← Vetro Attest · Free Art. 12/14 checker · Free EU AI Act tools

Vetro Attest vs. RFC 3161 timestamping

*Engineering comparison, not legal advice.*

If you want to prove your AI logs were not changed after the fact, a trusted timestamp is the classic tool: hash the file, send the hash to a Time Stamping Authority (TSA), keep the signed token. It is cheap, standard and often free. So why pay for a countersignature?

What RFC 3161 does well

RFC 3161 defines a protocol in which a TSA signs a statement "this hash existed at this time". It is:

• Standard: supported by OpenSSL (openssl ts), code-signing tools and PDF signatures;
• Cheap or free: several public TSAs accept requests at no cost;
• Content-blind: the TSA only sees a hash, never your data;
• Recognised: under eIDAS, a *qualified* timestamp from a qualified trust service provider carries a legal presumption of accuracy in the EU.

If all you need is "this file existed, unchanged, no later than time T", a timestamp token is the right tool, and we recommend it.

What a timestamp does not tell anyone

A TSA signs a hash. It knows nothing about what was hashed.

• It does not check the log is well formed. A timestamp over a truncated, reordered or already-edited log is just as valid as one over a clean log.
• It does not know what an AI trace is. Nothing links the token to the agent run, the number of events, the model calls or the tool calls inside.
• The recipient has to do all the work. An auditor holding a token and a JSONL file still has to parse the trace, rebuild it and decide whether it shows what Art. 12 and Art. 14 of the EU AI Act ask for.
• It proves "when", not "what". Integrity of the content before timestamping is on you.

What Vetro Attest adds

Vetro Attest works one level up. It accepts an OTLP/JSON trace with the OpenTelemetry GenAI semantic conventions, or a natively signed Vetro ledger, and:

• verifies the content for free: rebuilds the spans into a hash-chained ledger, checks the chain and, for native ledgers, every ed25519 signature;
• for 49 USD, one-off, produces a full EU AI Act report (Markdown and HTML) mapping the trace onto logging and oversight obligations;
• issues an ed25519 countersignature over the digest, event count, input type and timestamp, verifiable by anyone against our published public key, no account needed.

The countersignature attests that the trace verified at a time. It does not attest that the events are true. It is not a qualified eIDAS timestamp, and the report is a structured aid, not legal advice or certification.

When to use which

• Only need to fix a file in time? Use an RFC 3161 timestamp. Free TSAs are fine; use a qualified one if you need the eIDAS presumption.
• Need someone outside to accept that an AI agent's trace is intact and complete, and see what it covers? Get it countersigned.
• Belt and braces: timestamp the attestation file itself with a TSA. You then have an independent check of the trace and a standard proof of when that check existed.

A timestamp proves when. The countersignature also proves what was checked.

Try it

• Run the free EU AI Act Art. 12/14 checker.
• Paste an OTLP trace on the Vetro Attest home page and verify it free. The full report plus countersignature is 49 USD, no subscription.

See a sample ledger verified in one click, check your own logs free or get the countersigned EU AI Act report.