetProofAnchor wraps every captured version in four independent integrity layers, each with its own files in the Evidence ZIP, each independently verifiable by a third-party auditor. Defeating any single layer doesn't break the others.
Layer 1
SHA-256 file fingerprints
Every captured file in the Evidence ZIP is bound by its SHA-256 hash into the qualified timestamp. Editing a single byte — even reformatting whitespace — fails the integrity check during audit. The report and manifest are generated at download and are not sealed.
Layer 2
Append-only hash chain
Each capture is part of a global SHA-256 chain. Each entry contains the hash of the previous one, so inserting or modifying a past version-snapshot breaks the chain mathematically — the audit-trail timeline is itself protected.
Layer 3
Bitcoin anchor (OpenTimestamps)
Each proof's timestamped content is bound into a Merkle tree whose root is anchored to Bitcoin via OpenTimestamps. The ZIP includes the inclusion proof, so anyone can check offline that the anchor covers exactly this proof — independent of GetProofAnchor and of any single jurisdiction.
Layer 4
Qualified eIDAS timestamp
RFC 3161 timestamp from an EU qualified trust service provider. Under eIDAS Art. 41(2) it carries a legal presumption of the accuracy of its time and the integrity of the sealed data.
All four layers pass → the audit trail is cryptographically intact, not just well-organized. Any layer FAILS → modification is detected, with a per-layer report showing exactly which one was tampered with — turning a vague tampering concern into a deterministic technical question for the auditor.
Why a screenshot binder fails the integrity test
Screenshot binders, PDF print-outs, and internal archives all share the same weakness: the audit team has to take your word that the contents weren't edited after the fact. Modern audit and regulatory frameworks are increasingly explicit about evidence integrity — accountability principle, audit-trail tamper-evidence, contemporaneous record requirements. Cryptographic integrity replaces credibility with verifiability, and converts an audit interview from “convince us” to “verify it yourself”.
Cryptographic integrity verification
Evidence ZIP includes a SHA-256 manifest of every file. Subsequent edits — text, screenshot pixels, file replacement, even JSON whitespace reformatting — become mathematically detectable. The audit trail does not depend on testimony or organizational trust.
Independent time anchors
Each version-snapshot gets two independent time anchors: an eIDAS qualified timestamp (with legal weight in the EU) and a Bitcoin OpenTimestamps anchor (preserved by the Bitcoin network). Backdating accusations stop being a credibility argument and become a cryptographic fact-check.
What's inside the Evidence ZIP
A standardized, self-contained bundle of around 24 files (format: getproofanchor-evidence-1). Designed to be filed in the audit folder, attached to regulatory submissions, handed to internal or external auditors — and to verify independently of GetProofAnchor.
manifest.jsonthe integrity baseline — SHA-256 hash of every other file in the packageproof.jsonmain record — source URL, final URL, capture time, SHA-256 fingerprints, eIDAS status, Bitcoin anchor infoscreenshot.pngfull-page screenshot at capture time (the published state of the page on date X)page.html + content.txtcaptured DOM/HTML and extracted plain-text content — the underlying source for behind-the-pixels analysiscapture/capture_meta.jsonforensic capture metadata — engine, viewport, scroll, consent dialogs auto-handled — the audit-trail backbonechain/*append-only hash chain entries linking this version-snapshot to the global chain of all capturesanchor/anchor_receipt.otsbinary OpenTimestamps receipt with the Bitcoin merkle path — verifiable against any Bitcoin nodetimestamp/*complete eIDAS qualified-timestamp kit — RFC 3161 token, TSA certificate chain, frozen EU Trusted List snapshot, verification reportreport.pdfhuman-readable Evidence Report PDF — formatted summary suitable for the audit folder or regulatory submissionREADME.mdbilingual (EN + CS) verification guide with copy-paste commands using python3, openssl, ots — auditors reproduce the verification independently
Verification result: Match / Modified.
For a file-by-file walkthrough see the Evidence ZIP — every file inside tutorial.
eIDAS qualified timestamp — the default audit-trail anchor
Every GetProofAnchor proof gets an RFC 3161 timestamp from a qualified trust service provider on the EU trusted list. It is not a marketing label — it has a specific legal meaning under Regulation (EU) 910/2014 (eIDAS): it carries a legal presumption that its time is accurate and the sealed data are intact, recognised in all EU member states.
Qualified provider
The timestamp comes from a qualified trust service provider listed on the EU trusted list.
