ASL Timestamp Anchor — Source library
Public documentation snapshot: 2026-09-08
Prove when your file existed, without handing it over
Independent proof that your file existed at a moment in time, without uploading the file.
Prove when your file existed, without handing it over
Built for: A therapist whose progress notes could be reviewed by a licensing board years after they were written · A solo attorney who needs to show that an engagement letter, a draft, or a piece of work product existed before a particular date · An investigator, inspector, or adjuster who wants field photos and reports fixed in time before anyone has a reason to question them · A designer, writer, or engineer who wants dated proof of an original draft without publishing it or sending it to a stranger
ASL Timestamp Anchor exists because of this.
You have the file. You know when you made it. The trouble starts the moment someone else has a reason not to believe you. A date typed on a document is just typing. A file's creation date is whatever the computer says it is, and anyone can change it in about ten seconds. Even a carefully kept records system usually cannot answer the question that actually gets asked in a hearing. That question is not "was this edited?" It is "can you prove this existed on the date you claim?" A tamper-evident log answers the first question and not the second. It proves the entries are internally consistent, that nothing was slipped in afterward. It cannot prove when anything happened, because a log you control could be rebuilt from the beginning today, with any dates you like, and it would still check out perfectly. So when your record meets someone with a motive to doubt it — an opposing attorney, a state board, an insurer, a client who says you wrote that note after the complaint arrived — your own system is the weakest possible witness. You are vouching for your own records. That is exactly the point a skeptical party will press on, and "our software says so" is not an answer that survives it. The usual workarounds are worse than they look. Mailing yourself a copy proves you sent an email, and hands your content to a mail provider. A sealed envelope proves you mailed an envelope. A notary can witness your signature but never saw the file. And most online proof services want you to upload the document itself, which is precisely what you cannot do with a clinical note, a case file, a sealed investigation, or anything covered by a confidentiality obligation. You end up choosing between having proof and keeping the file private.
ASL Timestamp Anchor exists because of this.
The signature comes from someone with no stake in your records — not from us. A timestamp we signed ourselves would be the exact thing an opponent attacks first.
ASL Timestamp Anchor exists because of this.
Only a fingerprint travels. Contents, filename, and folder path never leave your device, so this works for records you are not allowed to upload.
ASL Timestamp Anchor exists because of this.
The evidence is a portable file you keep, not a row in our database. It verifies with the app deleted and AutoSecureLogin gone.
ASL Timestamp Anchor exists because of this.
It refuses to store anything it cannot verify at that moment, so your history never contains something that looks like proof and isn't.
ASL Timestamp Anchor exists because of this.
Verification is always re-run from the stored bytes. There is no saved 'valid' flag that could hide later damage to the evidence.
ASL Timestamp Anchor exists because of this.
The exact signed release was run end to end on a real phone against the real authority, and its exported evidence was then checked on a separate computer — including a deliberately modified file that was correctly rejected.
ASL Timestamp Anchor exists because of this.
The product states its own limits in its own interface: a timestamp proves existence by a time, not authorship, ownership, truth, or legality.
How ASL Timestamp Anchor works, start to finish.
Timestamp Anchor removes that choice. On your phone, you pick a file with the normal Android file chooser. The app reads it on the device and reduces it to a fingerprint: a fixed-length code that changes completely if a single byte of the file changes. That fingerprint is the only thing that ever travels. The file's contents, its name, and the folder it lives in are never sent anywhere — not to AutoSecureLogin, and not to anyone else. The fingerprint goes to an independent public timestamp authority, which signs a statement in RFC 3161, the international standard for trusted timestamping: this fingerprint existed no later than this moment. AutoSecureLogin does not own that authority, does not operate it, and does not receive your file or your fingerprint. That separation is the whole design. A timestamp we signed ourselves would just be us attesting to our own records, which is the first thing an opponent would attack. The authority is FreeTSA, a free public service, and the phone app is fixed on it — there is no setting that quietly points your proof somewhere else, and the app will reject a reply signed by anything other than the exact certificate it carries. The app names that authority plainly on its Help screen and links straight to the authority's own documentation rather than hiding it behind our brand. Before anything is saved, the app checks the reply three ways: the signature on it, the signing certificate against a copy carried inside the app, and whether the fingerprint that was signed is exactly the fingerprint that was sent. If any of those fail, or the authority is unreachable, or the reply is malformed, nothing is stored and you are told. This matters more than it sounds. A half-finished record sitting in your history, looking like proof and not being proof, is worse than no record at all — you would rely on it at the worst possible moment. What you keep is real evidence. Verified timestamps go into an on-device locker, encrypted with a key that is created on the phone and cannot be pulled off it. You can re-check any record on demand, and the app re-runs the full check against the stored bytes rather than reading back a saved answer. You can export any record as a standard.tsr evidence file. That exported file is the deliverable: hand it to an expert together with the original document and they can verify it themselves, with standard tools they already trust, with this app deleted and AutoSecureLogin out of the picture entirely. During acceptance testing that was proved both ways — an exported token checked out against the original file on a separate computer, and correctly refused to match a deliberately modified copy. The on-device locker is a convenience copy rather than an archive: it holds the hundred most recent records, and the exported file is the thing meant to outlive the phone. There is a second half aimed at organizations rather than individuals. If you already keep a tamper-evident log of clinical notes, complaint filings, or credential access, a companion service takes the current head value of that log — you hand it that one value, nothing else — and gets the same independent authority to sign it. One outside signature then covers every record in the chain up to that moment, which is what turns “nothing was edited” into “and it existed by this date.” How often that happens is your call: the service anchors what you send it and does not run itself on a timer, so the cadence is set by whoever operates it. The evidence is stored as a file with only a pointer to it kept in the service's own index, the file is written before the pointer, missing evidence is named rather than quietly skipped, and re-anchoring adds a new proof rather than overwriting the old one. That service is written and covered by automated checks. It is not running for customers, and nothing in it schedules anything on its own.
