Create an unforgeable proof of date and time of event

Prove to a controlling authority that the promotional prices implemented comply with the European Omnibus regulation on promotional prices

Record and timestamp product information, at each stage of the supply chain (producer, processor, distributor...)

Prove that an event occurred at a specific date to win a case: damage to a person or property, accident, infringment, etc...

A flexible timestamping solution that adapts to your business needs

Guarantee norm compliance and audit preparation 

Timestamping is the best way to guarantee the regulatory compliance of digital documents, such as invoices, payslips, legal documents, etc...

1 - The client connects to the Vaultinum platform with an API. Once we receive the document, a hash is created

2 -  Vaultinum adds a date & time to the hash and creates a timestamp token

3 -  The client receives the signed hash and the timestamp with the document for archiving

• Sandbox Environment dedicated to testing

• Developer center to support integration

• High performance and scalability by design

• Compliant with the timestamping protocol RFC3161

Timestamping: simple to implement, easy to use 

Do you want to know more about our timestamping solution?

Certified and secure timestamping used to create unforgeable proof of date and time of event. Automated timestamping connected with an API.

Certified timestamping | Vaultinum

Although electronic timestamping is mostly used when electronically signing documents, as you will see today, it is useful in many other areas for proof and traceability purposes. Vaultinum, a trusted third party, regularly provides support to its customers through its reliable, adaptable and secure timestamping system.

I developed a software. How can I protect myself against possible appropriation by a third party? How can I prove that I developed it before a third party?

According to article L111-1 of the Intellectual Property Code, “the author of a work of the mind shall enjoy in that work, by the mere fact of its creation, an exclusive incorporeal property right which shall be enforceable against all persons.” In other words, and subject to fulfilling certain conditions such as originality, copyright protection exists from the moment a work is created and does not require any additional formality, contrary to a trademark or an invention. This remains true throughout the 179 signatory countries of the Berne Convention. 

 In the absence of compulsory registration with an office, it can, however, be difficult to provide proof of the existence and the content of a digital creation on a specific date, that is to say before that claimed by a possible infringer. It is therefore recommended to create a so-called “evidentiary repository” with a trusted third party such as a bailiff, a notary, or Vaultinum. 

Due to its technology involving the use of symmetric and asymmetric encryption algorithms, hash functions/fingerprint creation and electronic timestamping guaranteeing the integrity of the transmitted elements, the deposit made with Vaultinum: 

 materialises the content of the digital creation;

All preparatory documents necessary to file a patent application can also be filed. Indeed, the procedure for filing a patent with a patent granting authority (such as the European Patent Office, the Federal Institute of Intellectual Property in Switzerland, the National Institute of Industrial (INPI) in France, the National Intellectual Property Office in China or the United States Patent and Trademark Office) is a long and complex procedure which very often responds to the rule of "first come, first served". In this context, the evidentiary repository presents several advantages:

It limits the risks of appropriation of an invention by partners and/or third parties;

It affixes a date certain to ideas, projects, preparatory documents, etc. pending validation of a patent application;

It records the results of research (especially laboratory notebooks) as and when discoveries are made so as to preserve prior rights and ensure a fair distribution of rights between employees;

It proves that an invention kept secret was developed before a third party filed a patent on it, allowing the inventor to continue to use it (right of prior personal possession). 

In accordance with the GDPR, I use the email addresses of prospects to send them offers if I have their prior consent. I also delete this data three years as from the last contact with the individual concerned. In the event of a CNIL control, how can I prove my compliance with the GDPR?

In cases where the legal basis for processing is consent, the data controller must be able to demonstrate that the data subject has given consent to the processing of personal data concerning them.[1] 

In practice, compliance with this obligation can be complicated as the text does not specify how this evidence can be reported. It is therefore essential for the data controller to be equipped with a tool ensuring the conservation and traceability of the following elements: 

the information communicated at the time of consent; and

if applicable, the date of withdrawal of consent. 

On this point, the French Data Protection Authority (CNIL) indicated, in March 2017, that "the digital timestamping of the indication of consent (by means of a click or a ticked box) and the implementation of a procedure for obtaining consent, duly documented, must be considered as a valid means of establishing proof of consent”.[2] 

Vaultinum offers a reliable, adaptable and secure solution for timestamping and automated archiving thanks to its API. In addition, Vaultinum is a partner of CMP (Consent Management Platform) and as such, ensures the timestamping and, if necessary, the archiving of consent records. 

As a businessperson, I offer discounts on certain items sold on my e-commerce site. Regulations require me to justify the reference price from which the reduction is applied. How can I do this?

The authenticity of discounts offered during promotional operations is assessed with regard to unfair commercial practices (Article L. 121-2 to L. 121-5 of the Consumer Code). Price reduction announcements to consumers are governed by the decree of 11 March 2015.[3] Under article 2 of this decree, sellers are required to indicate, in addition to the announced price reduction, the reference price on the basis of which the announced reduction is calculated. 

Although professionals are free to determine the reference price of their choice (for example, regular price, competitors’ price, recommended price), they must be able to "justify the reality of the reference price on the basis of which the price reduction is announced”.[4] To do this, they may use notes, slips, order forms, sales receipts, catalogues, advertising leaflets or any other documents; all the means of proof first set out in the circular of 7 July 2009 specifying the provisions of the decree of 31 December 2008 (repealed)[5]. However, these means are costly and difficult to execute, especially when price reductions are offered online and repeatedly. They also necessitate tremendous data collection and evidence-based archiving. 

