Technology

Timestamping and fingerprint: your file stays confidential.

The fingerprint is computed at the time of deposit. It represents the exact state of the file on a given date and protects the confidentiality of its content. The file is then transferred to our storage with encryption. For the free deposit, this transfer is automatic: you can then retrieve the file if you open an account with the same email address. Subscribers who want to better organize their deposits can request this transfer. The content can be viewed from your space.

Under the hood

The mechanism, step by step

New to Ipocamp? The simple version is on the page From idea to proof.

Where is the fingerprint computed?
  1. 01 Local fingerprint

    Your browser computes the SHA-256 fingerprint of the file, a 64-character string unique to that file. The calculation runs on your device, before anything is sent.

    The calculation module is installed in your own infrastructure. The SHA-256 fingerprint is computed there and only the fingerprint is sent to us. The source file never leaves your company and we never see it, which suits organisations protecting a trade secret. An agent can also timestamp every file dropped into a folder automatically.

  2. 02 Timestamping

    The fingerprint is placed in a token signed by Ipocamp, together with a fingerprint of the author details chosen at deposit (name and email of each author). The document and its declared authors are sealed together, on the same date, without these details appearing in plain text in the registry. The token is then sent to the registry. Each file is timestamped on its own, one by one, in order of arrival, with no batching.

  3. 03 Anchoring

    The token is recorded on the Tezos blockchain, a public registry that nobody can alter afterwards. The date that counts is the block's date, set by the network to the second (UTC), independently of Ipocamp. Each deposit has its own record, and the file is never written there.

  4. 04 Certificate

    You receive a PDF certificate showing the fingerprint, the date, the registry reference and a verification QR code.

  5. 05 Verification

    Anyone can check it for free, without an account. You recompute the fingerprint of the original file and compare it with the one recorded in the registry.

Preview

What it looks like

Your deposits are listed in your client area. Each one comes with a certificate you can download and share.

Client area: list of deposits and details of the selected file
Client area: list of deposits and details of the selected file
Timestamp certificate: fingerprint, date, registry reference and verification QR code
Timestamp certificate: fingerprint, date, registry reference and verification QR code

Illustrations with fictitious data.

Keep your source file to use your certificate

The certificate attests that a given fingerprint existed on a given date. To use it in a dispute, an audit or a challenge, you need to be able to reproduce that fingerprint from the original, intact file. Keeping the source file in its original state lets you link the certificate to your creation. It matters as much as the deposit itself.

Why Ipocamp's timestamping uses few resources

The computation covers only the file's fingerprint and uses the equivalent of a few seconds of web browsing.

What is actually sent

Only the file's fingerprint is recorded on the Tezos blockchain, inside a signed token of a few hundred bytes, whatever the size of the original file. A 2 GB video and a 40 KB sketch produce the same traffic and the same carbon footprint on this blockchain. Tezos was chosen for its negligible energy use and its proof-of-stake mechanism. The associated file is transferred separately to our storage. It is encrypted and distributed via Storj, a decentralized storage network. The application infrastructure is hosted with OVHcloud, in France.

Blockchain anchorThe fingerprint only, never the file
HostingOVHcloud, France and European Union, GDPR-compliant
TimestampingTezos block date, set by the network
File storageEncrypted and distributed via Storj, automatic for the free deposit, on request for subscribers
VerificationPublic, no account needed, at any time, from any country
RetentionCertificate verifiable for life, stored file deleted three years after termination
Evidentiary valueFree-form evidence under French law, Art. 1358 of the French Civil Code. Growing recognition abroad (EU, China, United States...)
Insurance distributionIpocamp, a broker registered with ORIAS
IntegrationSaaS, API, white label

Enterprise deployment

For technical and security teams

Beyond the proof mechanism, what IT, security and procurement teams ask for before signing off on the tool.

Single sign-on (SSO, one login for several tools)

Sign-in via your identity provider (SAML or OIDC standards), with account provisioning and deprovisioning from the systems you already use.

API and automation

Every deposit can be triggered via API, including at volume and from your CI/CD pipeline, with real-time processing tracking. The fingerprint calculation can also be integrated into your own infrastructure: only the fingerprint reaches us, and the file stays with you.

Roles, groups and quotas

Each group has its own rights (administration, deposit, generation, read) and its own deposit and storage quotas, per day, month or year. API keys have their own rights and an expiry date.

Spaces per subsidiary or brand

Each entity, or each white-label deployment, has its own space, its own users and its own history, under shared governance.

Automatic timestamping agent

An agent installed in your infrastructure automatically timestamps every file dropped into a chosen folder. Everything is configurable, from the folders it watches to sending only the fingerprint or the file too.

White label and resale

Domain name, logo, certificate and email templates in your colours. A partner reselling the service bills its own clients with its own Stripe account and plans.

Details by profile: IP and R&D teams, White-label publishing.

Glossary

The words of digital proof

Six terms come up in every intellectual property case. Here they are, one sentence each, without unnecessary jargon.

Prior existence

The fact that a creation existed before another one, or before a given date. This is what you seek to demonstrate in the event of copying.

SHA-256 fingerprint

A 32-byte string computed from a file. It represents the exact state of the file and does not reveal its content.

Timestamping

A date linked verifiably to a file's fingerprint, attesting that the file existed at that moment. At Ipocamp, it is the date of the Tezos block in which the fingerprint is recorded.

Tamper-proof registry

A public log that keeps each entry in its original state. A third party can thus verify it directly with open tools.

Infringement

The use of a protected creation without its owner's authorization. It can be proven, and the harm it causes quantified as damages.

Trade secret

Confidential business information protected by reasonable measures, which you need to be able to document.

Frequently asked questions

The technology, question by question

Can Ipocamp see the content of my files?

The fingerprint is calculated on your device, before anything is sent, and only the fingerprint is recorded on the blockchain. If the file is stored, it is encrypted and can be viewed from your own space. Our team does not open it, except at your written request or when the law requires it. For companies, the calculation module can be installed in your own infrastructure. The file then never leaves your premises.

Why the Tezos blockchain?

It is a public ledger that nobody can alter after the fact. The authoritative date is set by the network to the second, independently of Ipocamp. Tezos uses very little energy, as it runs on proof of stake, without mining. Unlike other services, which group fingerprints into batches before recording them, Ipocamp records each file separately, with its own anchor on Tezos.

Does my proof remain valid if Ipocamp disappears?

The record stays on the Tezos blockchain, a public ledger that does not depend on Ipocamp. With your original file and the record reference shown on the certificate, the fingerprint can be recalculated and compared with the one recorded.

Where is my data hosted?

The application is hosted by OVHcloud, in France. Stored files are encrypted and distributed via Storj, a decentralized storage network.

Why keep my original file?

The certificate proves that a fingerprint existed at a given date. To link it to your creation, you need to be able to recalculate that fingerprint from the original, unaltered file.

Want to see it in action?

Deposit your first file and get your timestamped proof in a few seconds.

Secure a file