Guardtime, the EIC Accelerator and the Promise of Log Integrity

For more than a decade Guardtime was the company Estonia pointed to when it explained how a state can prove its data has not been tampered with. Its KSI blockchain, a system of hash chains that fixes when a piece of data existed and in what form, was a qualified eIDAS trust service for time-stamping, and the company named the European Space Agency, the World Health Organisation and drug makers such as Roche and AstraZeneca as partners, according to e-Estonia. In the EIC SME Instrument Phase 2 round of 5 June 2019, the forerunner of today's EIC Accelerator, the EU backed a project called TNT, short for Truth-not-Trust, to turn that technology into TrueTrail, a product that proves an organisation's logs have not been altered. Guardtime is listed as the project's only beneficiary in the European Commission's list of winners.

Seven years on, little of that company is left in Estonia. GuardTime OÜ reported one employee in the first and second quarters of 2026, down from 114 in the second quarter of 2020, according to Tax and Customs Board data published by Inforegister. It handed back its licence for the qualified KSI time-stamping service in June 2025. Its Swiss parent, Guardtime SA, was dissolved by a Lausanne court in May 2026, according to the Swiss commercial register (Zefix).

Where Guardtime Stands Now

The Estonian company that received the grant still exists on paper. The e-Business Register lists GuardTime OÜ as entered into the register, with no insolvency proceedings. It also shows that the annual report for 2025, due on 30 June 2026, has not been submitted and that the registrar has begun supervision. Inforegister shows tax arrears of €34,947.82 on 10 April 2026, cleared by 29 May 2026, and no tax debt since.

The business itself has almost stopped. Taxable turnover fell from €2.37 million in the second quarter of 2024 to €222,218 in the first quarter of 2026 and €31,776 in the second, Inforegister's tax data show. The company's website, guardtime.com, did not resolve on 8 October 2026; the Internet Archive last recorded it as online in May 2026. Whether GuardTime OÜ still serves any customer could not be verified, so this article records its status as unknown rather than closed.

The parent company is further along. On 20 May 2026 a judge of the Lausanne district court dissolved Guardtime SA under article 731b of the Swiss Code of Obligations, which applies when a company's organisation is deficient, and ordered its liquidation under the rules for bankruptcy; the company's name became "Guardtime SA en liquidation", according to the notice published on 16 June 2026 and shown in Zefix. The same register shows that long-time chief executive Michael Gault, recorded as living in Abu Dhabi from January 2025, left the board in October 2025, and that the auditor resigned in January 2026.

An Ownership Story That Does Not Add Up

Guardtime was sold in 2023 to an investment firm linked to the ruling family of the United Arab Emirates for €18 million, according to a Dealroom news item, and an Estonian headline aggregated by uudis.net describes it as having "moved into the hands of an Emirati firm". The buyer is not named in any source that could be opened for this article, and the price and date could not be checked against a filing. The Estonian defence industry directory now describes Guardtime as "headquartered in Abu Dhabi, UAE".

The registers tell a partial and not fully consistent story. The Estonian e-Business Register still names Michael Gault as the beneficial owner of GuardTime OÜ, through "control or influence through other means", a record last updated on 27 June 2025. The Swiss register, in turn, records only that Gault and another board member, Richard Budel, had moved to Abu Dhabi and Dubai by January 2025. Who controls Guardtime today is not public.

The Technology: Proof That a Log Was Not Touched

Every action in an IT system leaves a log, and attackers who break in usually edit those logs to hide what they did. Conventional defences protect logs with access controls or digital signatures based on public-key infrastructure, which depend on keys and administrators that can themselves be compromised. Guardtime's approach was to hash each log entry and anchor the hashes in its KSI blockchain, so that anyone can later check, without trusting Guardtime or the log owner, that an entry existed at a given time and has not changed since.

TrueTrail was the product built on that idea. Its CORDIS objective promised "massive scale automated and independent log integrity assurance", real-time integrity checks and the detection of "currently hidden log manipulations". During the project the company widened the pitch from audit-trail authenticity to what it called "continuous compliance attestation": recording every change to systems, access lists and databases as it happens, so that an auditor can check compliance at any moment instead of once a year, according to the project's CORDIS report.