With a view to limiting the impact of these regulations and simplifying the application of price reductions, professionals are recommended to use an automated timestamping tool to ensure the preservation, traceability and integrity of the following elements:

the chosen reference price (example: price applied by a competitor);

the location of the chosen reference price (example: a website page);

the date of application of the chosen reference price. 

The implementation of reliable and recognized means of proof to justify the reference price is all the more important as the General Directorate for Competition, Consumption and Fraud Control (DGCCRF) has for several years now, been closely monitoring online sales and particularly misleading price reduction announcements, as can be seen from its recent surveys.[6] 

Vaultinum provides support to e-commerce companies by offering them a turnkey solution for timestamping and archiving proof related to the applied reference price. Through this adaptable, reliable and secure solution, the e-merchant can connect to an API and thus manage thousands of data at a time, in an automated manner. 

An employee repeatedly logged on to sites expressly prohibited by the company’s IT charter. How can I prove this in a reliable way?

Whether human or technical, each action taken in an IT system is likely to leave tracks which must be recorded. These could be: 

successful connection to an application; 

attempted intrusions into the information system;

The National Information Systems Security Agency (ANSSI) emphasizes that event logs are an essential technical component to manage the security of information systems. However, these can serve as evidence only if the log files reliably connect certain events to a particular point in time. 

To ensure this reliability, events cannot be timestamped through sole use of the computer's internal clock, as this is easily falsified and deviates naturally over time. The ANSSI first recommends synchronizing the clocks of IT equipment with several internal time sources that are coherent with each other, themselves synchronized with several reliable external sources.[7] Secondly, a logging system must be set up in accordance with applicable regulations and the recommendations of the CNIL insofar as the main objective of logging is to allow the person or the equipment causing an event to be identified directly or indirectly. Finally, logs must be signed and timestamped as soon as they are created so as to ensure their integrity. 

As a large-scale distributor, I would like to ensure the traceability and transparency of some of my products of animal origin. How can I do this?

Following a number of scandals that testified to a lack of supply chain transparency in the food industry, regulation no. 178/2002 of 28 January 2002 introduced a requirement for food traceability at all stages of production, processing and distribution[8] in order to identify sources of contamination more quickly. 

In terms of supply chain (agro-food, luxury goods, wine, pharmaceutical industry), electronic timestamping and, more generally, timestamping applied to "blockchain" technology (a chain of records keeping track of a set of information, in a decentralized, transparent and secure way), has a real potential to ensure traceability and control of the origin of a product. 

At every stage of the supply chain (producer, processor, distributor), a certain amount of information (dates, origin) concerning a food product, from its manufacture to its sale, will be recorded in a timestamped blockchain register. Depending on the case, the recording on the register could be done either by means of human intervention such as a photograph of the items, or automatically, through the use of connected sensors. Each actor in the supply chain can access the blockchain register to learn the identity of the person who first entered the information, the content of information itself (the integrity of which is guaranteed), and the date of registration of this information. 

And yet, blockchain has its limits. Distributors and other importers need to protect their commercial networks and other trade secrets. The transparency of blockchain prevents this protection, but another solution exists. It consists of validation by a trusted third party by virtue of the presence of secure, timestamped register systems at each stage of the supply chain. 

The same question arises with regard to environmental protection. Soon, food and product traceability will allow for the display of information on the environmental footprint of a product. 

In terms of supply chain (agro-food, luxury goods, wine, pharmaceutical industry), electronic timestamping and, more generally, timestamping applied to "blockchain" technology (a chain of records allowing to keep track of a set of information, in a decentralized, transparent and secure way), has a real potential to ensure timestamping, traceability and control of the origin of a product. 

At every stage of the supply chain (producer, processor, distributor), a certain amount of information (dates, origin) concerning a food product, from its manufacture to its sale, will be recorded in a timestamped blockchain register. Depending on the case, the recording on the register could be done either by means of human intervention such as a photograph of the items, or automatically, through the use of connected sensors.[1] Each actor in the supply chain can access the blockchain register to learn the identity of the person who first entered the information, the content of information itself (the integrity of which is guaranteed), and the date of registration of this information. 

And yet, blockchain has its limits. Distributors and other importers need to protect their commercial networks and other trade secrets. The transparency of blockchain prevents this protection, but another solution exists. It consists of validation by a trusted third party by virtue of the presence of secure, timestamped register systems at each stage of the supply chain. 

In practice, a leading European brand has already chosen blockchain timestamping for its chicken industry. Each actor in the supply chain can enter and timestamp traceability information which is of interest to them, and which will, for the most part, be communicated to the consumer by means of a QR Code[2]. 

Vaultinum provides support to its clients in setting up a timestamping system to date the events registered throughout the supply chain. Using the Vaultinum API, client or blockchain systems can interface with Vaultinum’s timestamping solution and continuously and automatically timestamp thousands of events in a reliable, secure and adaptable manner.

6. Quality assurance and monitoring of document versions

To play it safe, my service provider has put in place a business continuity plan ("BCP") to manage force majeure or crisis situations. This BCP is essential for my business. It is updated every year. How can I be sure that the plan I have is the latest version and that it has not changed?

