timevolt
Opening soon. Receipts and payments aren't open yet.
Timevolt / Quarterly external scan results, remediation and attestation of compliance as dated receipts
external scan record checklist

Keep the original report behind the attestation.

External scan record checklist — Keep the original report behind the attestation. Keep the exact scan report and attestation with their issuer’s records.

Try a file locally

Your photos and files stay on your device, so keep them.

EXAMPLE
Quarterly external scan results, remediation and attestation of compliance as dated receipts
1 Nov 2026
Authority time: 14:02 UTC · example
Bitcoin block time: 14:10 UTC · example
Last checked: 15:02 UTC · example
✓ Dated◆ Permanent
Now keep it safe: three things
  1. Keep your photos and files unedited. The receipt only matches the originals. Put them in an album such as “My records”.
  2. Save this receipt to your camera roll.

    Keep the receipt file too. The image is a handy copy; checking needs the file.

  3. Email it to yourself.Email it to myself

    Your mail app opens a draft. Attach your receipt image and receipt file. Don’t attach your photos or documents. Timevolt does not send it or know whether it was sent.

Your record, one step at a time.

Your photos and files stay on your device, so keep them.

Local preview: files are fingerprinted here. Notes and progress stay in this browser. Keep downloaded copies; browser storage is not a backup.

0 items
How?

Add the exact original files for this part of the record. Keep them unchanged; a different export or edit has a different fingerprint.

Add link and screenshots

The link is recorded, not fetched or verified.

    0 items
    How?

    Record the date, time, place and who you spoke to. New notes are saved separately rather than editing an old note.

    How to keep notes that hold up
    Write it down

    By making a receipt you agree to the Terms and Privacy Policy. The Bitcoin record is permanent.

      By making a receipt you agree to the Terms and Privacy Policy. The Bitcoin record is permanent.

      How to keep notes that hold up

      Write notes as soon as you can. Keep the original account rather than replacing it later; the venue decides what weight it gets.

      1. Write it down straight away, on paper or in the box on a step.
      2. Put the date, time and place at the top, and who you spoke to.
      3. Use their words where you can; separate what you saw from what you were told.
      4. Sign or initial a paper note, photograph it and add the photo.
      5. Never edit an old note. Add a new dated entry when something changes. A device save time is not independent time evidence or proof of event order.
      Quarterly external scan results, remediation and attestation of compliance as dated receipts
      Quarterly external scan results, remediation and attestation of compliance as dated receipts

      01 · Keep the exact files

      Keep the exact scan report and attestation with their issuer’s records.

      Records to keep: Scan report, rescan report, attestation document

      Quarterly external scan results, remediation and attestation of compliance as dated receipts

      02 · Date the file’s code

      Your device fingerprints the selected file or manifest. Dated follows an independent timestamp; Permanent follows Bitcoin anchoring.

      An independent time, tied to the exact bytes.

      Quarterly external scan results, remediation and attestation of compliance as dated receipts

      03 · Keep the evidence

      Verify the issuer and assessment through the relevant PCI process separately. We are not an ASV or QSA.

      Keep the originals too. A changed or compressed copy has a different fingerprint.

      Try a file. It stays here.

      Make a test receipt on this device.

      By making a receipt you agree to the Terms and Privacy Policy. The Bitcoin record is permanent.

      or drop a file here

      Real cases: why the saved copy matters.

      Real cases where dated records mattered. We don’t claim a time receipt would have changed the result.

      US federal, M.D. Tenn. · 2014

      Keep the security checks from before a breach

      After a data breach, a card network charged the banks that handled a shop's card sales. The shop fought the charges, with scans and security signoffs among the rules discussed. The final outcome was not checked.

      The reviewed court document does not establish a final decision on the merchant’s claims.

      Summarized on Oct 29, 2026

      Read the source ›

      Related cases

      Texas, Court of Appeals · 2021

      A security promise can be tested after breaches

      Related: card-security promises after breaches

      A shop had two computer break-ins fourteen months apart. It and a card network fought over a contract payment and claims that its security promises were false. The court reopened both claims after early shop wins, with no final winner.

      Appeal decision; fraud was disputed, and the remand did not establish a final winner.

      Summarized on Oct 29, 2026

      Read the decision ›
      US federal, S.D. Tex. · 2011

      Early rulings do not prove security failures

      Related: payment processor security claims

      Banks sued a payment processor after a data breach, saying it broke card-security rules. The court let some claims continue and dismissed others. That early ruling did not prove the claimed failures.

      Summarized on Oct 29, 2026

      Read the decision ›

      What courts, schemes and regulators say.