Everything in the current release.
Each of these is built and working today. Nothing on this list is a roadmap item.
Your file never leaves the phone
The app reads the file on the device and turns it into a fingerprint — a code that changes completely if one byte changes. Only that fingerprint is sent. The contents, the filename, and the folder path are never transmitted to anyone, which is what makes this usable for clinical notes, case files, and anything else you are not permitted to upload.
The signer has no stake in your records
The timestamp is issued by an independent public authority that AutoSecureLogin does not own, operate, or pay. That is deliberate: a timestamp we signed ourselves would be us vouching for our own files, which is the first thing a skeptical opponent would go after. The app names the authority openly on its Help screen and links straight to that authority's own published documentation, so you can check it rather than take our word.
Evidence you can hand to someone else
Every verified timestamp exports as a standard .tsr evidence file in the RFC 3161 format used for trusted timestamping worldwide. Give that file and the original document to an expert and they can verify it on their own machine with tools they already trust. None of that check involves us, our systems, or our continued existence as a company.
It refuses to save what it cannot verify
Before a record is stored, the app checks the signature on the reply, checks the signing certificate against a copy carried inside the app, and confirms the fingerprint that was signed is exactly the one it sent. If any check fails, nothing is saved and you are told. You never end up with a record in your history that looks like proof and is not.
No cached verdict — it re-checks on demand
Tap Verify again and the app re-runs the whole check against the stored bytes. It does not read back a saved yes-or-no from when the record was created. A stored verdict would hide later damage to the evidence, which would defeat the entire point of keeping it.
An encrypted evidence locker on your device
Verified timestamps are kept in a local history, encrypted with a key created on the phone that cannot be extracted from it. Device backup and phone-to-phone transfer are switched off on purpose, so evidence is never silently copied somewhere you did not choose. The trade-off is real and stated plainly in the app: export the tokens you need to keep.
The certificate fingerprints are printed in the app
The Help screen shows the exact fingerprints of the two public certificates the app will accept from the authority. If the signing certificate ever changed unexpectedly, the app rejects the response rather than quietly accepting a new signer. You can compare those fingerprints against the authority's own published files any time you like.
Honest about what a timestamp does not prove
The app says plainly, in its own Help screen and in its store listing, that a valid timestamp proves the fingerprint existed no later than the authority's time and nothing else. It does not prove authorship, ownership, truth, legality, or what a document means. Overclaiming is how evidence gets picked apart, so the limits are written into the product rather than buried in a disclaimer.
Fingerprinting works with no signal
Calculating the fingerprint needs no connection at all; only requesting the timestamp does. Put the phone in airplane mode and it keeps hashing — and, importantly, creates no evidence record. A record that appeared when the request never happened would be far worse than no record, so failure is loud and empty rather than quiet and plausible.
English and Spanish, all the way down
Every one of the app's 53 interface strings exists in Spanish as well as English, with none left untranslated — the help text, the privacy explanation, and the account of what the timestamp does and does not prove included. Someone reading in Spanish gets the same description of the trust boundary and the same instructions for verifying evidence without the app. The menus are not the only thing that got translated. The Spanish is written without accent marks, which we would rather say than let you discover.
No account, no ads, no tracking
There is nothing to sign up for and no profile to create. The app carries no advertising, no analytics, no crash reporting, and no tracking code, and it does not use an advertising identifier. On the released app, screenshots are blocked, so a fingerprint or filename does not end up sitting in your photo gallery.
