Skip to main content

Draft — not legal advice. This document is published in good faith as Seald's working draft. It has not yet been reviewed by counsel and may change before becoming binding. If you are reviewing this on behalf of a customer, please contact legal@seald.nromomentum.com for the countersigned production version.

Version: sub_processors_v0.1 · Last updated: 2026-04-30

Sub-processors

Seald engages a small number of trusted Sub-processors to operate the Service. This page lists each Sub-processor, the processing role, the location of the processing, and the international-transfer mechanism used for personal data originating in the EEA, UK, or Switzerland. The list is maintained under our Data Processing Agreement.

1. Change-notice subscription

We give at least thirty (30) days' advance notice before adding or replacing a Sub-processor. To receive notices by email, send a message to subscribe-subprocessors@seald.nromomentum.com with the subject line "Subscribe — sub-processor changes". You can unsubscribe at any time by replying with the subject line "Unsubscribe".

Customers may object to a new Sub-processor on reasonable data-protection grounds within the thirty-day window per Section 4 of the DPA.

2. Current Sub-processors

Legal name Processing role Location Transfer mechanism
Supabase Inc. Managed PostgreSQL database, object storage, and authentication. Processes envelope metadata, audit events, account profiles, document files. United States (AWS us-east-2) EU-U.S. Data Privacy Framework certification; SCCs Module 2 with UK Addendum where applicable
Amazon Web Services, Inc. Cryptographic key service (KMS), Secrets Manager, and compute (EC2). Holds non-exportable private keys used to seal PDFs. United States (us-east-2) EU-U.S. Data Privacy Framework certification; SCCs Module 2 with UK Addendum where applicable
Resend, Inc. Transactional email delivery (signing invitations, completion notices, account notifications). United States EU-U.S. Data Privacy Framework certification; SCCs Module 2 with UK Addendum where applicable
Cloudflare, Inc. DNS, content delivery network, Cloudflare Pages hosting for the marketing site, and the Cloudflare Web Analytics insights beacon. Global edge, United States headquarters EU-U.S. Data Privacy Framework certification; SCCs Module 2 with UK Addendum where applicable
GitHub, Inc. Source-code hosting and CI/CD. Processes commit metadata and authorized contributor identifiers; does not process Customer Content. United States EU-U.S. Data Privacy Framework certification (via parent Microsoft Corporation); SCCs Module 2 with UK Addendum where applicable

Seald has not obtained SOC 2 Type II, ISO 27001, or any qualified-trust-service-provider recognition; the certifications listed above belong to the named Sub-processors.

3. Seald affiliates

Seald has no operating affiliates today. If we add an affiliate that processes Customer Personal Data, it will be listed here and subject to the same notice and objection process.

4. Contact

Sub-processor questions
privacy@seald.nromomentum.com
Subscribe to change notices
subscribe-subprocessors@seald.nromomentum.com