Business continuity plans (BCPs) have long been required by buyers of products and services. These plans are generally tested and updated annually. They are essential because they provide information on the measures taken to avoid service interruptions on the supplier's side, for example, in the event of unforeseeable events or natural disasters and, and in turn, on the buyer's side. As such, it is essential that tests and updates are timestamped and securely archived in order to maintain documentary evidence over time and ensure the legal protection of all parties concerned.

Vaultinum provides secure and reliable archiving and timestamping services.

Data and information are often submitted online and are sometimes used to generate positions, offers or assessments. In order to avoid any dispute related to the content of the information submitted and its date of submission, and to guarantee that requests are dealt with properly and within a given timeframe, content should be archived securely and with a timestamp token.

Vaultinum supports banks and insurance companies by offering them a turnkey solution for timestamping and secure archiving of online requests. This adaptable, reliable and secure solution enables the automation of certified timestamping and secure archiving, thanks to the Vaultinum API. 

Invoicing has a number of consequences, particularly in terms of payment deadlines but also with regard to deadlines for taxes and other fees. How can I make sure that I can provide proof of electronic invoicing and the date it was issued/sent?

The digitalization of invoicing processes promises significant efficiency gains and cost reductions. At the tax level, article L 102 B of the French Tax Procedure Code, amended by article 16 of the Amending Finance Law for 2016 allows taxpayers to digitize their paper invoices received and issued and to keep them in digitized format for the fiscal retention period of 6 years. The regulations specify that digitized invoices must meet two conditions; they must be secured to ensure their integrity, and they must be timestamped. 

Although the timestamp can be internal, a timestamp certified by a trusted third party or a qualified timestamp process is essential to avoid disputes, especially since the timestamping of invoices is also used to enforce payment deadlines and calculate late payment penalties. 

Vaultinum has developed an API to which clients can connect to obtain an automated certified timestamp of each document with the additional possibility of secure archiving.

With the digitalization of entire sectors of the economy, certified timestamping will become increasingly important in commercial relations since it will be the best way to demonstrate that an action has been taken. In addition, electronic timestamping does not only affix a date to a document, it also attests to the integrity of the content of the document it dates, which is a definite evidential advantage.

If you would like more information on the services offered by Vaultinum in the area of timestamping, you can contact the legal department at the following address: legal@vaultinum.com.

Contact us for more information our our Timestamping solution

[1] Regulation (EU) 2016/679 of April 27, 2016 on the protection of individuals with regard to the processing of personal data and on the free movement of such data and repealing Directive 95/46/EC, art. 7.

[2]Commission nationale de l’informatique et des libertés, Consultation publique sur le règlement européen, mars 2017.

[3] Decree of 11 March 2015 relating to price reduction announcements to consumers.

[5] Circulaire du 7 juillet 2009 concernant les conditions d’application de l’arrêté du 31 décembre 2008 relatif aux annonces de réduction de prix à l’égard du consommateur, p. 6.

[6] Communiqué de presse, Pratiques commerciales des enseignes de vente en ligne : la DGCCRF a transmis à l’autorité judiciaire les conclusions de ses investigations concernant le site vente-privee.com, 10 janvier 2019.

[7] Agence nationale de la sécurité des systèmes d’information, Note technique – Recommandations de sécurité pour la mise en œuvre d’un système de journalisation, 2 décembre 2013.

[8] Regulation (EC) No 178/2002 of the European Parliament and of the Council of 28 January 2002 laying down the general principles and requirements of food law, establishing the European Food Safety Authority and laying down procedures in matters of food safety, art. 18.

[9] Etude réalisée par Blockchain Partner, Supply Chain, Traçabilité & Blockchain, 10 juillet 2017.

[10] Dalila BOUAZIZ, Carrefour lance la première blockchain alimentaire d’Europe, E-commerce mag, 6 mars 2018.

Marine is our Marketing Director. She is a branding and brand activation specialist with international experience in BtoB and BtoC.

Marine Yborra

With the digitalization of entire sectors of the economy, certified timestamping has become increasingly important in commercial relations as it is one of the best ways to demonstrate that an action has been taken. 

This article will explore the many areas where electronic timestamping is useful for proof and traceability purposes.

8 different situations where electronic timestamping is useful for proof and traceability purposes in commercial relations

The various uses of electronic timestamping

8 good reasons to use electronic timestamping

The impact of this decision will be unprecedented. 46 countries are part of the European Convention on Human Rights, including all of the European Union countries. More than 600 million people’s human rights are concerned.

Against the back drop of this decision, a fleury of law suits against countries and companies alike will no doubt follow. Countries will implement tough new regulations to meet their international commitments. These regulations and lawsuits will first and foremost target companies.

Companies must proactively look at how they address environmental matters and implement all measures that can be reasonably expected of them. To do so they must identify the gaps between their practices and good practices/regulations, define an environmental action plan and KPIs, implement it and monitor it over the long term.

