timevolt
Opening soon. Receipts and payments aren't open yet.
Timevolt / Coordinated disclosure timeline
Cybersecurity

Vulnerability disclosure timeline: preserve the report, each revision and separate acknowledgments.

Vulnerability disclosure timeline: preserve the report, each revision and separate acknowledgments. Keep your original source records together, then date the exact files. It does not establish origin, identity, truth, physical events, sending, delivery, agreement, acceptance or the outcome of a dispute.

Try a file locally

Your photos and files stay on your device, so keep them.

EXAMPLE
Coordinated disclosure timeline
1 Nov 2026
Authority time: 14:02 UTC · example
Bitcoin block time: 14:10 UTC · example
Last checked: 15:02 UTC · example
✓ Dated◆ Permanent
Now keep it safe: three things
  1. Keep your photos and files unedited. The receipt only matches the originals. Put them in an album such as “My records”.
  2. Save this receipt to your camera roll.

    Keep the receipt file too. The image is a handy copy; checking needs the file.

  3. Email it to yourself.Email it to myself

    Your mail app opens a draft. Attach your receipt image and receipt file. Don’t attach your photos or documents. Timevolt does not send it or know whether it was sent.

Your record, one step at a time.

Your photos and files stay on your device, so keep them.

Local preview: files are fingerprinted here. Notes and progress stay in this browser. Keep downloaded copies; browser storage is not a backup.

0 items
How?

Add the exact original files for this part of the record. Keep them unchanged; a different export or edit has a different fingerprint.

Add link and screenshots

The link is recorded, not fetched or verified.

    0 items
    How?

    Record the date, time, place and who you spoke to. New notes are saved separately rather than editing an old note.

    How to keep notes that hold up
    Write it down

    By making a receipt you agree to the Terms and Privacy Policy. The Bitcoin record is permanent.

      By making a receipt you agree to the Terms and Privacy Policy. The Bitcoin record is permanent.

      How to keep notes that hold up

      Write notes as soon as you can. Keep the original account rather than replacing it later; the venue decides what weight it gets.

      1. Write it down straight away, on paper or in the box on a step.
      2. Put the date, time and place at the top, and who you spoke to.
      3. Use their words where you can; separate what you saw from what you were told.
      4. Sign or initial a paper note, photograph it and add the photo.
      5. Never edit an old note. Add a new dated entry when something changes. A device save time is not independent time evidence or proof of event order.
      Coordinated disclosure timeline
      Coordinated disclosure timeline

      01 · Keep the exact files

      Keep the original files for coordinated disclosure timeline. Include any existing photos, signed records and source-system exports.

      Records to keep: Advisory draft and emails as sent to the vendor, plus the vendor's acknowledgment

      Coordinated disclosure timeline

      02 · Date the file’s code

      Your device fingerprints the selected file or manifest. Dated follows an independent timestamp; Permanent follows Bitcoin anchoring.

      An independent time, tied to the exact bytes.

      Coordinated disclosure timeline

      03 · Keep the evidence

      Keep the original files and complete receipt separately, alongside any existing venue, signature and workflow records.

      Keep the originals too. A changed or compressed copy has a different fingerprint.

      Try a file. It stays here.

      Make a test receipt on this device.

      By making a receipt you agree to the Terms and Privacy Policy. The Bitcoin record is permanent.

      or drop a file here

      Real cases: why the saved copy matters.

      Real cases where dated records mattered. We don’t claim a time receipt would have changed the result.

      United States federal · 2018

      Keep each bug report review and response record

      A watchdog challenged how a transport firm kept private data safe. The firm agreed to privacy rules and records of listed bug report reviews and replies. It did not admit or deny the main claims.

      Summarized on Oct 29, 2026

      Read the source ›
      United States federal · 2016

      Respond to security reports with real follow up

      A watchdog said a router firm received repeated flaw reports but delayed replies and notices to customers. The firm agreed to written rules to keep data safe. It did not admit or deny the main claims.

      Summarized on Oct 29, 2026

      Read the source ›

      Related cases

      United States federal · 2024

      Tell customers the full known breach scope

      Related: breach notices to customers

      A watchdog said a firm was slow to tell customers the full scope of a data breach. The firm settled but did not admit or deny the main claims. The final order set security and data keeping rules and barred false claims.

