timevolt
Opening soon. Receipts and payments aren't open yet.
Timevolt / SBOM as delivered to a customer or regulator with each product release
Software supply chain

Keep the exact SBOM version linked to each software release.

Keep the exact SBOM version linked to each software release. Keep your original source records together, then date the exact files. It does not establish a complete component list, secure software, license compliance, delivery, customer receipt or regulatory satisfaction.

Try a file locally

Your photos and files stay on your device, so keep them.

EXAMPLE
SBOM as delivered to a customer or regulator with each product release
1 Nov 2026
Authority time: 14:02 UTC · example
Bitcoin block time: 14:10 UTC · example
Last checked: 15:02 UTC · example
✓ Dated◆ Permanent
Now keep it safe: three things
  1. Keep your photos and files unedited. The receipt only matches the originals. Put them in an album such as “My records”.
  2. Save this receipt to your camera roll.

    Keep the receipt file too. The image is a handy copy; checking needs the file.

  3. Email it to yourself.Email it to myself

    Your mail app opens a draft. Attach your receipt image and receipt file. Don’t attach your photos or documents. Timevolt does not send it or know whether it was sent.

Your record, one step at a time.

Your photos and files stay on your device, so keep them.

Local preview: files are fingerprinted here. Notes and progress stay in this browser. Keep downloaded copies; browser storage is not a backup.

0 items
How?

Add the exact original files for this part of the record. Keep them unchanged; a different export or edit has a different fingerprint.

Add link and screenshots

The link is recorded, not fetched or verified.

    0 items
    How?

    Record the date, time, place and who you spoke to. New notes are saved separately rather than editing an old note.

    How to keep notes that hold up
    Write it down

    By making a receipt you agree to the Terms and Privacy Policy. The Bitcoin record is permanent.

      By making a receipt you agree to the Terms and Privacy Policy. The Bitcoin record is permanent.

      How to keep notes that hold up

      Write notes as soon as you can. Keep the original account rather than replacing it later; the venue decides what weight it gets.

      1. Write it down straight away, on paper or in the box on a step.
      2. Put the date, time and place at the top, and who you spoke to.
      3. Use their words where you can; separate what you saw from what you were told.
      4. Sign or initial a paper note, photograph it and add the photo.
      5. Never edit an old note. Add a new dated entry when something changes. A device save time is not independent time evidence or proof of event order.
      SBOM as delivered to a customer or regulator with each product release
      SBOM as delivered to a customer or regulator with each product release

      01 · Keep the exact files

      Keep the original files for sbom as delivered to a customer or regulator with each product release. Include any existing photos, signed records and source-system exports.

      Records to keep: Hash of SBOM (SPDX or CycloneDX) and the release digest

      SBOM as delivered to a customer or regulator with each product release

      02 · Date the file’s code

      Your device fingerprints the selected file or manifest. Dated follows an independent timestamp; Permanent follows Bitcoin anchoring.

      An independent time, tied to the exact bytes.

      SBOM as delivered to a customer or regulator with each product release

      03 · Keep the evidence

      Keep the original files and complete receipt separately, alongside any existing venue, signature and workflow records.

      Keep the originals too. A changed or compressed copy has a different fingerprint.

      Try a file. It stays here.

      Make a test receipt on this device.

      By making a receipt you agree to the Terms and Privacy Policy. The Bitcoin record is permanent.

      or drop a file here

      Related cases

      Related cases from nearby fields. We don’t claim a time receipt would have changed the result.

      US federal · 2016

      Back router security claims with real safeguards

      Related: Router security and update claims

      An agency said router software was unsafe and safety claims misled buyers. The firm agreed to checks, updates and notices to buyers. It did not admit or deny the claimed faults.

      Summarized on Oct 29, 2026

      Read the source ›
      US multistate · 2019

      A software settlement may leave fault undecided

      Related: Software flaws and warning dates

      States said software was sold despite known flaws, while the seller pointed to earlier guidance. Both sides agreed to end the case. The deal did not admit or deny fault.