Anchor a whole record system, not one file at a time
For an organization already keeping a tamper-evident log, a companion service takes the current head value of that log and gets the same independent authority to sign it. One outside signature then covers every record in the chain up to that point, so the whole history gets a date that is not yours. You decide when to send a head value — the service anchors what it is given and does not schedule anything itself. This part is written and covered by automated checks; it is not running for customers yet.
The proof is a file, not a database entry
In the organization-wide service, each signed proof is written to disk as its own file, and only a pointer to that file is kept in the service's index. The file is written before the pointer, deliberately: an unreferenced file can be picked back up, while a pointer to a file that was never written looks exactly like proof and is not. Evidence you can hand over is the point; a row in a table is not evidence.
Loud about missing or repeated evidence
If a signed proof ever goes missing, the service names the affected records — their source and label — rather than showing a tidy list that implies everything is fine; a quiet gap in evidence is the kind of thing you find out about at the worst moment. Re-anchoring the same record creates an additional proof instead of replacing the earlier one. History accumulates; nothing is overwritten.
Numbers we can stand behind.
Every figure below comes from the product's own release record or test suite, not from a marketing estimate.
Numbers we can stand behind.
Nothing to sign up for, no advertising, no analytics, no tracking identifier, and no data collected.
Surfaces and status.
Status as of 2026-09-02. The Android app reached a finished, signed 1.0.0 release (versionCode 1) committed on 2026-08-23 and passed end-to-end acceptance the same day in two environments — an Android 16 emulator and a physical Google Pixel 8 on Android 14 — including a live timestamp from the independent authority at 15:13:46 UTC, and an independent re-check of the exported evidence on a separate computer that verified against the original file and correctly refused a modified copy. Store listing copy, data-safety answers, app-access notes, release notes, four phone screenshots, the icon, and the feature graphic are all present and finished. A read-only store check on 2026-08-23 found no app record for the package and nothing uploaded, priced, or submitted. The companion record-anchoring service is described as undeployed in the repository's own README, and a read-only check of the running environment on 2026-09-02 found it running nowhere. Nobody can obtain either half today; publication is the next step.
Worth more together.
Products on this platform share one sign-in, one support queue, and one engineering standard. These pair naturally with ASL Timestamp Anchor.
ASL Vault
Vault keeps a tamper-evident record of who reached which credential and when. Anchoring the head of that record turns 'nothing was altered' into 'and it existed by this date', signed by someone outside your organization. You choose when to anchor it; nothing about it is automatic today.
ASL Therapy
Clinical notes are the records most likely to be read years later by a board or a court. Anchoring the note history gives you an outside date on the whole file without any note content ever leaving your systems.
ASL Command Center
The review inbox already keeps a tamper-evident record of what was reviewed and when. An outside signature over that record means the dates on it are not just your own word — and the anchoring happens when you send a head value, not on any timer the product runs for you.
ASL Intake
Engagement letters, intake forms, and case files all carry date arguments that surface later. The phone app produces a portable proof file you can keep alongside any one of those documents, dated by a signature from outside the practice.
Recent progress.
This product ships often. The most recent verified changes, newest first.
Recent progress.
2026-08-23 the native Android app reached a finished, signed 1.0.0 release and passed end-to-end acceptance in two environments — an Android 16 emulator and a physical Google Pixel 8 — covering local fingerprinting, a live timestamp from the independent authority (authority time 15:13:46 UTC), re-verification, export of a 4,678-byte proof, and cold relaunch with evidence still intact. The exported proof was then pulled onto a separate computer and verified against the original file with standard tools, and correctly refused to match a deliberately modified copy. Airplane-mode behaviour was checked and confirmed to create no evidence record when the request cannot happen. Store listing copy, data-safety answers, app-access notes, release notes, four phone screenshots, the icon, and the feature graphic were completed the same day, and the English and Spanish interfaces were confirmed complete at 53 strings each. A read-only store check on.
Recent progress.
2026-08-23 confirmed no store record exists for the app and nothing has been uploaded. As of.
Recent progress.
2026-09-02 the companion record-anchoring service is still not running for customers. Publishing the app is the next step.
Recent progress.
Pricing for ASL Timestamp Anchor is quoted after a short conversation about your situation, because the right scope differs from one team to the next. There is no charge for that conversation.
What is this going to cost me, and do I pay per timestamp?
The Android app is planned as a one-time $9.99 purchase, not a subscription, though it is not on sale yet. The timestamps themselves are issued by a free public authority, so there is no per-timestamp charge and no metered bill from us. Pricing for the organization-wide anchoring service has not been set.