The international community increasingly acknowledges the link between climate change and fundamental human rights. This is evident in the preamble of the Paris Agreement[1] and endorsed by the UN Human Rights Council (UNHRC). The UNHRC, informed by The Intergovernmental Panel on Climate Change (IPCC)[2], stated that climate change directly threatens a range of human rights, such as those to life, food, housing, development, water, sanitisation, self-determination, health and culture.[3]

In recent years, a growing number of climate change litigation cases have occurred in jurisdictions around the world. At the beginning of 2023, there were 2180 cases underway in domestic courts globally.[4] Thus far, complainants have primarily based their arguments on violations of the right to life, the dignity of the person, privacy, liberty and security, and family and home life.[5] On April 9, 2024, the European Court of Human Rights (ECHR) grand chamber decided on three such cases. In one of these cases, Verein KimaSeniorinnen Schweiz and Others v. Switzerland, the ECHR ruled that the climate change inaction of the Swiss government had violated the human rights of its citizens.

The ECHR Grand Chamber heard Verein KimaSeniorinnen Schweiz and Others v. Switzerland in March 2023.[6] In this case, Swiss association Verein KimaSeniorinnen Schweiz and four women argued that heat waves induced by the climate crisis negatively affected their health and living conditions. The argument stated that Switzerland’s insufficient climate policies breached the right to life and health under Articles 2 and 8 of the European Convention on Human Rights. The application also suggested that the Swiss Federal Supreme Court rejected the case in violation of their right to a fair trial, as stated in Article 6, and that the Swiss authorities failed to provide an adequate remedy in breach of Article 13. The ECHR concluded that there had been violations of the right to privacy and family life, as well as the right to access the court. In its April 9, 2024 decision, the court ruled that regarding climate change, the Swiss Confederation had failed to comply with is duties under the Convention. This is the first verdict from an international court that has ruled on a government’s legal obligations to meet climate change targets under human rights law.

This case has garnered significant international attention, especially from European Council states, who share the same obligation as Switzerland to protect the right to private and family life under Article 8 of the UCHR Convention. This case is expected to inspire a wave of climate litigation across Europe.[7] Already, six other adjourned cases will now be heard by the court in light of this decision. Plaintiffs in these cases have brought action against Norway, Austria, Italy and Germany.[8]

In response to this judgement and in preparation for a new wave of climate litigation, countries are expected to increase environmental regulations dramatically. The ruling sets a precedent that governments are legally obligated to protect their citizens’ human rights from climate change’s adverse and pervasive impacts. Governments will have to re-evaluate climate policy and close the gap between their current climate measures and what science shows is required to protect human rights and limit the risk of legal action. Politicians will need to reprioritize the environment and ensure that such reprioritization is and stays a reality over the long term. Faced with increased legal liability (including commitments to the Paris Agreement and Kyoto Protocol) and public pressure, governmental strengthening of climate policies is inevitable. This may include changes in emission reduction targets, renewable energy incentives and adjustments to fossil fuel extraction and consumption regulations.

A ripple effect on companies operating within the jurisdiction of these nations and beyond is a given. Governments will impose higher standards of sustainable practices and corporate accountability. Criminal liability for failure to act may just be around the corner and company boards need to rethink their position and involvement.

Hence, sustainable development will be incentivised to alleviate legal and reputational risks associated with maintaining practices that are not environmentally conscious. Investors will increasingly exert pressure on companies to disclose and mitigate climate-related harm. More extensive national environmental regulations and increased institutional accountability will mean that investors will consider ESG factors and performance more in investment decisions. In 2023, BlackRock, the world’s largest investment firm, found that already over 85% of investors consider ESG factors necessary in investment decisions.[9] Hence, companies that fail to address climate risks or do not have sustainable goals and practices will likely face divestment or reduced access to investors and capital. Investors themselves will need to go beyond the superficial analysis of ESG factors that they currently undertake to put their minds at rest. Indeed, many are happy to rely on their financial advisors’ reassurance or merely invest in anything that is not qualified “brown”. Investors must undertake better due diligence and revise their views on “brown industries”. In fact, “brown industries” such as mining, cement, shipping, power or the aviation sectors are not only essential but are also those that need the most investments to transition towards more sustainability. It is sustainability progress in those industries that can positively impact climate change the most. 

New tougher regulations lead to more greenwashing

As standards for sustainable practices rise, so does the prevalence of greenwashing in the market. Greenwashing occurs when an organisation makes false or misleading statements about the environmental impact of its products or services. Companies utilise greenwashing to capitalise on the growing demand for environmentally sound practices.[10] The correlation between increased environmental regulations and greenwashing was demonstrated in 2015 after China enacted an Environmental Protection Law (EPL) that placed new institutional pressures on high-polluting companies. Studies found that the EPL exacerbated greenwashing as many firms would not sacrifice profit for the elevated compliance costs of new environmental regulations. Instead, firms inflated ESG scores and misrepresented the use of clean energy, low pollutant emissions and other sustainable practices in external marketing to maintain the support of stakeholders and the government.[11]

In light of the recent EHRC judgement, and the onslaught of environmental regulations expected to follow, greenwashing will be omnipresent in the coming years. In 2022, the Harvard Business Review already reported that 42% of green claims by European companies were disingenuous or deceptive.[12] Many “independent” third party “scoring” organizations are either complicit in this by implementing scoring tools that only scrape the surface of a company’s ESG situation or by not offering tools able to identify relevant gaps and effectively evaluating performance.

