timevolt
Opening soon. Receipts and payments aren't open yet.
Timevolt / Quarterly user access review: the reviewer list, decisions and removals frozen as submitted
IT governance

Preserve the existing access-review export, decisions and separate removal evidence as one dated version.

Preserve the existing access-review export, decisions and separate removal evidence as one dated version. Keep your original source records together, then date the exact files. It does not prove a reviewer acted, every account was included, access was removed, or an audit/control requirement was met.

Try a file locally

Your photos and files stay on your device, so keep them.

EXAMPLE
Quarterly user access review: the reviewer list, decisions and removals frozen as submitted
1 Nov 2026
Authority time: 14:02 UTC · example
Bitcoin block time: 14:10 UTC · example
Last checked: 15:02 UTC · example
✓ Dated◆ Permanent
Now keep it safe: three things
  1. Keep your photos and files unedited. The receipt only matches the originals. Put them in an album such as “My records”.
  2. Save this receipt to your camera roll.

    Keep the receipt file too. The image is a handy copy; checking needs the file.

  3. Email it to yourself.Email it to myself

    Your mail app opens a draft. Attach your receipt image and receipt file. Don’t attach your photos or documents. Timevolt does not send it or know whether it was sent.

Your record, one step at a time.

Your photos and files stay on your device, so keep them.

Local preview: files are fingerprinted here. Notes and progress stay in this browser. Keep downloaded copies; browser storage is not a backup.

0 items
How?

Add the exact original files for this part of the record. Keep them unchanged; a different export or edit has a different fingerprint.

Add link and screenshots

The link is recorded, not fetched or verified.

    0 items
    How?

    Record the date, time, place and who you spoke to. New notes are saved separately rather than editing an old note.

    How to keep notes that hold up
    Write it down

    By making a receipt you agree to the Terms and Privacy Policy. The Bitcoin record is permanent.

      By making a receipt you agree to the Terms and Privacy Policy. The Bitcoin record is permanent.

      How to keep notes that hold up

      Write notes as soon as you can. Keep the original account rather than replacing it later; the venue decides what weight it gets.

      1. Write it down straight away, on paper or in the box on a step.
      2. Put the date, time and place at the top, and who you spoke to.
      3. Use their words where you can; separate what you saw from what you were told.
      4. Sign or initial a paper note, photograph it and add the photo.
      5. Never edit an old note. Add a new dated entry when something changes. A device save time is not independent time evidence or proof of event order.
      Quarterly user access review: the reviewer list, decisions and removals frozen as submitted
      Quarterly user access review: the reviewer list, decisions and removals frozen as submitted

      01 · Keep the exact files

      Keep the original files for quarterly user access review: the reviewer list, decisions and removals frozen as submitted. Include any existing photos, signed records and source-system exports.

      Records to keep: Fingerprint of the campaign export: entitlements listed, reviewer, keep/revoke decision, timestamp

      Quarterly user access review: the reviewer list, decisions and removals frozen as submitted

      02 · Date the file’s code

      Your device fingerprints the selected file or manifest. Dated follows an independent timestamp; Permanent follows Bitcoin anchoring.

      An independent time, tied to the exact bytes.

      Quarterly user access review: the reviewer list, decisions and removals frozen as submitted

      03 · Keep the evidence

      Keep the original files and complete receipt separately, alongside any existing venue, signature and workflow records.

      Keep the originals too. A changed or compressed copy has a different fingerprint.

      Try a file. It stays here.

      Make a test receipt on this device.

      By making a receipt you agree to the Terms and Privacy Policy. The Bitcoin record is permanent.

      or drop a file here

      Real cases: why the saved copy matters.

      Real cases where dated records mattered. We don’t claim a time receipt would have changed the result.

      North Carolina US · 2023

      Compare leaver lists with accounts that still work

      A firm settled security claims after a data breach but did not admit fault. The deal required checks between leaver lists and active accounts at least each quarter, within its stated scope. It set those checks to start 180 days after the deal took effect.

      Summarized on Oct 29, 2026

      Read the source ›

      Related cases

      New York US · 2023

      Access reviews must fit the network

      Related: manual access review and shared passwords

      A watchdog found a lender's manual access reviews too weak for its large network, along with shared password problems. The lender agreed to a fine and a plan to improve access checks. The case did not ban all manual reviews.

