Public procurement evidence · reviewed 4 September 2026
Sealkeep assurance and audit roadmap
The Q3 2026 assurance workstream packages implemented controls, test evidence, and review scope for independent assessment. Internal evidence is published now; external validation is the next gate.
Current evidence
- Authenticated-encryption format v2 with deterministic vectors and tamper tests.
- Archive round-trip, wrong-key refusal, integrity refusal, and restore tests.
- Upload verification before a local source becomes eligible for reclamation.
- Signed device requests with timestamp and nonce replay protection.
- Tenant/account boundary and destructive-authority tests.
- Project collaboration rehearsal: 12/12 live company scenarios recorded as passing
on 2026-08-20, covering two developers, a shared project, cross-machine retrieval, revocation, and allowed/refused deletion.
- Architecture, threat-model, deployment, DPA, and TOMs working documentation.
- Dependency lockfile and release checksum/manifest tooling.
Q3 2026 — complete procurement evidence
- Verify every production Subprocessor's legal entity, service, data, locations,
access regions, retention, transfer mechanism, and Article 28 flow-down terms.
- Verify hosted identity, network, logging, monitoring, backup, restore, incident,
deletion, and privileged-access evidence.
- Review the DPA, privacy notice, retention, and public-sector terms against the
selected customer, jurisdiction, and deployment.
- Publish dated versions and a change-notice mechanism.
Exit evidence: approved DPA/TOMs annex, contractual Subprocessor register, production data map, restore/deletion rehearsal record, and named control owners.
Next assurance gate — independent product security review
- Commission a third-party cryptographic implementation review.
- Commission external review of key lifecycle, recipient removal, project continuity,
and organisation recovery design.
- Commission an authenticated application/API penetration test.
- Remediate material findings and publish a scope/methodology/outcome summary that does
not disclose exploitable detail.
Exit evidence: reviewer identity and independence, scope, version, dates, severity summary, remediation status, and any residual accepted risk.
Q3–Q4 2026 — software supply-chain evidence
- Publish a per-release CycloneDX or SPDX SBOM.
- Publish artifact SHA-256 values, source revision, and test summary.
- Operate signed manifests with a published verification key and rotation/revocation
procedure.
- Add supported platform code-signing/notarisation.
- Evaluate build provenance and reproducibility against an appropriate framework.
Exit evidence: buyer-verifiable release bundle tied to the exact delivered artifact.
Recurring assurance — after the first independent review
- Define annual and material-change review cadence.
- Re-run independent testing after material security-boundary changes.
- Exercise incident response, backup restore, customer exit, and no-egress deployment.
- Track coverage health if organisation-enforced capture and fleet evidence become
part of the product claim.
- Publish changes, expired evidence, residual risk, and next review dates.
Claims not made today
- No independent cryptographic audit completed.
- No SOC 2 or ISO 27001 certification claimed.
- No OS code-signing certificate claimed.
- No public per-release SBOM or complete build attestation claimed.
- No guarantee that every coding-agent session across a company is captured.
- No separate organisation recovery recipient or transferable project-owner role
claimed in the current Team model.
Roadmap questions: security@spala.ai