dataseal.dev

Zero-trust document vault.
Sealed in cryptography.

Data Seal is a cryptographic document vault for small engineering teams. Your secrets stay sealed in math — not access controls, not policy, not someone else's promise.

macOS & iOS apps in private alpha · SDK available

See the apps How it works

⚭ ⚭

sealchain · the tamper-evident log underneath
open source · commercial licensing & support available

The Problem

Your documents deserve better than "encrypted at rest"

Encrypted at rest just means the disk is encrypted. The service can still read your files, the cloud provider can still be subpoenaed, and an insider can still walk out with plaintext. Data Seal takes a different position: your documents never exist as plaintext outside a protected access window. Your cloud storage holds nothing but encrypted noise it can't read. You and your team control the keys. Nobody else does — not your cloud provider, not us.

What makes Data Seal different

🗄

Bring your own storage

Encrypted documents go into Dropbox, Google Drive, or iCloud — infrastructure you already pay for. No new service to subscribe to.

🔑

No central authority

Each person holds a cryptographic identity tied to their device. Team membership is a signed record — not an account in someone else's database.

🧾

Audited extraction

When someone takes a local copy, it's watermarked and logged. You know exactly who extracted what, and when — and it's provable.

📱

No extraction on mobile

On iOS, documents live only in app memory behind biometrics. There is no path to a local file — by design, not policy.

📲

QR identity transfer

Pair your iOS and macOS devices by scanning a QR code. Your cryptographic identity moves securely — no cloud account, no email link.

⚙️

Daemon-based sync

A local daemon (vaultd) handles vault sync in the background. The CLI and macOS app both talk to it — same vault, multiple surfaces.

Use Cases

Who could use Data Seal

Any team that shares sensitive documents over standard cloud storage — without wanting to trust the cloud.

⚖️

Attorney / Client

Privileged communications and discovery documents — shared securely, inaccessible to the storage provider. End-to-end encrypted, with a tamper-evident record of every access.

💼

Financial Adviser

Account statements, estate plans, and sensitive client records — without relying on a separate secure portal. Your Dropbox holds only encrypted noise.

🧾

CPA / Accounting

Tax returns and workpapers shared with clients — encrypted in transit and at rest, with a cryptographic record of every open and extraction.

🏥

Healthcare

Patient records shared between providers — end-to-end encrypted, audit trail included, aligned with HIPAA access-control requirements.

🤝

M&A / Due Diligence

A deal room without a dedicated deal room service — encrypted documents shared through your existing cloud storage, revocable the moment the deal closes.

🏛️

Board & Governance

Minutes, compensation records, and legal filings — restricted to the right people, with a tamper-evident log that proves who saw what and when.

⚙️

Engineering Teams

Infrastructure secrets, internal specs, and proprietary source — sealed in cryptography, not access policy. No central server to subpoena.

Audit Log

Tamper-evident by construction

Conventional audit logs are mutable files. Any admin with write access can delete lines, edit entries, or forge attribution. Data Seal builds tamper evidence directly into the log — every entry is cryptographically linked to the one before it. Modify or remove any entry and the chain breaks, detectable by anyone with the log. Every event is also signed by the person who caused it, so attribution can't be forged even by someone with direct filesystem access.

The log records every access, open, extract, and membership change — with a verified identity, a timestamp, and a reference to the document. It is append-only and self-verifying.

Compliance coverage

The audit log is designed to satisfy the electronic-records requirements of:

FDA 21 CFR Part 11

Audit trails for electronic records. Tamper-evident, cryptographically attributed event history satisfies the requirement for secure, verifiable records on regulated data.

SOX § 802

Record alteration or destruction. The append-only structure with detectable tampering directly addresses the prohibition on altering records related to audits or investigations.

HIPAA § 164.312(b)

Audit controls for PHI. Every access, open, extract, and member-change event is recorded with verified actor identity, timestamp, and document reference.

GDPR Art. 30

Records of processing activities. A verifiable, actor-attributed record of who processed which documents and when.

Forensic watermarking

Extraction events don't just get logged — the extracted document itself is marked. A forensic watermark is embedded at extraction time, tied to the audit entry. If a file leaks, the watermark traces it back to exactly who took it and when. It survives most common editing paths.

Platforms

macOS, iOS, and CLI — all in private alpha.

The core vault, audit log, and daemon have been running in daily use for months. macOS and iOS apps are both in private alpha. The CLI ships with every install.

CLI (vault + vaultd) Available

SDK (TypeScript, Python, Swift) Available

macOS Application Private Alpha

iOS Application Private Alpha

Android Planned

macOS app — document vault

Data Seal

Encrypted documents stored in your own cloud — Dropbox, Google Drive, or iCloud. Nobody else holds the keys.

macOS app — tamper-evident audit log

Data Seal — Audit Log

Every access, open, extract, and membership change — cryptographically linked, signed by actor, verifiable by anyone.

iOS app

Data Seal — iOS

Documents in app memory only — Face ID gated, no local file path.

iOS — QR identity transfer

Identity

Scan from macOS to pair devices. No cloud, no account — just math.

CLI — vault + vaultd

Terminal

Data Seal CLI — vault ls and vault audit output

vault ls lists your encrypted documents. vault audit prints the verified event chain. vaultd runs the sync daemon the apps talk to.

Developer SDK

Build on the vault directly.

The SDK gives applications direct access to the vault — encrypt, decrypt, list, audit, and manage team membership without going through the desktop apps. Available for TypeScript, Python, and Swift.

Private alpha

Data Seal is in private alpha. The SDK, vault, and CLI are functional — we use them daily. If you're building something that needs zero-trust document storage with a real audit trail, reach out. We'll give you access and talk through the integration.

Threat Model

What Data Seal protects against

Threat	How it's handled
Cloud provider subpoenaed	Your cloud storage holds only encrypted blobs — no readable filenames, no metadata, nothing that can be deciphered without your keys
Device compromised	Documents exist only in protected application memory during an active access window — closed or timed out, they're gone
Team member leaves	Remove them from the team; their access is revoked immediately — no key, no access, enforced by the vault itself
Document leaked after extraction	Every extraction is logged and watermarked; the watermark traces the file back to exactly who took it and when
Audit log tampered	Every entry is cryptographically linked to the one before it — modification, deletion, or insertion is immediately detectable
Mobile extraction	No export path on iOS; biometrics gate every open; documents clear from memory on close — by design, not policy

What it does not protect against

Screen capture. Once a document is rendered on screen, it can be photographed. Data Seal controls access and attribution — it is not DRM.

A fully compromised machine. If the device running the vault is owned at the OS level, an attacker can access application memory. The vault is the trust boundary — not a magic black box.

Zero-trust document vault.Sealed in cryptography.