Security
Your records stay yours
You are handing us your subcontractors’ insurance paperwork. Here is exactly what keeps it separate from every other contractor using Sealinn, what stops the compliance history being quietly changed, and what you walk away with if you leave.
Last updated: August 1, 2026. If your procurement process wants this as an annex rather than a page, the same measures are set out clause by clause against GDPR Article 32 in Annex B of the data processing addendum.
Another contractor cannot see your subs. Not by accident, not through a bad link.
Every table is locked to one company inside the database itself, not just in the app. Sealinn signs in with an account that has no power to unlock that rule — so a query written wrongly returns nothing rather than someone else's records.
Sealinn cannot edit or erase your compliance history. The database refuses the write.
Every upload, approval, override and rejection is written once to a log the application has no permission to change or delete. That is enforced by the database, so it holds even if a bug or a bad request tries.
Cancel and you keep everything.
Canceling moves you back to the free plan — it does not lock you out. You can still download your certificates as a zip, organized by subcontractor, export your compliance ledger to Excel or CSV, and export the full audit log to PDF, Excel or CSV. Plan limits apply to adding new subcontractors, never to reading or exporting what is already yours.
Where your data is held
Two places, both read back from the running system rather than taken from a diagram.
- The database
- AWS us-east-1 (Northern Virginia, United States)
- Uploaded documents
- Cloudflare R2, Eastern North America (the ENAM location hint — a placement preference, not a guarantee)
- In transit and at rest
- Encrypted in both cases. The connection to the database and to storage is TLS, and both providers encrypt what they hold on disk.
- Other companies involved
- 12 companies, each named — hosting, the database, storage, sign-in, the AI extraction, email, text messages, the job queue, payment, error monitoring and analytics. The list is on service providers we use, and it is derived from the credentials the deployment actually requires — a unit test fails the build if a credential appears without a provider being disclosed.
Who can reach it
Three separate gates, and none of them is the app being careful.
- Sign-in
- Handled by Clerk. Sealinn never sees or stores a password — there is nowhere in our database to put one.
- Inside your workspace
- 4 roles you can assign, from owner down to project manager. A project manager sees the projects they are assigned to and nothing else, and that filter is applied in the query, not hidden in the interface.
- The application's own account
- Sealinn connects to the database as a role that cannot bypass row-level security, and cannot update or delete the audit log. Those are two things the database refuses, not two things our code remembers to avoid.
- The files themselves
- Documents are never on a public address. Every view is a signed link that expires after 1 hour, and an upload link lasts 10 minutes. A certificate cannot be reached by guessing a URL.
- Links you send subcontractors
- A subcontractor uploads through a one-off link with no account and no password. The link is valid for 7 days, is stored only as a hash so it cannot be read back out of our database, can be scoped to a single document type, and can be revoked at any time.
What happens to a document you upload
The part most security pages leave out, including the awkward half.
- Virus scanning
- Documents Sealinn reads — certificates, W-9s, licenses, safety cards — are scanned in our own infrastructure before anything opens them. If the scanner is unreachable the file is refused rather than let through, and an infected file is deleted and rejected outright. A file you upload as a contract is stored but never opened by us, so it is not scanned.
- Sent to OpenAI
- An image of the page is sent to OpenAI to be read. It is not used to train their models — that is their default for API traffic. They keep API logs for up to 30 days for abuse monitoring and then delete them. We are not on their zero-retention arrangement, so we do not claim to be.
- What we deliberately do not read
- A W-9's taxpayer number is never extracted or stored. It is visible in the image we send, which is worth saying plainly rather than leaving you to work out.
- A person still decides
- The reading is checked against your own requirements, and anything below the confidence floor goes to the top of your review queue rather than through it. How Sealinn reads a certificate walks through what it does and does not catch.
How long we keep it
Every window below is a number in the code, not an intention.
- Your compliance history
- Kept for the life of the workspace. For a compliance product the record of who approved what is the thing you need years later, so it is deliberately not on a purge schedule.
- If you ask us to delete the workspace
- It stays recoverable for 30 days and is then erased — rows and stored files. The window exists so a mis-click or a departing colleague is not final.
- Rejected documents
- Recoverable for 3 days, then the row and the file are deleted.
- Generated reports
- 3 days — they are cheap to regenerate, so they do not linger. A failed one goes after 1.
- The full policy
- Every window, what we collect and why, and how to make a request is in the privacy policy, which renders these same numbers from the same source.
The questions people actually ask
Do you hold any security certifications?
What am I actually storing here?
Something looks wrong. Who do I tell?
See also the Privacy Policy, the Subprocessors list and the Terms of Service.
Looking for a different document? They are all listed on the Legal page.