What the EIC Grant Promised, and What CORDIS Shows

The grant agreement was signed on 7 February 2020. CORDIS lists an EU contribution of €1,885,857 towards a total cost of €2,694,082.50, with the project running from 1 March 2020 to 31 August 2022. The objective was to launch TrueTrail "to global markets", build "a highly scalable business model", shorten sales cycles, target new customer segments and "achieve commercial independence and technological freedom".

Only one report is public. It is labelled the report for the second period, March 2021 to August 2022, but its text says "we are half-way through the project" and describes much of the work as still to come. It records a modular log-signing foundation with a unified KSI signature format, partial work on automated verification, an early end-user dashboard, a TrueTrail web page and "tens of potential customer meetings". It says the pandemic had hurt business development. CORDIS publishes no final results for the project.

The one named customer was SMIT, the IT and development centre of Estonia's Ministry of the Interior, which needed to prove the integrity of audit trails across about 2,500 services. The CORDIS report describes the SMIT pilot as starting earlier than planned, and PwC Legal advised Guardtime on the resulting partnership, according to CEE Legal Matters. Two further pilots in other sectors were planned for the second period; neither has been named publicly.

1. Verifiable log foundationDeliveredModular signing layer and common log formats, per the CORDIS report.
2. Automated verification intelligencePartial"Definition and partial implementation" only, per CORDIS.
3. Government pilotDeliveredSMIT pilot and partnership, per CORDIS and CEE Legal Matters.
4. Two more pilots in other sectorsNot verifiedNo pilot partner named.
5. Global TrueTrail launchNot achievedNo customers outside Estonia announced; staff and turnover fell from 2024.
6. Commercial independenceNot achievedQualified time-stamping service ended in 2025; parent in liquidation in 2026.

The End of the Trust Anchor

TrueTrail's selling point rested on KSI being a qualified trust service under eIDAS, the EU regulation that gives qualified electronic time-stamps legal weight across member states. On 3 June 2025 GuardTime OÜ notified Estonia's Information System Authority (RIA) that it would stop providing the qualified time-stamping service from noon on 12 June 2025, having told all its contract partners, customers and partners by email on 12 May. RIA's decision of 9 June 2025 revoked its licence, which had been renewed in February 2024 until February 2026, and moved both "Guardtime KSI Time-stamping service (2023)" and "Guardtime KSI ajatempliteenus (2021)" from granted to withdrawn status on the EU trusted list. From that moment every time-stamp Guardtime had issued counted as non-qualified under eIDAS.

The Money

Until 2024 the accounts did not look like a company in trouble. GuardTime OÜ reported revenue of €8.44 million in 2019, between €6.81 million and €8.49 million in each year from 2020 to 2023, and €6.82 million in 2024. It was profitable in its last three filed years, with €784,257 in 2022, €1,117,631 in 2023 and €1,145,109 in 2024, according to the e-Business Register and Inforegister, which puts equity at €9,259,579 at the end of 2023. How a profitable subsidiary with that much equity came to be wound down within two years, and where its business went, is not explained in any public filing found for this article.

Guardtime's earlier private funding is better documented than its recent history. It raised an $8 million Series A in May 2010 from Horizons Ventures, Ambient Sound Investments, Infocomm Investments, FITOne Capital and Joi Ito, TechCrunch reported. Guardtime does not appear in any of the 16 pages of the EIC Fund portfolio, which fits a grant-only award.

Beyond TNT, a CORDIS search returns 16 EU-funded projects that mention Guardtime, mostly cybersecurity and energy consortia such as CRITICAL-CHAINS, CyberSEAS and the Estonian-Czech cybersecurity hub CHESS, which runs to the end of 2026.

Why Europe Should Care

Few fields matter more to the EU's digital rules than the one Guardtime worked in. The NIS2 Directive requires operators of essential services to detect and report incidents, which depends on logs that can be trusted, and the revised eIDAS Regulation, Regulation (EU) 2024/1183, builds Europe's digital identity framework on qualified trust services like the one Guardtime ran. A European supplier of tamper-evident logging, already used by its own government, is the kind of capability the EU says it wants to keep at home.

Guardtime's trajectory shows the limits of a grant in protecting that capability. The EU paid for TrueTrail's development; it had no say over the company's ownership, its move towards the Gulf or the decision to end its qualified trust service. Whether the KSI technology, its patents and its staff now sit outside Europe could not be verified.

The Verdict

Guardtime, its owners and the EIC have not been asked for comment for this article. It is based entirely on public records, company statements and EU project data, linked throughout.