Gate 1 · Identity
Finance approver · verified
Gate 2 · Rule
Release policy v3.2
Evidence receipt
who: finance.approver.07 · rule: release-policy v3.2 · time: 10:42:07.118 · fingerprint: 9f3a…c41e · anchored ✓Evidence feed
Every event checked and proven the second it happens. Two seconds to final proof.
Reltime plugs into what you already run, API to API. Everything flows as it does today.
Your external auditor verifies continuously, straight against the proof, without access to your systems.
SOX, SOC 2 and customer audits stop being evidence hunts. The proof already exists when the question comes.
Decision, role and rule version proven in the moment. Nobody reconstructs a timeline under deadline.
Deviations alert before they become incidents. Anything without approval is stopped.
Since 18 Dec 2023
In forceMaterial cyber incidents disclosed within four business days of the materiality determination.
Incident timeline and the materiality decision anchored with who decided, when and on what facts. The four-day clock becomes provable.
SourceAudit-trail alternative since 3 May 2023
In forceElectronic records kept with a complete time-stamped audit trail of every modification and deletion.
Every record change anchored with identity and time as it happens. Alterations raise an alert at once.
SourceFully phased in 1 Nov 2025
In forceMFA, asset inventory, incident notice within 72 hours and an annual compliance certification signed by the CEO and CISO.
Controls, incidents and exceptions on record in real time. The signatures on the certification rest on proof.
SourceOngoing
In forceIT general controls over change management and access, tested by the external auditor every year.
Every change and access grant tied to approval and role. The auditor verifies the receipt without access to your systems.
SourceBreach notice since 13 May 2024
In forceNon-bank financial institutions notify the FTC within 30 days of a breach affecting 500 or more consumers.
Detection, scope and decision steps anchored as they happen. The 30-day notice is drafted from the proof.
SourceOngoing
In forceControlled access, authority checks, individual accountability and signature controls for regulated electronic records.
Each record and signature bound to identity, role, time and version. Any later change breaks the match and alerts.
SourceFull obligations since 6 Oct 2025
In forceRestricted transactions involving bulk sensitive data need a compliance program, due diligence, audits and records.
Every data transfer checked before release and anchored with counterparty, rule and approval.
SourcePhase 1 since 10 Nov 2025 · Phase 2 paused
PhasedDefense contractors handling controlled information prove their security level before award.
Control evidence for self-assessments anchored continuously, ready for the next assessment phase.
SourceOngoing
In forceGrid operators prove access control, supply chain risk management and monitoring of critical cyber assets.
Access, changes and supplier evidence anchored per asset. Operator and supplier see the same receipt.
SourceSince 18 Dec 2023
In forceMaterial cyber incidents disclosed within four business days of the materiality determination.
Incident timeline and the materiality decision anchored with who decided, when and on what facts. The four-day clock becomes provable.
SourceAudit-trail alternative since 3 May 2023
In forceElectronic records kept with a complete time-stamped audit trail of every modification and deletion.
Every record change anchored with identity and time as it happens. Alterations raise an alert at once.
SourceFully phased in 1 Nov 2025
In forceMFA, asset inventory, incident notice within 72 hours and an annual compliance certification signed by the CEO and CISO.
Controls, incidents and exceptions on record in real time. The signatures on the certification rest on proof.
SourceOngoing
In forceIT general controls over change management and access, tested by the external auditor every year.
Every change and access grant tied to approval and role. The auditor verifies the receipt without access to your systems.
SourceBreach notice since 13 May 2024
In forceNon-bank financial institutions notify the FTC within 30 days of a breach affecting 500 or more consumers.
Detection, scope and decision steps anchored as they happen. The 30-day notice is drafted from the proof.
SourceOngoing
In forceControlled access, authority checks, individual accountability and signature controls for regulated electronic records.
Each record and signature bound to identity, role, time and version. Any later change breaks the match and alerts.
SourceFull obligations since 6 Oct 2025
In forceRestricted transactions involving bulk sensitive data need a compliance program, due diligence, audits and records.
Every data transfer checked before release and anchored with counterparty, rule and approval.
SourcePhase 1 since 10 Nov 2025 · Phase 2 paused
PhasedDefense contractors handling controlled information prove their security level before award.
Control evidence for self-assessments anchored continuously, ready for the next assessment phase.
SourceOngoing
In forceGrid operators prove access control, supply chain risk management and monitoring of critical cyber assets.
Access, changes and supplier evidence anchored per asset. Operator and supplier see the same receipt.
SourceDecisions are made locally and anchored afterwards. Personal data stays off the network. Nodes are placed where your rules require.
Information that holds up in a defence setting.
Reltime has delivered the Governed Verification Layer to NEWSROOM.
ProjectsNEWSROOM is funded by the European Union under the European Defence Fund, grant agreement 101121403. Views expressed are those of Reltime AS only.
Integrity proven without patient data on the network.
Reltime has delivered the Governed Verification Layer to COMFORTage.
ProjectsCOMFORTage is funded by the European Union under Horizon Europe, grant agreement 101137301. Views expressed are those of Reltime AS only.
Asset-backed investment with identity and evidence built in.
ProjectsMap the obligation and connect the first system
Configure the workflow, roles and alerts
Test and review with your counsel or auditor
Run and deliver the first evidence pack
Dates reflect public sources as of October 2026. Rules marked Coming are proposals or pending final text.
