Public procurement evidence · reviewed 4 September 2026
Sealkeep deployment responsibility matrix
This matrix describes the default allocation for fully isolated self-hosted operation. Connected self-hosted and hosted services change the operator of selected components; the signed order form remains authoritative.
| Control area | HM Software LLC / Spala | Customer |
|---|---|---|
| Application delivery | Deliver the agreed application/backend bundle, schema, deployment instructions, version, and integrity information | Validate and accept the delivered version and approved configuration |
| Runtime and network | State requirements and disclose optional external dependencies | Operate container/VM/Kubernetes, ingress, egress, firewall, TLS, DNS, and capacity |
| Database and storage | Preserve documented data model and encrypted archive interface | Operate PostgreSQL, object storage, credentials, regions, availability, and deletion |
| Identity and access | Supply application access-control capabilities and document roles | Configure identity provider, named administrators, MFA, least privilege, and reviews |
| Endpoint encryption | Maintain the archive format and endpoint cryptographic implementation | Secure endpoints, OS accounts, agent files, local keystore, and device custody |
| Recovery and recipients | Document recipient, rewrap, revocation, and recovery behaviour | Hold phrases and private keys; govern project membership and recipient lifecycle |
| Logging and monitoring | Document security-relevant events produced by the product | Collect, protect, retain, review, alert, and respond to deployment logs |
| Backup and recovery | Provide product restore/export instructions and agreed defect support | Back up and restore PostgreSQL, objects, configuration, logs, and customer-held keys |
| Retention and deletion | Implement documented product controls; delete Spala-controlled support data as agreed | Set policy and delete endpoint, database, object, log, snapshot, and backup copies |
| Vulnerability and patches | Maintain intake, assess product issues, issue supported updates and advisories | Monitor notices, test and deploy patches within customer change policy |
| Support access | No standing access; request only approved minimum; respect time and scope | Approve, provision, observe, log, and revoke time-bounded access if needed |
| Incidents | Investigate product or Spala-controlled processing and notify as agreed | Operate environment response and make controller/regulatory decisions |
| Regions and transfers | Disclose Spala-controlled processing and applicable providers | Select deployment, administrator, database, storage, log, and backup regions |
| Exit | Provide agreed export, documentation, and deletion from Spala-controlled systems | Preserve bundle/licence rights; export/delete customer-operated data and keys |
Fully isolated acceptance evidence
- Record bundle version, checksum, dependencies, and available SBOM.
- Prove customer PostgreSQL and object storage work without Spala credentials.
- Inventory outbound destinations and test with egress denied.
- Confirm there is no mandatory Spala runtime API, authentication, telemetry, storage,
or licence-check dependency.
- Prove archive, verification, reclamation, restore, export, and deletion paths.
- Record approved regions, administrators, retention, patch, backup, and support policy.
- Accept current assurance limits, including independent-audit and code-signing status.
Architecture review: security@spala.ai