Security & Trust
Your data is yours. We built SealedSpace so we literally can't read it.
SealedSpace is a zero-knowledge, end-to-end encrypted collaboration suite. Your notes, files, messages, and email are encrypted on your device before they ever reach our servers — so a breach, a subpoena, or a rogue employee all hit the same wall: ciphertext we have no key to open. (The small set of routing metadata we do hold is listed below.)
How we protect your data
🔒 End-to-end encryption, by default
Everything you create — notes, documents, files and their names, chat messages, internal email — is encrypted with AES-256 on your device. We store only ciphertext. Inbound email from external providers necessarily arrives in plaintext (that's how email works, for every provider); we seal it to your key on receipt and delete the raw message — it is unreadable to us at rest.
🗝️ Zero-knowledge key model
Your encryption keys are derived and held on your devices, never by us. We use modern, widely vetted cryptography: Argon2id, Ed25519, X25519, and AES-256-GCM.
🛡️ Encrypted in transit and at rest
TLS 1.2+ everywhere, and your content is encrypted before storage — not just "encrypted disks," but content we cannot decrypt.
👤 You control access
Granular, capability-based permissions with teams and per-item sharing. Passkey-protected account recovery that preserves zero-knowledge.
🏠 Built for self-hosting
The architecture is designed so the entire stack can run on your own infrastructure. Enterprise self-hosted deployments are available by arrangement — a packaged distribution is in development. Contact us, or support the open-source core.
🚫 No tracking, no ads
We don't use advertising, analytics, or session-replay trackers. We make money from the product, not your data.
What we can and can't see
| We can see (to run the service) | We can never see |
|---|---|
| Your email & display name | Note & document content |
| Who's in which space/team | File contents & names |
| Timestamps & message ordering | Chat messages |
| File size & type | Email bodies & attachments1 |
| Admin audit events | Space names |
1 Internal mail is end-to-end encrypted. Inbound external mail is sealed to your key on receipt and the plaintext deleted — unreadable to us at rest, a guarantee we label honestly as sealed-on-receipt rather than calling it E2EE.
Integrations you choose to connect. If you opt to link an external
tool such as Claude Code (our @sealedspace/mcp server), you decide which
spaces it may read; it runs on your machine and sends the content you share to your own
AI provider under their terms. That content leaves end-to-end encryption by your explicit
choice — we never receive or control it, and the provider is not our sub-processor. See
the Privacy Policy and Sub-processors.
Compliance
- Built in today: end-to-end encryption, encryption in transit & at rest, default-deny access control, administrative audit logging, a data-minimizing architecture that keeps personal data out of our reach by design.
- On our roadmap: SOC 2 Type II, ISO 27001, and independent penetration testing.
Resources
- 📄 Security Whitepaper — the technical detail
- 📄 Sub-processors
- 📄 Vulnerability Disclosure Policy
- Privacy policy and DPA are being finalized with counsel — available on request at privacy@sealedspace.com, along with our completed security questionnaire (CAIQ).
Report a vulnerability
Found a security issue? Email security@sealedspace.com. See our disclosure policy — we offer safe harbor for good-faith research.