      Summarized on Oct 29, 2026

      Read the source ›

      What courts, schemes and regulators say.

      Positions below refer to the cited rule or record type, not endorsement of Timevolt. This service is not represented as an eIDAS qualified timestamp provider. A non-qualified timestamp does not receive the qualified timestamp presumption.

      Needs something else · United States; GSA systems expressly in policy scope

      GSA vulnerability disclosure policy; updated October 1 2026

      Specified reporting channels and report details; acknowledgment target within two business days and policy-specific confidentiality and coordinated release process.

      GSA alone defines scope and conditional protections; retaining a report does not prove it arrived or authorize testing. Its 90-day language is not a worldwide deadline.

      Source summary as of 2026-10-29. Check the current source and applicable local rules.

      Read the source
      Needs something else · European Union; ENISA owned internet-facing services

      ENISA responsible disclosure policy

      Email submission, reproducible evidence and discovery details; minimum 90-day confidentiality and working-day acknowledgment table.

      Raw scanner output is not accepted alone. Receipt-based agency timing and validation rules are separate from the date on a locally saved report.

      Source summary as of 2026-10-29. Check the current source and applicable local rules.

      Read the source

      Other ways to do this

      Prices change. Check each provider’s site for current prices and service details.

      • Bugcrowd VDP

        Provides managed report intake, triage, coordination and reporting.

        Visit site

      • CERT Coordination Center

        Provides selective coordination assistance, prioritizing multi-vendor and high-impact reports.

        Visit site

      • CERT Guide to CVD

        Provides public process guide and role-based troubleshooting.

        Visit site

      Related workflows.

      Quarterly user access review: the reviewer list, decisions and removals frozen as submittedAccess or license request, manager approval and grantQuarterly user access review: the list shown to the reviewer, each keep/remove decision and proof removals happenedHuman-in-the-loop approval before an AI agent executes a high-impact action (refund, payment instruction, production change, customer message)Who was physically present at a members' or condo board meetingHuman-made process record

      Proves / Doesn’t prove

      Proves

      A completed time receipt shows that the exact selected file existed by the independently witnessed time. You can check whether a later copy has the same bytes. It does not establish creation time, authorship, identity, event order, location or the truth of the contents.

      Doesn’t prove

      It does not establish origin, identity, truth, physical events, sending, delivery, agreement, acceptance or the outcome of a dispute.

      It does not establish origin, identity, truth, physical events, sending, delivery, agreement, acceptance or the outcome of a dispute.

      These are the bounds of a completed proof. The local tester does not establish any time. The chosen court, scheme or regulator decides what to accept.

      Questions, answered plainly.

      Your file stays on your device. During normal receipt creation, your device sends a randomized code made from its fingerprint, plus encrypted recovery data. It doesn't send the plain fingerprint or the random value that opens the code. Keep the original file and the complete receipt for checking. Privacy Policy.

      Is there one universal disclosure deadline?

      No. GSA publishes its own scope and timing process. Other recipients can have different policies.

      Source summary as of October 30, 2026. Check the current source and its scope.

      Context for this answer
      Does saving the report prove the vendor received it?

      No. GSA treats acknowledgment of receipt as a separate action through its reporting process.

      Source summary as of October 30, 2026. Check the current source and its scope.

      Context for this answer
      What details does ENISA request?

      Affected asset, reproduction steps, proof of concept, impact and discovery time are among its requested fields.

      Source summary as of October 30, 2026. Check the current source and its scope.

      Context for this answer
      Can a scanner export alone count as an ENISA report?

      Its policy says automated findings need proof of concept and validation information; raw output alone is not accepted.

      Source summary as of October 30, 2026. Check the current source and its scope.

      Context for this answer
      Will CERT coordinate every report?

      No. CERT says it prioritizes certain risks and does not accept or respond to every report.

      Source summary as of October 30, 2026. Check the current source and its scope.

      Context for this answer

      The file tester runs on your device. It does not issue a timestamp or take a payment.

      Keep the records you already have.

      Keep your original files and any existing official records while the receipt service is being prepared.