1
You create the channel, once
One per type of process: name, mode and in whose name the certifications will be issued. The configuration is sealed before the events; if it changes, a new version is created and the previous one is kept.
Tamper-evident event log with qualified timestamps
Records that don't depend on your word
Safe Creative Platform is Safe Creative's event logging service. Your systems declare each event via API as it happens; Safe Creative numbers it, chains it, covers it with a qualified timestamp and holds it in custody as an independent third party. When you need to prove it, to an auditor, a customer, an insurer or a court, you request a certification for the period.
With your Safe Creative account · free testing · prepaid, no fees or commitment
See a sample certification Would you rather talk first? Talk to our team
Event loggedCovered by a qualified timestamp
- Channel
- Production deployments
- Sequence
- #18,204 · no gaps
- Received
- 2026-09-14T09:41:07.318204Z
- Chained hash
- c41e7b…9a07d2
- Batch timestamp
- 09:45:00Z · qualified provider
eIDAS qualified timestampGap-free sequenceHash only
Illustrative example.
Since 2007Safe Creative, trusted third party
800+organizations already rely on our evidence
eIDASTimestamp from a qualified trust service provider
EN · ESSigned report in two languages, verifiable by anyone
Your records hold up until someone disputes them
Many processes generate facts nobody looks at while everything goes well. The problem comes months or years later, when you have to prove that they happened and when.
- A deployment, a fixed vulnerability or a configuration change that today only appears in your logs.
- The inspection of a lift or a fire protection system, on a report nobody will be able to date with certainty.
- The acknowledgement of an internal report or a reply within the deadline, which the law requires you to be able to prove.
- What an AI agent did, and when.
What your systems can't give themselves
Records kept by the party presenting them can be altered without a trace, and the other side knows it. Safe Creative Platform adds what is missing: a declaration made at the time of the event, before any dispute, and held in custody by a third party independent of both sides.
Your internal log still exists. Now a third party backs it too.
How it works
Three moments, each at its own pace
Logging and certifying are separate moments: the evidence builds up quietly, like an insurance policy, and you certify it when you need it.
2
Your systems declare, continuously
One call per event, with an immediate acknowledgement. Each event gets its sequence number, is chained to the previous one and is covered within minutes by the qualified timestamp of its batch. Retries never create duplicates.
3
You request the certification, when needed
Choose the channel and period and receive the report signed by Safe Creative, in English and Spanish, with the evidence archive. Whoever receives it can check it on the public verification page, without being anyone's customer.
Use cases
Where an internal log is not enough
The pattern repeats itself: facts your systems generate, legal consequences if you can't prove them, and rules that require demonstrable integrity and dates without saying how.
Vulnerabilities and incidents
If you manufacture products with digital elements, from 11 September 2026 the Cyber Resilience Act requires you to report actively exploited vulnerabilities and severe incidents within hours and days. Declare the hash of each outcome from your continuous integration pipeline: the details never leave your perimeter.
- #311Finding03-Oct 08:12:44Zsealed
- #312Validation03-Oct 10:37:02Zsealed
- #313Initial notification03-Oct 16:05:51Zsealed
- #314Patch released05-Oct 11:48:19Zsealed
- #315Verification05-Oct 12:02:33Zin batch
What is proven: when you found out and what you did, dated by a third party that neither you nor your security provider controls.
AI agents
Every action of the agent, declared the moment it happens. The AI Act will require high-risk systems to allow the automatic logging of their events (from December 2027 for those in Annex III).
What is proven: what the agent did and when.
Whistleblowing channel
Acknowledgement within seven days and a reply within three months at most. You declare only the hash of each milestone: the content, confidential by law, never leaves your company.
What is proven: that each milestone existed and on what date.
Periodic inspections
Lifts, fire protection, facilities. Every closed report, declared to the channel. After an incident you don't produce a loose piece of paper: you produce the complete sequence.
What is proven: diligence sustained over time.
Changes to critical systems
Every deployment and every relevant configuration change is a declared event.
