Security and privacy

Sealio holds identity, tax and financial documents, so security is part of the platform, not a setting. This page lists what is in place in the Sealio platform today and what is planned before launch.

Signing inCopy Anchor Link

In place.

• Passwords must be at least 12 characters and are checked against known data breaches. They are stored only as Argon2id hashes, a slow, memory-hard hash designed to resist cracking. Sealio never stores or sees your password in readable form.
• Email confirmation is required before your first sign-in: you enter a 6-digit code we email you, which proves the address is yours. Codes expire after 10 minutes, and repeated wrong codes are blocked.
• Automated abuse protection: sign-up and sign-in are protected by a Cloudflare Turnstile check and by limits on repeated attempts.
• Sessions end after 12 hours without activity, and always within 30 days of signing in. Resetting your password signs out your other sessions.
• Password recovery uses a one-time link that expires after 1 hour.

Planned: passkeys, sign-in links by email, and single sign-on for enterprise firms. Two-factor sign-in with an authenticator app is in place (below).

Your firm's data is kept separateCopy Anchor Link

In place. Every record belongs to exactly one firm. Separation is enforced twice:

• in Sealio's application code, which scopes every operation to your firm;
• in the database itself, with row-level security. The database only returns rows for the firm making the request, so a bug in one query cannot expose another firm's data. Outside a firm's request, the database returns nothing at all.

The same rules apply to your firm's settings and team memberships, to the audit trail, and to the events Sealio produces for integrations. If you belong to several firms, Sealio shows you the list of firms you belong to, and nothing else from any of them until you open one.

Every action is recordedCopy Anchor Link

In place. Sealio keeps an audit trail of changes: who acted (a team member, a client, an integration or a system job), what they did, what changed, and when.

• Append-only: once written, an audit entry cannot be edited or deleted by the application.
• Tamper-evident: each entry is linked to the previous one with a cryptographic hash (SHA-256), so a changed or missing entry breaks the chain and is detected at the exact entry.
• Recorded with the change: an action and its audit entry are saved together. If one fails, neither is kept.

Creating your firm is itself recorded: the firm's details and your Owner membership are the first entries in its audit trail.

Planned: audit entries for sign-in activity; a daily check of every firm's chain, with a copy archived to write-once storage for 7 years; an audit explorer and CSV export for your admins; and redaction of sensitive values.

Documents are encrypted and never pass through our serversCopy Anchor Link

In place.

• Documents are stored in Amazon S3, encrypted at rest with a customer-managed key in AWS KMS.
• Uploads and downloads go directly between the browser and storage through short-lived signed links, issued only after a permission check.
• Every file is scanned for malware before your team can open it. Files that fail are deleted at once, and files that can't be checked are held back.

Where your data livesCopy Anchor Link

Planned. At launch, Sealio runs in a single AWS region. Firms in Canada use sealio.ca and firms in India use sealio.in; a firm's region is fixed when it signs up.

Compliance and certificationsCopy Anchor Link

Sealio does not hold a SOC 2 report or an ISO 27001 certificate yet.

In place. Sealio runs on Amazon Web Services, whose data centres are covered by AWS's own independent audit reports. The controls on this page marked In place are built into the platform.

Planned. An independent SOC 2 audit covering security, availability and confidentiality. This page will say so when a report is available; until then, please don't rely on any other statement that Sealio is SOC 2 compliant.

Every upload is checked (In place)Copy Anchor Link

After a client uploads a file, Sealio checks that its contents match its type: a file called statement.pdf must really be a PDF. Files that don't match are deleted straight away, and the client is asked to save or export the document again. Every file is also scanned for malware before your team can open it.

Two-factor sign-in (In place)Copy Anchor Link

Turn on two-factor sign-in from You → Your account in the sidebar. Scan the QR code with an authenticator app (1Password, Google Authenticator, Microsoft Authenticator…), enter the code it shows, and save the 10 backup codes somewhere safe. From then on, signing in asks for a code from the app. If you lose your phone, use a backup code.

The same page lists your recent sign-ins, failed attempts and two-factor changes.

Protection against password guessing (In place)Copy Anchor Link

After five wrong passwords, Sealio blocks sign-in for that email for 15 minutes, then for longer each time. Resetting your password is always available.

Planned: passkeys, and letting a firm require two-factor sign-in for everyone.