Skip to main content

Draft — not legal advice. This document is published in good faith as Seald's working draft. It has not yet been reviewed by counsel and may change before becoming binding. If you are reviewing this on behalf of a customer, please contact privacy@seald.nromomentum.com for the countersigned production version.

Version: sub_processors_v0.3 · Last updated: 2026-09-30

Sub-processors

Seald engages a small number of trusted Sub-processors to operate the Service. This page lists each Sub-processor, the processing role, where the processing takes place, and the basis on which we transfer personal information to it. The list is maintained under our Data Processing Agreement.

1. Change-notice subscription

We give at least thirty (30) days' advance notice before adding or replacing a Sub-processor. To receive notices by email, send a message to privacy@seald.nromomentum.com with the subject line "Subscribe — sub-processor changes". You can unsubscribe at any time by replying with the subject line "Unsubscribe".

Customers may object to a new Sub-processor on reasonable data-protection grounds within the thirty-day window per Section 4 of the DPA.

2. Current Sub-processors

Legal name Processing role Location Transfer basis
Supabase Inc. Managed PostgreSQL database, object storage, and authentication. Processes envelope metadata, audit events, account profiles, document files. EU (AWS eu-central-1, Frankfurt) EU member state (Germany); written data-processing terms (Israel Transfer Regulations, 5761-2001)
Amazon Web Services, Inc. Cryptographic key service (KMS) when used for document-sealing or token-wrapping keys, plus Secrets Manager and compute (EC2). United States Written data-processing terms (Israel Transfer Regulations, 5761-2001)
Resend, Inc. Transactional email delivery (signing invitations, completion notices, account notifications). United States Written data-processing terms (Israel Transfer Regulations, 5761-2001)
Cloudflare, Inc. DNS, content delivery network, Cloudflare Pages hosting for the marketing site, and the Cloudflare Web Analytics insights beacon. Global edge, United States headquarters Written data-processing terms (Israel Transfer Regulations, 5761-2001)
GitHub, Inc. Source-code hosting and CI/CD. Processes commit metadata and authorized contributor identifiers; does not process Customer Content. United States No Customer Content; GitHub data-protection terms

Seald has not obtained SOC 2 Type II, ISO 27001, or any qualified-trust-service-provider recognition; the certifications listed above belong to the named Sub-processors.

3. Seald affiliates

Seald has no operating affiliates today. If we add an affiliate that processes Customer Personal Data, it will be listed here and subject to the same notice and objection process.

4. Contact

Sub-processor questions
privacy@seald.nromomentum.com
Subscribe to change notices
privacy@seald.nromomentum.com