For investors, greenwashing can and will increasingly lead to penalties, reputational harm and a profound impact on the share price of the company being invested in.[13] Governments worldwide, including in the EU and the US Federal Trade Commission, have enacted stricter regulations (such as the European Green Deal) to mitigate greenwashing. Companies charged with greenwashing face serious legal repercussions, including lawsuits and fines. In France, violating the Climate and Resilience Law[14] and falsely advertising environmental achievements can result in heavy fines and prison sentences.[15] Further, greenwashing poses significant reputational risks. Companies accused or charged with greenwashing damage the trust of their clientele, investors and employees. Greenwashing can also lead to costly product recalls and strained relationships with partners and suppliers – impairing the operations and prospects of the company.[16] With the EHRC decision, more regulations will undoubtedly see light and companies may well risk closure if they fail to meet them.

Due Diligence as a tool for governments, investors and companies alike

Regulations multiply. Greenwashing is becoming increasingly harder to detect as emissions science limitations and questionable “ratings” tools facilitate the use of smokescreens and funhouse mirrors.

Investors and companies should and can no longer rely on their knowledge of buzzwords to identify disingenuous environmental claims.

On the one hand, it is essential that companies present a truthful picture of their ESG situation, goals, action plans, KPIs and achievements or areas of needed improvements. On the other hand, Investors must look at companies for their potential rather than for what they are. Brown industries for example are essential to society and can transition towards sustainability whilst continuing to provide value.

Continuous, due diligence tools help both companies and investors in ensuring that they are pro-active in their assessments over time. ESG is not a one-off effort. It has to be continuous and involves short, medium and long-term goals and milestones setting, ongoing monitoring and evaluations against predefined KPIs, and honest acknowledgments and reviews of failures and successes to implement lessons learned. 

Vaultinum, a trusted independent and impartial third party, has developed such due diligence tools to help companies meet accountability expectations and investors make informed decisions.

Contact us for more information on our ESG Audit

[1] Mayer, B. (2016). Human rights in the Paris Agreement. Climate Law. https://www.benoitmayer.com/files/Human%20rights%20in%20the%20Paris%20Agreement.pdf [2] Data — IPCC. (n.d.). IPCC. https://www.ipcc.ch/data/ 

[3] OHCHR. (n.d.). OHCHR and climate change. https://www.ohchr.org/en/climate-change/

[4] Climate lawsuits are on the rise. This is what they’re based on. (2023, August 9). State of the Planet. https://news.climate.columbia.edu/2023/08/09/climate-lawsuits-are-on-the-rise-this-is-what-theyre-based-on/#:~:text=According%20to%20the%20report%2C%20the,in%20the%20United%20States%20alone. 

[5] Warnock, C. A., & Preston, B. (2023). Climate change, fundamental rights, and statutory interpretation. Journal of Environmental Law, 35(1), 47–64. https://doi.org/10.1093/jel/eqad002 [6] KlimaSeniorinnen v Switzerland (ECtHR) - Climate Change Litigation. (2024, April 9). Climate Change Litigation.https://climatecasechart.com/non-us-case/union-of-swiss-senior-women-for-climate-protection-v-swiss-federal-council-and-others/ 

[7] Kaminski, I. (2024, April 13). Strasbourg court’s Swiss climate ruling could have global impact, say experts. The Guardian. https://www.theguardian.com/law/2024/apr/13/swiss-climate-ruling-global-impact-european-court-human-rights#:~:text=Experts%20believe%20the%20latest%20ruling,in%20place%20good%20climate%20governance.

[8] Frost, R. (2024, April 10). ‘Historic’ European Court of Human Rights ruling backs Swiss women in climate change case. Euronews. https://www.euronews.com/green/2024/04/09/top-european-human-rights-court-could-rule-that-governments-have-to-protect-people-from-cl 

[9] The rise of ESG investing: A game changer for financial markets. (2024, March 6). Acuity Knowledge Partners. https://www.acuitykp.com/blog/the-rise-of-esg-investing/#:~:text=ESG%20investing%20is%20helping%20to,2022%20from%20200%20in%202015.

[10] Hayes, A. (2024, January 22). What is greenwashing? How it works, examples, and statistics. Investopedia. https://www.investopedia.com/terms/g/greenwashing.asp#:~:text=Greenwashing%20is%20an%20attempt%20to,are%20environmentally%20conscious%20or%20friendly. 

[11] Zhang, Y., Chen, S., Li, Y., & Ramos, D. L. (2024). Does Environmental Protection Law Bring about Greenwashing? Evidence from Heavy-Polluting Firms in China. Sustainability, 16(5), 1782. https://doi.org/10.3390/su16051782 

[12] Ioannou, I. (2022, July 21). How greenwashing affects the bottom line. Harvard Business Review. https://hbr.org/2022/07/how-greenwashing-affects-the-bottom-line 

[13] Green is not always clean: Rising tide of greenwash brings risks for investors. (2021, May 19). https://www.avivainvestors.com/en-gb/views/aiq-investment-thinking/2021/05/greenwashing-risk/ 

[14] Loi n° 2021-1104, Climat et Résilience, August 22, 2021.

[15] FRANCE: Update on “Greenwashing” regulation | World Law Group. (2022, June 5). https://www.theworldlawgroup.com/news/advertising-and-the-environment-update-on-greenwashing-regulation 16 Team, T. (2023, March 10). What is Greenwashing? Why Should Large Enterprises Care? Terrascope. https://www.terrascope.com/blog/what-is-greenwashing-why-should-large-enterprises-care

Jean Albert is a registered attorney specializing in international law and is the Chair of Vaultinum’s Strategy and Legal Commissions.