      Positions below refer to the cited rule or record type, not endorsement of Timevolt. This service is not represented as an eIDAS qualified timestamp provider. A non-qualified timestamp does not receive the qualified timestamp presumption.

      Silent · Card brands and acquirers (Visa)

      Visa Core Rules as described in court opinions

      Acquirers must ensure merchants comply with PCI DSS; Visa has required validation and a quarterly network scan plus an attestation of compliance.

      Visa required QSA validation, a quarterly network vulnerability scan and a completed attestation of compliance (per the opinion). Whether a time receipt can supplement these is not addressed in the source.

      Source summary as of 2026-10-28. Check the current source and applicable local rules.

      Read the source

      Other ways to do this

      Prices change. Check each provider’s site for current prices and service details.

      • PCI SSC document library (official SAQ and AoC templates)

        Publishes official PCI self-assessment and attestation templates.

        Visit site

      • Secureframe

        Provides compliance automation platform with templates.

        Visit site

      • Approved scanning vendors (Qualys, Tenable, Rapid7 and others)

        Provides vulnerability scans and associated reports.

        Visit site

      • Acquirer or processor compliance portal

        Collects merchant scan and self-assessment submissions.

        Visit site

      Related workflows.

      Inventory and authorization of scripts running on payment pages on a given dateQuarterly user access review: the reviewer list, decisions and removals frozen as submittedAccess or license request, manager approval and grantQuarterly user access review: the list shown to the reviewer, each keep/remove decision and proof removals happenedHuman-in-the-loop approval before an AI agent executes a high-impact action (refund, payment instruction, production change, customer message)Who was physically present at a members' or condo board meeting

      Proves / Doesn’t prove

      Proves

      A completed time receipt shows that the exact selected file existed by the independently witnessed time. You can check whether a later copy has the same bytes. It does not establish creation time, authorship, identity, event order, location or the truth of the contents.

      Doesn’t prove

      It does not prove the scan was run by an approved vendor, that the result was a genuine pass, that the merchant was actually compliant, or that an acquirer or card brand will accept it.

      A receipt is not PCI certification and cannot establish an approved scanner, a genuine pass or acceptance.

      These are the bounds of a completed proof. The local tester does not establish any time. The chosen court, scheme or regulator decides what to accept.

      Questions, answered plainly.

      Your file stays on your device. During normal receipt creation, your device sends a randomized code made from its fingerprint, plus encrypted recovery data. It doesn't send the plain fingerprint or the random value that opens the code. Keep the original file and the complete receipt for checking. Privacy Policy.

      What is a PCI attestation of compliance?

      A signed form that states the merchant's PCI DSS assessment type, scope and compliance status. It accompanies a self-assessment questionnaire or a report on compliance.

      Source summary as of October 30, 2026. Check the current source and its scope.

      Context for this answer
      Does a time receipt make me PCI compliant?

      No. It only shows that these exact files existed by the date on the receipt. Compliance is assessed under PCI SSC and acquirer rules.

      Source summary as of October 30, 2026. Check the current source and its scope.

      Context for this answer
      Do I upload my scan report to Timevolt?

      Your file stays on your device. During normal receipt creation, your device sends a randomized code made from its fingerprint, plus encrypted recovery data. It doesn't send the plain fingerprint or the random value that opens the code. Keep the original file and the complete receipt for checking.

      Will my acquirer accept a time receipt instead of the scan report?

      A completed time receipt shows that the exact selected file existed by the independently witnessed time. You can check whether a later copy has the same bytes. It does not establish creation time, authorship, identity, event order, location or the truth of the contents. Keep separate identity, process and entry-history evidence where needed.

      Source summary as of October 30, 2026. Check the current source and its scope.

      Context for this answer
      Why date a scan if the scan vendor keeps it?

      A completed time receipt shows that the exact selected file existed by the independently witnessed time. You can check whether a later copy has the same bytes. It does not establish creation time, authorship, identity, event order, location or the truth of the contents. Keep separate identity, process and entry-history evidence where needed.

      Can a receipt show a pass came before a breach?

      A completed time receipt shows that the exact selected file existed by the independently witnessed time. You can check whether a later copy has the same bytes. It does not establish creation time, authorship, identity, event order, location or the truth of the contents.

      Source summary as of October 30, 2026. Check the current source and its scope.

      Context for this answer
      What should I date each quarter?

      The scan report, any rescan report after fixes, and the attestation document, so the chain from failing scan to passing scan to attestation is visible.

      Source summary as of October 30, 2026. Check the current source and its scope.

      Context for this answer

      The file tester runs on your device. It does not issue a timestamp or take a payment.

      Keep the records you already have.

      Keep your original files and any existing official records while the receipt service is being prepared.