Prove to your auditor that your time servers stayed consistent, month after month
Time Evidence measures your NTP servers continuously and delivers a
sealed monthly report, verifiable by a third party, to add to your
ISO 27001, PCI-DSS, NIS2 or DORA file. No more ntpq screenshot taken on the
morning of the audit.
The problem: a snapshot, where the auditor asks for a film
ISO 27001 (A.8.17), PCI-DSS (10.6), NIS2 and DORA all require, in one form or another, an approved time source and drift monitored over time. Yet on audit day most teams can only show an instantaneous state. Nothing about the past quarter, nothing about dropouts, and nothing proving the history was not rewritten.
Time Evidence produces what is missing: a history measured by an instrument that is not the audited server, qualified under a published method, and sealed when it is issued.
What you receive
One report per month
Issued around the 15th of the following month. Verdict on page one: quality of the observed time, quality of the instrument, coverage of the collection. Plus on-demand reports for any period you choose.
Sealed, verifiable without trusting us
OpenPGP signature, RFC 3161 timestamps from two external authorities, and an OpenTimestamps proof. Your auditor checks for themselves that the report has not changed.
Attributed incidents
An outage on our side, a network cut or a drift of your server are never mixed up. You declare your maintenance windows and they are excused in the report.
Alerts and a customer portal
E-mail alert when a server leaves tolerance. Targets, incidents and reports are managed from the RDEM customer portal.
A real report, not a mock-up
August 2026 report — ntp-1.rdem-systems.com (Cloud Evidence mode)
A report issued under real conditions during the beta, on 15 September 2026, for one of our own servers: 34 pages (in French), with its incidents and its limits. Verdict: 99.9 % of measurements within the ±50 ms tolerance, 100 % collection coverage, qualified instrument, "high" defensibility, and two incidents attributable to the target, documented.
And its seals, to verify it yourself:
OpenPGP signature ·
DigiCert timestamp ·
Sectigo timestamp ·
OpenTimestamps proof.
Fetch the public key separately from
pkg.rdem-systems.com:
gpg --verify report.pdf.asc report.pdf. The full procedure is on the last page
of the report.
And a probe inside the network: August 2026 report — ntp-12.rdem-systems.com (appliance mode)
Same method, measured this time from the inside: a probe installed next to the server, which also serves time. This is the Appliance + NTP server offer: the report contains the consumption appendix (more than 3 million client addresses observed in August). The 20 client IP addresses in that appendix are masked: this redacted copy is therefore no longer the sealed document, and its signature does not apply to it.
Three ways to measure
Cloud Evidence
- For your NTP servers reachable from the Internet (public IP).
- Several RDEM probes, at distinct operators, observe them from the outside.
- An incident is only recorded if a majority of probes sees it: losing one probe does not create a false incident.
- NTP and NTS: two distinct measurement series per NTS server, with certificate tracking.
- Sealed monthly report, e-mail alerts.
Appliance
- For your internal NTP servers, invisible from the Internet.
- An appliance: a Go binary to run on Debian 13 with Chrony (VM or physical server) in your LAN, enrolled from the customer portal. It only needs outbound access: HTTPS to our API, NTP (UDP/123) to public references.
- Up to 10 internal NTP servers monitored, compared with each other and with heterogeneous public references.
- Only IP addresses and measurements reach us, never your inventory or host names.
- Sealed monthly report, e-mail alerts.
Appliance + NTP server
- Everything the Appliance does.
- The appliance also becomes one of the NTP servers of your estate — never the only one.
- It logs its NTP clients: IP address, first and last request, request count.
- You prove that your devices really use your time servers: hashed CSV appendix attached to the report.
- Your devices must also be able to query it over NTP (UDP/123).
Prices exclude VAT, billed monthly. Above 10 public servers the cheapest combination is computed automatically (packs of 10 + single servers). Need a hardware appliance rather than a VM? Write to us: this option is outside the beta.
What the report proves, and what it does not
| It establishes | It does not establish |
|---|---|
| That your servers stayed consistent with several heterogeneous time references, under a published, versioned method (RDEM-TEM-001 v1.5). | That you are "on UTC". We do not certify UTC; for that, see our UTC time traceability audit. |
| That every drift was detected, dated and attributed. | An ISO 27001, PCI-DSS, NIS2 or DORA certification. It is one piece of your file, not the file. |
| That the report has not been modified since it was issued (verifiable by a third party). | Qualified legal value: the timestamps are not eIDAS-qualified. |
These limits are written in every report. We would rather your auditor reads them from us than discovers them. The design story is told in Why we are building Time Evidence.
Join the beta
Free until 31 December 2026, then at the listed price. Businesses only (French SIRET required at this stage). Self-service: after ordering, you activate your account (link valid for 24 hours), sign the contract and register a payment method (card or SEPA direct debit mandate) in the customer portal, and the service activates automatically. All that is left is to declare your NTP servers (Cloud Evidence) or install the appliance.
Is your company already an RDEM customer? Order with the e-mail address of a contact we already have on file. With another address, the order reaches us and we validate it with you, without automatic activation.
A question before ordering? ntp@rdem-systems.com or a 30-minute call.