Jean Albert

A recent decision by the European Court of Human Rights will have broad repercussions on how companies and countries tackle climate change. Indeed, in deciding that Switzerland, a country not usually associated with poor environmental, social and governance (ESG) performance, had violated the Human Rights of its citizens by failing to meet its international commitments, the Court has dealt a blow to countries that believe they can deprioritize the environment as they see fit. In short, greenwashing is no longer sufficient to satisfy the courts.

This article will analyze the impacts of this decision, and the challenges that arise for governments and companies. 

Discover the implications of a recent European Court of Human Rights ruling on climate change accountability. Dive into the repercussions for nations and corporations, and explore the evolving landscape of ESG governance in the wake of this landmark decision.

ESG and new regulations to come

Companies Re-Assess their Environmental Stance as New Stringent Regulations Loom

Code quality is synonymous with software that is maintainable, efficient, reliable, and secure.  For a programmer, high quality code means, in its simplest form, source code that can be understood quickly.   
For a company or investor, high quality code represents a strategic asset that underpins operational efficiency, market agility, and financial stability. It signifies a software foundation that not only meets current needs but is also poised for future growth and adaptation, ensuring the company's long-term competitiveness and profitability. 

Google is a prime example of a high quality code company known for its robust, scalable and efficient code. Google's engineering practices are widely respected, and its commitment to high quality source code has been a key factor in its ability to scale its services and maintain leadership in search, advertising, and various other tech domains.   

Github is another example.  As a platform hosting millions of code repositories, GitHub not only provides tools for code management but also maintains high standards for its own codebase. Its acquisition by Microsoft was seen as a testament to its value, driven in part by the quality of its platform. 

On the other hand, the Boeing 737 Max is a prime example of poor code quality. The software issues which led to two fatal crashes, are an example of the catastrophic consequences of poor code quality [1]. This not only resulted in a significant financial loss for Boeing but also severely damaged its reputation and investor confidence.   

Organisations might compromise source code quality for various reasons. Many startups in their early stages often focus on rapid development and feature rollout, which can lead to compromised code hygiene. In more established companies, it could be a strategic decision to expedite the release of a feature, or it might occur when the business's needs evolve, rendering the existing design obsolete or inadequate. In some cases, the initial design might have been flawed from the beginning. 

Regardless of the underlying cause, the consequence of neglecting code quality is consistent: the organisation is left with a codebase that is more challenging and costly to maintain than it ought to be. This situation necessitates extra resources for ongoing maintenance, potentially leading to increased operational costs and impacting the software's adaptability and efficiency in the long term. 

The Business Case for Investing in Code Quality 

Investing in high-quality code is not just a technical decision but a strategic business choice. The benefits extend beyond the IT department, impacting customer satisfaction, operational efficiency, and the overall financial health of the business. 

Impact on EBITDA: A significant portion of a developer's time, estimated to be between 23-42%, is often consumed in managing technical debt and rectifying poor source code[2]. This inefficiency leads to inflated operational costs and diminished productivity, adversely affecting EBITDA. Low-quality code not only escalates software maintenance expenses but also necessitates increased resource allocation for bug fixes and prolongs product development cycles. Conversely, high quality code can dramatically reduce these overheads, enhancing the company’s financial performance. 

Synergy Generation in M&A: When companies merge, the integration of systems and software is a critical factor. High quality code enhances this integration process, making it smoother and more cost-effective. This directly contributes to the realisation of synergies post-merger, as well-executed integrations are less likely to encounter costly delays and technical setbacks.  

Quantitative Impacts: Research has quantitatively linked code hygiene to business performance. Studies indicate that low-quality code harbours up to 15 times more defects than high quality code[3]. Resolving issues in such code demands considerably more effort, taking about 124% longer in development[4]. This inefficiency not only adds unpredictability to project timelines but also imposes a substantial drain on resources.  

In summary, code quality should be viewed by investors not as a mere technical detail but as a vital component of a company's operational efficacy and growth trajectory. Its influence extends well beyond the confines of software development, shaping key financial metrics and overall business health and competitiveness. For savvy investors, recognising the strategic importance of code hygiene is essential in evaluating a company’s long-term viability and success. 

Assessing Code Quality: A Dual-Faceted Approach 

To assess code quality effectively, it’s essential to leverage the distinct yet complementary insights provided by Git history analysis and automated source code scans. Together, these methods offer a comprehensive evaluation of both the development process and the current state of the codebase. 

The examination of Git history delves into the development practices and team dynamics. It reveals the patterns and frequencies of commits, which illuminate how the team collaborates and distributes work. This history provides a narrative of the code's evolution, showcasing how the team has responded to various challenges and implemented new features over time. It also highlights the individual contributions of team members, offering insights into areas of expertise and code ownership. 

Leveraging Automated Source Code analysis 

In contrast, automated code scans focus on the current state of the codebase. These tools perform a thorough analysis against a range of quality metrics, identifying issues such as security vulnerabilities, performance bottlenecks, and potential bugs. They also assess maintainability by detecting duplicate code and areas that lack sufficient testing. This aspect of the assessment is critical for understanding the immediate technical health of the project. 