What is proven: that the change log could not be rewritten.
Trade secrets
Access granted and revoked, classified documents, staff departures: the measures you take to protect your secret, evidenced day by day.
See Business secretsWhat is proven: the reasonable measures the law requires.
No small print
We certify declarations. And that is the strength
Safe Creative attests that your declaration was received, at what exact moment and that nobody has altered it since; not that the declared fact is true. The same logic as a registered letter: it proves what was said and when. It promises exactly what it can stand behind.
- Dated, intact receipt of every declaration.
- A sequence with no gaps or duplicates.
- Configuration sealed before the events.
- A report that always keeps the two voices apart.
What Safe Creative states
Every declaration in the period was received on the date and time recorded, its content has not changed since and the sequence is complete, with no insertions or deletions.
What you declare
What the data means and in whose name it is declared. The report expressly presents this as your statement.
Two modes
The content, or just its hash: you choose
Content
- What you send
- The data itself: a JSON record generated by your process, or a file.
- What is proven
- The certification is self-contained: Safe Creative holds and seals the data.
- When it fits
- When being able to show what was declared is part of the value.
Hash only
- What you send
- Only the cryptographic hash. The content never leaves your systems.
- What is proven
- The existence, date and integrity of something you hold.
- When it fits
- When confidentiality or personal data is involved.
The mode is chosen per channel, depending on what you need to prove.
For your technical team
One call per event. One afternoon to try it
No installations or changes to your architecture: your systems declare via API and keep working as they do now.
- Public documentation, with integration recipes for each use case.
- Free test mode with the same contract as production.
- Retries without duplicates and signed notifications (webhooks).
- Already have your own audit log? Declare the hash of each acknowledgement and turn it into third-party evidence.
Not the one integrating it? Send it to your technical team
POST /v1/events
# Your system declares an event as it happens (hash-only mode) curl -X POST https://platform.safecreative.org/v1/events \ -H "Authorization: Bearer sc_live_••••" \ -d '{"client_ref":"deploy-48211", "hash":"6b1f0c6e…94a7d", "hash_alg":"sha-256"}'
# Immediate acknowledgement: your receipt { "sequence": 18204, "received_at": "2026-09-14T09:41:07.318204Z", "chain_hash": "c41e7b…9a07d2", "timestamp": { "type": "pending" } }
Evidential value
Why it holds up as evidence
The timestamp is issued by a qualified provider under the eIDAS Regulation, the configuration is committed before the events and the report is signed by Safe Creative, a third party unrelated to either side.
And something we'd rather tell you ourselves: no rule requires you to hire a trusted third party. What the rules require is demonstrable integrity and dates, without saying how. This is a solid way to demonstrate them, with a legal presumption in the EU. Outside the EU there is no legal presumption for the qualified timestamp: the evidence rests on its verifiable integrity and on custody by an independent third party.
eIDAS · Art. 41.2
Legal presumption of the qualified timestamp
It is presumed accurate as to its date and time, and guarantees that what was sealed has not changed. Whoever denies it has to prove it.
Art. 326.4 Spanish Civil Procedure Act
In Spain, reinforced in court
When a qualified trust service is used, procedural law reinforces that presumption.
Independent third party
Held by someone unrelated to either side
Safe Creative holds and chains your declarations; neither you nor the other side can rewrite them.
Open standards
Verifiable without depending on anyone
The evidence archive is checked with cryptographic hashes and RFC 3161 timestamps, without accessing any system.
