Guide

Bitemporal Claims: How TrustVendor Models What Vendors Promised and When

In a vendor risk system, two timestamps matter for every piece of information: when the event actually happened (valid time) and when the system became aware of it (transaction time). This is the bitemporal model, and it is the difference between a system that can answer "what did this vendor claim on June 1?" and one that can only answer "what do we know about this vendor today?"

What is valid time vs transaction time?

Valid time is the time interval during which a fact is true in the real world. If a vendor held SOC 2 Type II from April 2023 through March 2024, that is the valid time for that fact. Transaction time is when the database learned about the fact. If TrustVendor detected the SOC 2 and stored the claim on May 1, 2023, that is the transaction time. Both timestamps are stored independently, enabling queries like “as of June 15, 2023, what was the valid state of this vendor’s certifications as we knew it then?”

Why does bitemporal modeling matter for compliance?

Compliance programs are retrospective. An auditor reviewing your vendor risk program for the period January–December 2024 needs to know what you knew about each vendor at each point in that period — not what you know today. A system with only current state cannot answer this question. A bitemporal system can replay the exact state of vendor knowledge as of any past timestamp, making audit reconstruction reliable rather than reconstructed from memory and email threads.

How does TrustVendor implement bitemporal claims?

Every claim stored in TrustVendor’s claims table carries four timestamps: valid_from, valid_to (the period the claim is true in the real world), inserted_at, and superseded_at (the period during which this row represented the current knowledge). Claims are never updated in place; they are superseded by new claims. This means the full history of what was known and when is always available without special archival procedures.

Can I query what TrustVendor knew at a specific past date?

Yes. Every posture and assurance score computation in TrustVendor is versioned and replayable. You can query the score for a vendor as it was computed on any past date, and drill into which claims were active at that time, which evidence backed each claim, and which model version produced the score. This replayability is the foundation of the audit trail and the “verify hash” feature in the evidence drawer.

Common questions

Is bitemporal modeling standard in vendor risk tools?
No. Most vendor risk tools store only current state, losing historical claim data when records are updated. This is a fundamental architectural choice, not a feature gap — retrofitting bitemporality into a current-state system requires a complete data model rewrite.
How does bitemporal modeling handle corrections?
If TrustVendor learns that a claim it stored was incorrect — for example, an entity resolution error attributed a certificate to the wrong vendor — the correction is applied as a new claim that supersedes the erroneous one, with a note explaining the correction. The original record is not deleted; it is preserved with a superseded_at timestamp.

Related guides

Evidence Decay: Why Freshness Is a First-Class Risk ConceptHash-Verifiable Evidence: Making Vendor Claims AuditableWhat Is Third-Party Risk Management (TPRM)?

Put evidence behind every vendor claim.

TrustVendor automates the evidence collection this guide describes.

Book a demo