Integrated Approach for Comprehensive Assessment 

Combining these approaches provides a comprehensive view of both the process (how the team works and manages the code) and the product (the quality and state of the code itself). This holistic assessment is key to uncovering not just the technical issues but also the underlying patterns and trends in the development process. It enables a nuanced understanding of the project's overall health and trajectory. 

For investors, this dual approach offers a nuanced understanding of the technological potential of the company they are evaluating. It goes beyond surface-level analysis, allowing them to make informed decisions based on both the operational and technical facets of the company's software development practices. 

Cybersecurity in Code Quality: Beyond Risk Mitigation 

A discussion on source code quality would not be complete without addressing cybersecurity. Security in code refers to the measures and practices put in place to protect software from malicious attacks and unauthorised access. This includes writing code that is not only functional but also secure against known vulnerabilities, such as SQL injection, cross-site scripting, and buffer overflows. 

To ensure the security and sustainability of an investment, a thorough examination of the company's cybersecurity measures is a strategic necessity. This includes an in-depth analysis of the organisation's approach to security, verifying adherence to secure coding best practices, and the implementation of robust security protocols. Essential to this process are regular penetration testing, or pen testing, comprehensive security audits, and the prompt application of security patches and updates.  

The future of an investment hinges not only on its potential earnings but also on its ability to mitigate losses and risks. A breach due to vulnerable code can have far-reaching consequences, including regulatory fines, legal liabilities, loss of customer trust, and significant remediation costs.  In this way, evaluating cybersecurity is not just about averting threats but also about preserving and enhancing the long-term worth of the investment. 

Harnessing Code Quality for Informed Investments 

In conclusion, code quality assessment is not a mere formality but a critical component of investment strategy, offering deep insights into the potential risks and rewards associated with a prospective investment. By employing a team of experts skilled in examining Git history and conducting automated source code analysis, investors can gain an objective and all-encompassing view into the technological infrastructure of a target company.  

These experts are not just evaluating lines of code; they are delving into the very DNA of the company's technological capabilities and practices. Their analysis provides a 360-degree view, encompassing everything from the operational dynamics of the development team to the security posture and overall code hygiene. This thorough approach ensures that investors are not just basing their decisions on surface-level information but are empowered with a detailed understanding of the technical robustness and future potential of their investment.  

Contact us for more information on our Source Code Scan

[1] https://spectrum.ieee.org/how-the-boeing-737-max-disaster-looks-to-a-software-developer (last visited 31 January 2024).

2 https://www.infoq.com/articles/business-impact-code-quality/ (last visited 31 January 2024) 

https://www.infoq.com/articles/business-impact-code-quality/  

https://stackoverflow.blog/2021/10/18/code-quality-a-concern-for-businesses-bottom-lines-and-empathetic-programmers/  

https://www.thestack.technology/code-quality-the-overlooked-indicator-of-a-well-run-software-business/ 

Kristin is a registered US attorney specializing in the areas of IP and technology law. She is a member of Vaultinum’s Strategy and Legal Commissions charged with overseeing and implementing the policies and processes related to the protection of digital assets.

Kristin A.

Understanding the quality of code within a company's tech portfolio is an essential aspect of assessing a company’s long-term value and stability. This article delves into the multifaceted concept of code quality,or code hygiene, exploring its relevance to financial performance, operational efficiency, and investment decision-making. 

Learn more about the importance of assessing code quality in an acquisition process through a source code scan

What is code quality and why is it important?

The unique challenges of Technical Due Diligence for startups

Unlike established companies with a proven track record, startups may not have sufficient operating history to demonstrate their technical prowess. This can make it challenging for investors to assess the viability of the startup's technology and predict its future performance. In such cases, a thorough Technical Due Diligence process is crucial to identify any potential weaknesses and ensure that the startup has the necessary resources to scale its operations.

Startups often experiment with various business models to find the right product-market fit. As a result, their technology stack might be continuously evolving to accommodate these changes. During Technical Due Diligence, it's essential to evaluate whether the company's current technology can adapt to different business models and market demands.

Startups typically have fewer resources to protect their IP compared to established companies. Ensuring that a startup has a solid IP protection strategy in place is an essential aspect of Technical Due Diligence. This includes evaluating the company's patents, trademarks, copyrights, and source code protection, as well as assessing the risk of potential infringement claims.

How Technical Due Diligence benefits startups and emerging companies

Technical Due Diligence plays a crucial role in the success of startups and emerging companies, providing both short-term and long-term benefits. It can help identify potential risks, validate technological capabilities, and ultimately build investor confidence. Let's take a look at some specific ways Technical Due Diligence can benefit startups and emerging companies, along with real-life examples.

Technical Due Diligence helps identify potential risks and vulnerabilities within a company's technology stack. This can range from security concerns to performance limitations or scalability issues. By addressing these risks early on, startups can avoid costly mistakes and ensure a more stable foundation for growth.

For example, several years ago the cloud storage company Dropbox suffered a significant security breach, exposing users' personal information. The incident highlighted the importance of thorough security assessments during Technical Due Diligence. By identifying and addressing potential vulnerabilities beforehand, startups like Dropbox can avoid reputational damage and loss of user trust.

A robust Technical Due Diligence process can instill confidence in potential investors by validating the startup's technology, IP protection, and development processes. This can lead to increased investment opportunities and higher valuations.

