SealbookTrust centre
For your security, legal and procurement teams
Everything here describes Sealbook as it is on 4 November 2026, including what is not done yet. Last updated 4 November 2026.
Assurance status
| Item | Status |
|---|---|
| Independent penetration test | Not yet Being scoped with CREST-accredited firms; the report will be offered here when done. |
| SOC 2 or ISO 27001 | Not yet A readiness map is available on request. |
| Automated security testing | Done OWASP ZAP scans (outside and signed in), access rules checked on every API operation for five kinds of caller, input fuzzing, concurrent-write tests, dependency audit. Report on request. |
| Restore from backup | Done Drill with 252 projects, encryption on, every integrity check passed. |
| Install in a customer's own cloud | Used for real Microsoft Azure with Entra ID sign-in, 4 November 2026. |
| Automatic Teams, Zoom and Fireflies imports | Live test pending See integrations. |
| Independent accuracy benchmark of the reader | Not yet Our own results are on the accuracy page. |
| Customers in production | Not yet Pilots start in November 2026. |
Deployment options
Each consulting firm gets its own copy of Sealbook: one application and one database. There is no shared multi-firm service.
| Your own cloud or server | Dedicated copy we run | |
|---|---|---|
| Who runs it | Your IT team, with our install guide and support | Us, for your firm only |
| Where data lives | Your subscription or data centre | A server and database of its own, region agreed with you |
| Who holds the encryption key | You | The server; we as operator could technically read the data |
| Sign-in | Your identity provider | Your identity provider |
| Best when | Your client says the vendor must never see their meetings | You want to start quickly without an IT project |
The public demo at this address is a separate, shared server with made-up data only. Never put real conversations into it.
Where the data goes
- A transcript arrives: uploaded or pasted by your project lead, or fetched after the meeting from Teams, Zoom or Fireflies with read-only access you grant.
- The reader suggests decisions inside Sealbook. Only if you switch on the optional AI reader is transcript text sent to Anthropic (directly or through your Amazon Bedrock account).
- Your lead checks suggestions; both sides confirm in the app or, for operational decisions, from an email your own mail server sends.
- Everything is stored encrypted in the database, written to the hash-chained record, and backed up encrypted.
- Optional outbound: signed webhooks to systems you name, messages to a Slack or Teams channel you choose, and (if enabled) one fingerprint a day to a timestamping authority. Nothing else leaves.
Subprocessors
For a copy in your own cloud, Sealbook (the company) handles none of your data; you choose your providers. For a dedicated copy we run, and for this website:
| Who | What for | What they see | When |
|---|---|---|---|
| Render Services, Inc. | Runs dedicated copies and this website | Everything stored in that copy | Always, for copies we run |
| Cloudflare, Inc. | Network protection and DNS for getsealbook.com | Traffic, including IP addresses | Always, for this website |
| Anthropic, PBC, or Amazon Web Services (Bedrock) | The optional AI reader | Text of the meeting being read | Only if you switch it on |
| Your email provider | Confirmation requests, reminders, reports | Recipient, decision summary | When email is on |
| PostHog Inc. (US) | Visit counts on this website and the public demo; scrubbed error reports | Page, referrer, campaign tags, a daily-changing visitor hash; no cookies, no content | This website and demo |
| A timestamping authority you choose | Daily outside timestamp of the record | One SHA-256 fingerprint; no content or names | Only if enabled |
We give 30 days' notice before adding a subprocessor that handles customer data.
Legal documents
- Privacy notice for this website, the demo and pilot requests.
- Terms of use for this website and the demo.
- For customers: a pilot letter, the licence terms and a data processing agreement, sent on request. They are reviewed by our counsel before anyone signs.
How it is tested
Every change runs about 400 automated tests on two databases and a set of browser tests. They include: every API operation called as a signed-out visitor, someone from another firm, another project's client, the client's viewer and the client's reviewer, against one written access policy; script payloads in every field; oversized and malformed input; several people writing at once; backup and restore. The security page has the detail; the full report is available on request.
Incidents
If something affects your data in a copy we run, we tell your named contact without undue delay and within 72 hours of becoming aware of it, with what happened, what data, and what we are doing. Report a suspected incident to hello@getsealbook.com with "Security incident" in the subject.
Responsible disclosure
If you find a vulnerability, email hello@getsealbook.com with "Vulnerability report" in the subject. We acknowledge within 3 working days, keep you informed, and credit you if you want. Please test only against the public demo, don't access other people's data, don't degrade the service for others, and give us reasonable time to fix before publishing. We won't take action against good-faith research that follows these rules. Our security.txt has the same contact.
After a pilot
- You receive a full export of the project in a documented format.
- Then you choose: we delete the pilot copy and its backups within 30 days, or you continue on a licence.
- On your own cloud or server, the data was always yours and stays there.
Questions from your security, legal or procurement team: hello@getsealbook.com.