      Summarized on Oct 29, 2026

      Read the source ›

      What courts, schemes and regulators say.

      Positions below refer to the cited rule or record type, not endorsement of Timevolt. This service is not represented as an eIDAS qualified timestamp provider. A non-qualified timestamp does not receive the qualified timestamp presumption.

      Needs something else · Joint US Australian and international guidance

      Government cyber agencies

      2026 Minimum Elements for an SBOM

      Calls for component identity, versions, hashes, generation context and distribution practices. General guidance is not legal compliance advice and does not certify a timestamp provider.

      Source summary as of 2026-10-29. Check the current source and applicable local rules.

      Read the source
      Needs something else · US medical devices within applicable scope

      FDA

      February 2026 cybersecurity premarket guidance including section 524B SBOM discussion

      Relevant cyber-device submissions require an SBOM and broader cybersecurity documentation; a time receipt is neither the SBOM nor FDA clearance.

      Source summary as of 2026-10-29. Check the current source and applicable local rules.

      Read the source

      Other ways to do this

      Prices change. Check each provider’s site for current prices and service details.

      • Syft

        Provides CLI generates SBOMs from container images and filesystems.

        Visit site

      • Trivy

        Provides security scanner for code, artifacts and containers.

        Visit site

      • OWASP Dependency-Track

        Provides component analysis and SBOM management across application portfolios.

        Visit site

      Related workflows.

      Build provenance attestation (who built what, from which source, on which builder) anchored independently of the registrySBOM and build attestation stamped per release and sent to customersQuarterly user access review: the reviewer list, decisions and removals frozen as submittedAccess or license request, manager approval and grantQuarterly user access review: the list shown to the reviewer, each keep/remove decision and proof removals happenedHuman-in-the-loop approval before an AI agent executes a high-impact action (refund, payment instruction, production change, customer message)

      Proves / Doesn’t prove

      Proves

      A completed time receipt shows that the exact selected file existed by the independently witnessed time. You can check whether a later copy has the same bytes. It does not establish creation time, authorship, identity, event order, location or the truth of the contents.

      Doesn’t prove

      It does not establish a complete component list, secure software, license compliance, delivery, customer receipt or regulatory satisfaction.

      It does not establish a complete component list, secure software, license compliance, delivery, customer receipt or regulatory satisfaction.

      These are the bounds of a completed proof. The local tester does not establish any time. The chosen court, scheme or regulator decides what to accept.

      Questions, answered plainly.

      Your file stays on your device. During normal receipt creation, your device sends a randomized code made from its fingerprint, plus encrypted recovery data. It doesn't send the plain fingerprint or the random value that opens the code. Keep the original file and the complete receipt for checking. Privacy Policy.

      Does an SBOM hash prove it reached a customer?

      No. Joint guidance treats distribution and delivery as separate practices; retain the transmission or recipient record.

      Source summary as of October 30, 2026. Check the current source and its scope.

      Context for this answer
      What context belongs with a release SBOM?

      The 2026 guidance includes component versions and hashes, SBOM version, generation context and tool details.

      Source summary as of October 30, 2026. Check the current source and its scope.

      Context for this answer
      Should corrected SBOMs replace all earlier copies?

      The joint guidance accommodates corrections and updates. Preserve which version accompanied each release rather than losing that link.

      Source summary as of October 30, 2026. Check the current source and its scope.

      Context for this answer
      Is the June 2025 FDA document current?

      FDA's guidance page says the February 2026 document supersedes the June 2025 version.

      Source summary as of October 30, 2026. Check the current source and its scope.

      Context for this answer
      Does an SBOM prove software is safe?

      No. The joint guidance says SBOMs support risk decisions and do not resolve all software-security concerns.

      Source summary as of October 30, 2026. Check the current source and its scope.

      Context for this answer

      The file tester runs on your device. It does not issue a timestamp or take a payment.

      Keep the records you already have.

      Keep your original files and any existing official records while the receipt service is being prepared.