We already keep a tamper-evident log. Why would we add this?
Because they answer different questions. A tamper-evident log proves internal consistency — nothing was slipped in or edited after the fact. It cannot prove when anything happened, because a log you control could be rebuilt today from the beginning with any dates you like and would still check out. This puts a signature from outside your organization over that log, which is the part your own systems structurally cannot provide.
Can I actually get it right now?
No, and we would rather say so. The app is finished, signed, and has passed end-to-end acceptance on a real phone against the real authority, with store listing copy and screenshots ready. It has not been published to a store yet, and the organization-wide anchoring service is not running for customers. If you want it, tell us — a waiting customer moves it up the list.
What do you actually see of my file?
Nothing. The file is read on your device and reduced to a fingerprint there; only that fingerprint is sent, and it goes directly to the independent timestamp authority, not to us. We do not receive your file, its name, its location, or even the fingerprint. The app collects no data, has no account, and carries no advertising, analytics, or tracking.
What happens to my evidence if I stop paying, or you stop selling this?
Nothing happens to it. That is the point of the design. Your evidence is a standard file you already hold, in a format used for trusted timestamping worldwide, signed by an authority we do not control. Anyone can verify it with standard tools against your original file with our app deleted and our company gone.
Do we have to migrate anything, or change how we keep records?
For the phone app, no. You pick a file that already exists wherever it already lives, and you get a proof file back. Nothing is imported, converted, or moved. For anchoring a whole record system, the only thing needed is the current head value of your existing tamper-evident log — the records themselves stay where they are and never move. You send that value when you want it anchored; the service does not run on a timer and does not reach into your systems for it.
How many proofs does the phone hold, and what if I lose it?
The on-device locker keeps the 100 most recent records, encrypted with a key that cannot be pulled off the phone. Past 100 the oldest drops off to make room. Because backup and phone transfer are deliberately switched off, anything you have not exported is lost with the phone. Treat the exported proof file as the real record and the phone as a convenience copy.
Is this legally binding? Does it replace a notary?
It is evidence, not a legal conclusion, and it does not replace a notary where one is required. What it gives you is a signed statement from an independent third party, in the RFC 3161 international standard for trusted timestamping, that a specific fingerprint existed no later than a specific moment — checkable by the other side's own expert. It does not prove authorship, ownership, truth, or legality, and the app says so on its own screens. How much weight it carries is a question for your counsel and your jurisdiction.
What if the free timestamp authority disappears?
Timestamps already issued keep verifying, because they are signed files checked against public certificates rather than a service that has to answer a call. What would stop is issuing new ones. The app is fixed on one authority and rejects a reply signed by any other certificate, so moving to a different authority means an app update rather than a setting you flip. The format is a standard with more than one authority in the world, so this is a maintenance problem rather than a dead end — but it is a real dependency and we would rather you hear it from us.
What should I know before I rely on it?
We would rather you hear this from us than discover it later. As of 2026-09-02:
What should I know before I rely on it?
You cannot download it today. The Android app is finished and signed but has not been published to a store, and there is no web or desktop version.
What should I know before I rely on it?
There is no iPhone or desktop app, and none is currently in progress.
What should I know before I rely on it?
The record-anchoring service for whole audit logs is written and covered by automated checks, but a read-only check on 2026-09-02 confirmed it is not running anywhere for customers.
What should I know before I rely on it?
Nothing in the product schedules anything. The record-anchoring service anchors a value you send it; it does not run on a timer and does not reach into your systems to fetch anything, so any cadence is arranged by whoever operates it.
What should I know before I rely on it?
The phone app is fixed on one timestamp authority. There is no setting to choose another, so switching authorities means shipping an app update.
What should I know before I rely on it?
The timestamp comes from a free public authority that we do not run and do not fund. If it is unavailable or changes its signing certificate, new timestamps pause until the app is updated. Evidence already issued keeps verifying.
What should I know before I rely on it?
Because the authority is a free public service, there is no service-level guarantee on how fast a timestamp is issued or how long the service will exist.
What should I know before I rely on it?
A timestamp proves that a fingerprint existed no later than a moment. It does not prove who wrote the file, who owns it, whether it is true, whether it is legal, or what it means.
What should I know before I rely on it?
Change a single byte of the original file and the evidence no longer matches it. You must keep the exact file, unchanged, alongside the proof.
What should I know before I rely on it?
The on-device locker keeps the 100 most recent records. Past that the oldest record drops off to make room, and it goes without a prompt — so export anything you intend to keep rather than treating the phone as the archive.
Prove when your file existed, without handing it over
Prefer email? contact@autosecurelogin.com