Legal presumption
Under eIDAS Art. 41(2) the date, time and integrity of the timestamped data are presumed correct unless proven otherwise. You don’t have to rely on GetProofAnchor’s word.
Verifiable offline
The certificate chain and a copy of the trusted list are inside the ZIP, so the timestamp can be checked without internet and without us — also after the timestamp certificate has expired.
Together with the Bitcoin anchor you get two independent time anchors — one with legal weight in the EU, one public and global — for the same evidence.
Common questions from compliance & audit teams
Straight answers to the questions we hear most.
How does this map to “what was published on date X” audit requests?
That is exactly the question the workflow answers. Capture each version of a disclosure, policy, price page, T&C, marketing claim, or consent banner at the moment of publication. Each Evidence ZIP records the URL, the visible state, the underlying DOM/HTML, capture metadata, and an eIDAS qualified timestamp recognized in EU/EEA under Regulation (EU) 910/2014. When an auditor or regulator asks “what did your site say on March 14?”, you produce the ZIP, the auditor verifies it offline, and the answer is mathematical rather than testimonial.
Is this admissible in regulatory proceedings or court?
Admissibility depends on the jurisdiction, regulator, and procedure — that is decided by the court or regulator. GetProofAnchor's role is to provide a tamper-evident, time-anchored record. The eIDAS qualified timestamp from an EU-qualified Trust Service Provider carries a legal presumption of the accuracy of its date and time and of the integrity of the timestamped data under Regulation (EU) 910/2014 (Art. 41(2)), and is recognised in all EU member states. The Bitcoin OpenTimestamps anchor adds a second, independent, decentralized time anchor. Together they give a strong, verifiable record — but the formal admissibility decision is not ours to make.
Can it capture pages behind authentication (internal control attestations, vendor portals, regulator dashboards)?
Yes. Available on every paid plan, including the 9 € Starter Pack, the Chrome extension captures exactly what your real browser is showing — including pages behind login, 2FA, or paid subscription. This covers internal-control attestations, vendor-portal records, regulator submission dashboards, internal policy intranets, and any audit evidence that lives behind authentication. Public URLs (consumer-facing disclosures, T&Cs, marketing pages) can also be captured server-side via the dashboard.
Does this satisfy specific regulations like GDPR, DSA, MiCA, MAR, or ESG reporting requirements?
GetProofAnchor is a record-keeping and integrity-verification tool, not a compliance certification. It produces evidence packages that meet the technical requirements regulators typically expect — point-in-time capture, tamper-evident integrity, qualified timestamping, full chain of custody — but the determination of regulatory sufficiency in your specific case (GDPR Article 5(2) accountability, DSA transparency reports, MAR market disclosures, MiCA whitepaper versioning, ESG / CSRD reporting evidence) belongs to your compliance counsel and your regulator. The cryptographic foundation is solid; the regulatory mapping is yours to complete.
How do I capture multiple versions of the same page over time?
Capture again whenever something changes — a price update, a policy revision, a new consent banner, an updated disclosure. Each capture is a separate proof with its own public link, four-layer trust stack and its own eIDAS qualified timestamp, all linked to the global append-only hash chain. The result is a verifiable timeline of every version of the published page, each independently provable as having existed at the timestamped moment. This is exactly what auditors look for when reviewing changelog evidence.
Will the audit evidence still verify after the retention period (5, 7, 10+ years)?
The package is designed for long-term offline verification. The TSA certificate chain and a snapshot of the trusted list that lists the TSA are bundled inside the Evidence ZIP at capture time, so the qualified timestamp can be checked without an internet connection and without us — also after the TSA's certificate has expired. The Bitcoin anchor is an additional, independent layer. The hash manifest is verifiable with standard SHA-256 tooling. Keep the original ZIP: it is the evidence.
Further reading
Deeper reading for compliance officers, auditors, and the regulatory teams reviewing your evidence:
How it works
How GetProofAnchor works — capture, sealing, Evidence ZIP, verification
Open →Getting started
How to create a proof — from a URL or with the browser extension
Open →Reference
Evidence ZIP — every file inside, verifiable offline
Open →Verification
How to verify evidence — proof link or ZIP, online and offline
Open →Assisted Capture
Don't want to do it yourself?
Send us the URL and our team creates the forensic capture for you — full Evidence ZIP with eIDAS qualified timestamp, delivered to your inbox. From €49 per capture.
Keep proof of every published version
Audit-ready, point-in-time web evidence with cryptographic integrity, EU-qualified timestamp, and a Bitcoin anchor. Verifiable offline, by any auditor, throughout your retention period.