      Summarized on Oct 29, 2026

      Read the source ›
      New York US · 2023

      Act on access problems found in shared links

      Related: shared document links and security follow up

      A watchdog found weak controls over a firm's shared documents. It also found poor follow up on a known flaw. The firm agreed to a fine and fixes.

      Summarized on Oct 29, 2026

      Read the source ›

      What courts, schemes and regulators say.

      Positions below refer to the cited rule or record type, not endorsement of Timevolt. This service is not represented as an eIDAS qualified timestamp provider. A non-qualified timestamp does not receive the qualified timestamp presumption.

      Needs something else · US NIST control catalog; selected organizational scope

      NIST SP 800-53, Rev. 5, AC-2

      Account management includes approvals, monitoring, removal and review at an organization-defined frequency.

      The base Rev. 5 PDF, AC-2(j), It does not universally require quarterly review or endorse an external receipt; applicable baseline and later catalog updates need checking.

      Source summary as of 2026-10-29. Check the current source and applicable local rules.

      Read the source
      Needs something else · North Carolina US; settlement-bound company only

      Signed Blackbaud agreement para58f

      Compare termination lists with user accounts at least quarterly under the agreement's scope and start conditions.

      Actual review and implemented removal controls remain necessary; not a general obligation for other organizations.

      Source summary as of 2026-10-29. Check the current source and applicable local rules.

      Read the source

      Other ways to do this

      Prices change. Check each provider’s site for current prices and service details.

      • SailPoint

        Provides Identity-governance workflow.

        Visit site

      • C1 formerly ConductorOne

        Provides access requests, lifecycle and reviews.

        Visit site

      • Veza

        Provides permissions visibility and automated access reviews.

        Visit site

      Related workflows.

      Approval of a production change recorded before the deployment, with the approved package fingerprintAccess or license request, manager approval and grantQuarterly user access review: the list shown to the reviewer, each keep/remove decision and proof removals happenedHuman-in-the-loop approval before an AI agent executes a high-impact action (refund, payment instruction, production change, customer message)Who was physically present at a members' or condo board meetingHuman-made process record

      Proves / Doesn’t prove

      Proves

      A completed time receipt shows that the exact selected file existed by the independently witnessed time. You can check whether a later copy has the same bytes. It does not establish creation time, authorship, identity, event order, location or the truth of the contents.

      Doesn’t prove

      It does not prove a reviewer acted, every account was included, access was removed, or an audit/control requirement was met.

      It does not prove a reviewer acted, every account was included, access was removed, or an audit/control requirement was met.

      These are the bounds of a completed proof. The local tester does not establish any time. The chosen court, scheme or regulator decides what to accept.

      Questions, answered plainly.

      Your file stays on your device. During normal receipt creation, your device sends a randomized code made from its fingerprint, plus encrypted recovery data. It doesn't send the plain fingerprint or the random value that opens the code. Keep the original file and the complete receipt for checking. Privacy Policy.

      Must every access review be quarterly?

      No universal quarterly period follows from NISTAC2; it leaves frequency organization-defined.

      Source summary as of October 30, 2026. Check the current source and its scope.

      Context for this answer
      Does dating decisions prove access was removed?

      No. The settlement requires comparing accounts with termination lists; a file date cannot perform removal.

      Source summary as of October 30, 2026. Check the current source and its scope.

      Context for this answer
      Are manual access reviews always prohibited?

      No. OneMain's order describes weaknesses in its particular network and associated controls.

      Source summary as of October 30, 2026. Check the current source and its scope.

      Context for this answer
      Does a written policy establish working access controls?

      No. The title-insurer order distinguishes policies from their implementation.

      Source summary as of October 30, 2026. Check the current source and its scope.

      Context for this answer
      Should the reviewed population remain identifiable?

      Keep the existing account list and decisions together so review scope can be examined; NIST treats account management as a substantive process.

      Source summary as of October 30, 2026. Check the current source and its scope.

      Context for this answer

      The file tester runs on your device. It does not issue a timestamp or take a payment.

      Keep the records you already have.

      Keep your original files and any existing official records while the receipt service is being prepared.