Providers.
This register describes selected staging/sandbox integrations and planned public use. It does not claim a public receipt service is operating. Privacy §5 names the selected providers in the current v9.4 Privacy Policy.
| Provider | Purpose | What it receives | Location | Safeguard and remaining review |
|---|---|---|---|---|
| Stripe | Hosted payments, subscriptions, refunds and billing recovery. | Payment/contact details entered at Stripe, opaque customer/order/invoice IDs, amounts and payment state; hosted-page device/network information. No original file, opened fingerprint/nonce or recovery key. | US provider; detailed processing/subprocessor locations pending publication review. | Hosted Checkout, test-only credential, signed webhooks and payment-method drift guard. Transfer contract/certification applicability requires confirmation. |
| Amazon SES | Timevolt-owned service messages and separately consented updates. | Recipient email, approved message text and scoped account/unsubscribe links. No receipt contents, original files, opened fingerprints or recovery keys. | us-west-2, US. | DKIM, aligned MAIL FROM, TLS, send-only identity; no click/open tracking; private SNS/SQS feedback. Account-level suppression sync awaits production access. |
| Backblaze B2 | Independent encrypted recovery mirror and blind proof holding. | Encrypted envelopes, blind proof evidence, pseudonymous object paths and minimal signed deletion/checkpoint records. No plaintext file or private wallet/issuer key. | us-west-004, US. | Private bucket; TLS and encryption at rest; all-version deletion and signed restore barrier. Personal objects stay unlocked; only narrowly classified aggregates have governance protection. |
| Vercel | Static website hosting. | Requested URL, IP address and ordinary HTTP/security metadata. This review bundle sends no receipt or payment data. | US provider; project processing locations and contractual safeguard still require confirmation. | Static allowlisted files; no API, analytics, forms or runtime secrets. No claim of US-only processing. |
| FreeTSA (https://freetsa.org/tsr) | Independent RFC 3161 timestamp authority. | Only combined batch codes and required timestamp-protocol fields; no personal data, files or individual receipt opening. | Germany. | Independent operator; published policies govern its timestamps. Pinned root/chain, imprint, nonce, signature, ESS and timestamping EKU validation; at most one request per second. |
| Sigstore public timestamp service (https://timestamp.sigstore.dev) | Second independent RFC 3161 timestamp authority. | Only combined batch codes and required timestamp-protocol fields; no personal data, files or individual receipt opening. | Public service infrastructure; processing location not contractually confirmed. | Independent operator; pinned root/chain and full token validation; well under one request per second. Published service policies apply. |
| OpenTimestamps calendars | Aggregate Bitcoin proof submission and upgrade. | Batch-level digest and timestamp-proof protocol data, plus the service network address. No per-user record, email or document. | Selected calendars operate independently; processing locations and policies require publication review. | At least two calendars; local proof/header verification; no user BTC purchase required. |
| mempool.space and blockstream.info | Optional current-chain checks and staging anchor qualification. | Block/hash/height lookups and the requester’s IP address. When selected in the reader, requests go directly from the browser. No receipt, opened fingerprint or file is sent. | Public network services; processing locations/policies to confirm. | Explicit reader source selection and notice before contact; recorded source and check time. Offline verification remains available. |
The calendar pair is https://alice.btc.calendar.opentimestamps.org, https://bob.btc.calendar.opentimestamps.org. Only the batch summary goes to timestamp/anchoring providers. Explorers receive block lookups, never receipt contents.
Location and international-transfer safeguards marked pending are publication gates, not assertions that a particular contract or certification already applies.