In 2014, when Facebook acquired the messaging app WhatsApp for $19 billion, part of the justification for the high valuation was the results of the Technical Due Diligence process. It confirmed the scalability, security, and performance of WhatsApp's technology, making it an attractive investment.

Technical Due Diligence can uncover unique technological features or proprietary innovations that give the startup a competitive advantage in the market. This can help the company differentiate itself from competitors and create a strong value proposition for customers and investors alike.

When Google acquired DeepMind in 2014, one of the driving factors behind the acquisition was DeepMind's cutting-edge AI technology. The Technical Due Diligence process confirmed the innovative nature of DeepMind's algorithms, which later enabled Google to develop its industry-leading AI products and services.

Thorough Technical Due Diligence can help startups establish strategic partnerships with other companies, suppliers, or service providers. These partnerships can provide access to new markets, resources, and technologies, accelerating the startup's growth

In 2010, electric vehicle manufacturer Tesla entered a partnership with Toyota after the latter conducted extensive Technical Due Diligence on Tesla's battery and powertrain technology. This partnership enabled Tesla to access Toyota's resources and expertise while validating the quality of its technology to other potential partners and investors.

Technical Due Diligence is a critical process for startups and emerging companies, helping to mitigate risks, attract investment, gain a competitive advantage, and establish strategic partnerships. By conducting thorough Technical Due Diligence, startups can ensure they have a solid technological foundation to support their growth and long-term success.

However, while the fundamental goal of Technical Due Diligence remains the same for both startups and established companies, there are distinct differences in the process and the factors that need to be considered. For startups, the focus lies on evaluating the adaptability of their technology stack and ensuring adequate IP protection. On the other hand, established companies require a more in-depth assessment of their complex technology infrastructure, legacy systems, and the impact of mergers and acquisitions on their technological capabilities.

Vaultinum's Technical Due Diligence solution has been employed by companies of all sizes, offering a comprehensive approach to evaluating a company's technology. Our unique proprietary source code scanning methodology utilises data analysis from 10 scanners, ensuring an in-depth assessment of your codebase. We also analyse human capital, assessing the IT team's ability to share knowledge and execute the technology roadmap effectively. Additionally, our evaluation of the full architecture and infrastructure ensures that your systems are secure, reliable, and scalable to support future growth. 

Finally, we examine the alignment of your technology with your business strategy, verifying that your technology roadmap and investments have the potential to drive significant value. Trust Vaultinum to provide a thorough and reliable Technical Due Diligence process for your startup or emerging company, helping you navigate the challenges and unlock the full potential of your technology.

NEED HELP FOR A TECHNICAL DUE DILIGENCE ?

The opinions, presentations, figures and estimates set forth on the website including in the blog are for informational purposes only and should not be construed as legal advice. For legal advice you should contact a legal professional in your jurisdiction.

The use of any content on this website, including in this blog, for any commercial purposes, including resale, is prohibited, unless permission is first obtained from Vaultinum. Request for permission should state the purpose and the extent of the reproduction. For non-commercial purposes, all material in this publication may be freely quoted or reprinted, but acknowledgement is required, together with a link to this website.

Philippe is the CEO of Vaultinum. An expert in new technologies and high finance, and after 20 years in the international fintech industry, Philippe now heads Vaultinum.

Philippe Thomas

Technical Due Diligence is a critical process for assessing the technological capabilities and potential risks of a company before making investment decisions. It involves evaluating the company's software, hardware, intellectual property, and overall technical competency. While Technical Due Diligence is essential for businesses of all sizes, there are some key differences when it comes to startups and emerging companies compared to their larger, more established counterparts. This article will explore the unique challenges of Technical Due Diligence for startups and explain why the process is important for investors and stakeholders.

Explore the importance of Technical Due Diligence for startups and emerging companies, and the benefits it brings in attracting investments and ensuring success.

Tech Due Diligence: why is it beneficial for Startups and Emerging Companies

Technical Due Diligence for startups and emerging companies

Determine the scope of the Tech Due Diligence

The first step in conducting a tech due diligence is to determine the scope of the Due Diligence. This involves understanding the business goals of the software company, the type of software they develop, and the technologies they use. This information will help you identify the areas that need to be reviewed during the Due Diligence process.

Review the software code and infrastructure

Once you have determined the scope of the Tech Due Diligence, the next step is to review the software code and infrastructure. This involves examining the software architecture, the software source code, the coding practices, the development processes, and the deployment practices of the software company. It is also important to review the infrastructure that supports the software, including the servers, databases, and networks. 

Are you looking to invest in a software company? Learn how to conduct a thorough tech due diligence process to ensure your Tech investment is secure. Our guide for legal and tech professionals covers everything you need to know.

Certified Timestamping

A flexible timestamping solution that adapts to your business needs

Prove promotional price compliance

Ensure supply chain traceability

Provide proof of event

Guarantee norm compliance and audit preparation

Do you have another need?

How does timestamping work?

Timestamping: simple to implement, easy to use

Do you want to know more about our timestamping solution?

Certified Timestamping

A flexible timestamping solution that adapts to your business needs

Prove promotional price compliance

Ensure supply chain traceability

Provide proof of event

Guarantee norm compliance and audit preparation

Do you have another need?

How does timestamping work?

Timestamping: simple to implement, easy to use

Do you want to know more about our timestamping solution?

Related articles