Alternatives
Your logs, a blockchain or a trusted third party
Three ways to keep what your systems do. Only one gives you a date with a legal presumption and someone independent who answers for it.
| Criterion | Your own logs | Public blockchain | Safe Creative Platform |
|---|---|---|---|
| Who holds the evidence | Your own organization | A public network, with no identifiable party responsible | Safe Creative, independent third party since 2007 |
| Where the date comes from | Your server's clock | The block: approximate and with no legal presumption | An eIDAS qualified timestamp, with a legal presumption in the EU |
| Nothing missing | Hard to prove | Only covers what you anchored | Gap-free numbered sequence per channel |
| Confidentiality | Full | The hash is published permanently | Hash only or content, chosen per channel |
| What you hand to a third party | Your own exports and screenshots | A technical trail that needs explaining | Signed report in English and Spanish, verifiable on a public page |
| What you need to use it | Nothing new | Anchoring tools or nodes; variable network costs | One API call per event |
What about Safe Stamper? It certifies specific facts, one at a time: a web page, an email, a file. Safe Creative Platform continuously logs what your systems generate, in sequence.
Pricing
Pay per event, not per subscription
1 credit = 1 eventPrepaid packs with volume discounts
- No plans, no fees and no commitment.
- Free test mode: test keys don't use credits.
- Certifications on demand, whenever you need them.
- Automatic top-up and balance alerts so the sequence never stops.
Platform is contracted separately, under its own terms of use. It is not included in Safe Creative's Business or Enterprise plans. Prices exclude taxes.
FAQ
What people usually ask us
What is Safe Creative Platform?
Safe Creative's event logging service with qualified timestamps. Your systems declare each event via API as it happens; each event is numbered in its channel, chained to the previous one and covered by the qualified timestamp of its batch. When you need it, you request a certification for a period: a signed report and an evidence archive that anyone can verify.
How is it different from Safe Stamper?
Safe Stamper certifies specific facts, one at a time: a web page, an email, a notification or a file. Safe Creative Platform continuously logs what your systems generate and also proves that the sequence is complete. They are different products and are contracted separately.
What exactly does Safe Creative certify?
That your declaration was received, at what exact moment and that nobody has altered it since; not that the declared fact is true. The report separates what Safe Creative states (dated, intact receipt and an unbroken sequence) from what you declare (what the data means and in whose name it is declared).
Does my data leave my company?
Only if you choose content mode. In hash-only mode you send just the cryptographic hash and the data never leaves your systems; if one day you need to produce the original, its sealed hash ties it to its date.
Do I need a Safe Creative plan?
No. A Safe Creative account is enough, including the free one. Platform is contracted and invoiced separately, and is not included in the Business or Enterprise plans. If you already have an Enterprise agreement, we can add it there.
How much effort is the integration?
One API call per event. With the documentation, the use-case recipes and the free test keys, a basic integration can be validated in an afternoon, without talking to anyone.
What if I already have my own audit log?
Keep it and declare the hash of each acknowledgement or checkpoint to the channel. What your chain can't give itself is what Platform adds: custody by an independent third party and a timestamp issued by an eIDAS qualified provider.
What happens if I run out of credit?
Your events are still received, sealed and chained as unpaid, up to a limit, and are settled when you buy credits. The sequence doesn't break because of an administrative oversight; while there are unpaid events, however, certifications cannot be requested.
Does it work outside the European Union?
Yes, with a different value. The legal presumption of the qualified timestamp is European. Outside the EU, the certification is worth what anyone can check: an intact sequence of declarations made when the events happened, held by an independent third party and verifiable with open standards. Its admissibility depends on the rules of each country.
How long is the evidence kept?
For the retention period set out in the Platform terms of use, including after you close your account. Issued certifications can be verified on the public page throughout that period.
Evidence counts if it exists before the dispute
Create your account, declare your first test event this afternoon and, when you're ready, move to production.
Safe Creative, S.L., trusted third party since 2007. Safe Creative Platform certifies the dated, intact receipt of declarations and the integrity of their sequence, not the truthfulness of what is declared. Each event is covered by the qualified timestamp of its batch, issued by a qualified trust service provider under Regulation (EU) No 910/2014 (eIDAS). The weight of the evidence is for the body or person it is presented to. Regulatory references are for guidance only: Platform helps demonstrate diligence, integrity and dates, and does not by itself guarantee compliance with any rule. Platform is contracted separately, under its own terms of use. This page is for information purposes only and does not constitute legal advice.