Sub-processors
The third-party service providers (“sub-processors”) SealedSpace uses to deliver its cloud service, what each processes, and where.
Last updated: 2026-06-11
Customers running a self-hosted deployment have no SealedSpace-operated sub-processors — they control their own infrastructure.
For the SealedSpace-hosted (cloud) service, the sub-processors are:
| Sub-processor | Service / Purpose | Data processed | Region |
|---|---|---|---|
| Amazon Web Services (AWS) — RDS PostgreSQL | Primary database: encrypted content + plaintext routing metadata | Ciphertext envelopes; account email & display name; membership/routing metadata | US (us-east-1) |
| AWS — EC2 + Caddy | Application compute / API tier (TLS termination) | In-transit request data (ciphertext + metadata) | US (us-east-1) |
| AWS — S3 | Encrypted media/file blob storage (presigned access) | File ciphertext only (no keys, no plaintext) | US (us-east-1) |
| AWS — CloudFront | CDN for the web app & static assets | Static app assets; standard request logs (IP, user agent) | Global edge |
| AWS — SES v2 + SNS | Organization email send/receive | Email envelope routing (addresses); bodies are sealed per-recipient (inbound external mail is sealed on receipt and the raw message deleted) | US (us-east-1) |
| AWS — ACM | TLS certificates for app/apex domains | None (certificate issuance) | US |
| Oracle Cloud Infrastructure (OCI) | Self-hosted LiveKit SFU + coturn for real-time audio/video calls | Real-time media streams (E2EE by default; relay/SFU metadata) | US (us-ashburn-1) |
| Google Firebase Cloud Messaging (FCM) | Push notifications (Android / web) | Content-free wake signals: device token + routing ids only | Global |
| Apple Push Notification service (APNs) | Push notifications (iOS) | Content-free wake signals: device token + routing ids only | Global |
| Let’s Encrypt | TLS certificates for the API domain | None (certificate issuance) | Global |
User-initiated integrations (not sub-processors)
Separately from the infrastructure above, a user can opt in to connect their own external tools to their account. These are not SealedSpace sub-processors: SealedSpace does not engage, control, or send data to them — the user does, from their own device, on their own provider account.
| Integration | What it is | Data flow | Controlled by |
|---|---|---|---|
Claude Code (MCP) — @sealedspace/mcp | An optional client a user links so an AI assistant can help plan and work on their tracker | Runs on the user’s machine; with the user’s approval it decrypts the specific spaces the user granted and sends that content to the user’s own Anthropic account under Anthropic’s terms. SealedSpace only facilitates the encrypted delegation of space keys and never receives or stores the decrypted content. | The user (approve per-space; revoke anytime in Settings → Integrations) |
Because the user initiates and controls the transfer, the AI provider is a recipient chosen by the user, not a processor acting on SealedSpace’s behalf. Encryption against SealedSpace’s own servers is unchanged. See the Privacy Policy §5a for detail.
Notes for reviewers
- No analytics, advertising, session-replay, or tracking sub-processors. The product ships with none integrated.
- No payment data is processed by SealedSpace’s own systems today; if/when billing is added, the payment processor (e.g. Stripe) will be added here and card data will never touch our servers.
- Email bodies and attachments are sealed per-recipient before storage; SES/S3/SNS handle routing and ciphertext only. See the Security Whitepaper for the inbound-mail sealing model.
- Push payloads carry no message content — only an id that wakes the app to fetch and decrypt locally.
Change management
Material changes to this list (adding a sub-processor, or a new category of data processed) will be announced to customers with at least 30 days’ notice via email and this page’s changelog, allowing time to object, per the DPA.
Changelog
- 2026-06-06 — Published at sealedspace.com/subprocessors; OCI region stated; inbound-mail sealing note added.
- 2026-06-02 — Initial list drafted.