Security & trust

The signed substrate behind every receipt.

Every sealed event carries a SHA-256 content hash, a classical Ed25519 signature, a post-quantum ML-DSA-87 signature, and a chain link to the previous record — independently verifiable on a public ledger. This page is for buyers and their security teams.

Request SOC 2 bridge letter Vulnerability disclosure

Cryptography

Content hash. SHA-256 over the canonical JSON event payload. PHI-lattice entropy score (≥0.95 required) detects low-entropy or replay payloads before sealing.
Classical signature. Ed25519 over the 32-byte content hash. Signing-key id 5D579BC434FE1EE7. Public key directory at /security/keys.json. Keys rotate on a documented schedule; older keys remain verifiable via the chain.
Post-quantum signature. ML-DSA-87 (NIST FIPS 204). Key id 00A1B445B44906C3. Guarantees long-horizon verifiability against future cryptanalytic advances on Ed25519.
Chain link. Every sealed event includes a prev_seal_hash. Any modification to a past event breaks the chain at that point and is detectable in O(1) per check.
Watermark. Each receipt carries an EPOCHCORE™_DKAP_CEO_ watermark with the short hash, embedded in QR scanability checks.

Chain anchor & data residency

Sealed events are written to an in-region Cloudflare edge queue plus a D1 archive (the source of truth for the /v/<hash> verifier on this site). A rolling Merkle root is anchored on the Base L2 public blockchain so anyone can verify a receipt without trusting EpochCore.

Data residency. Sealed events are stored in US-only Cloudflare regions (IAD / ENAM). The chain-anchor publishes a Merkle root to Base L2 (a public Ethereum-style L2) — the anchor is public; your raw event payloads are not.

Retention policy

Segment	Default	Configurable up to	Floor (regulatory)
Farms (USDA-205)	7 years	15 years	2 years
Restaurants (FSMA-204)	7 years	10 years	2 years
Shops (SEC-17a-4)	7 years	10 years	6 years
Enterprise	Custom	30 years	Per contract

Records cannot be deleted before retention expires. After retention, receipts roll out of the live queue but the Merkle anchor on Base L2 remains permanent.

Service-level & availability

Verifier availability. 99.95% target on seal.epochpay.today/v/<hash>.
Fallback. If our verifier is unavailable, the chain anchor is still independently checkable on Base L2 — see Verify this independently on any sealed receipt.
Status page. status.seal.epochpay.today (coming soon).

Continuity & liability

If Sealed disappears. Your sealed records remain independently verifiable on Base L2 forever — the chain anchors don't depend on us being online. Customers download a complete export at any time during their subscription and for 30 days after cancellation.

Liability. $1M E&O coverage per claim, capped at 12 months of fees. Detailed terms at /terms.

Sub-processors

Cloudflare — edge compute, D1 storage, R2 cold storage, queue infrastructure.
Resend — pilot intake email notifications. Founder-side only by default.
IBM Cloud — optional hosting region for enterprise tier. Not in the SMB direct-subscription path.
Base L2 (Coinbase) — public-ledger anchor for Merkle root snapshots.

Compliance status

SOC 2 Type II — audit in progress. Target completion 2026 Q3. Bridge letter available on request.
USDA Rule 205 — Sealed's farm trust-pack PDFs align with the 205.103 chain-of-custody inspector workflow.
FSMA Rule 204 — Sealed's restaurant trust-pack PDFs align with the FDA's 4-hour traceability requirement for high-risk foods. See a sample trust pack →
SEC 17a-4 — Shop segment defaults to SEC 17a-4 retention class; WORM (write-once-read-many) semantics enforced at the storage layer.
GDPR / CCPA — Sealed stores only the data your event payloads contain. Right-to-erasure handled via cryptographic blinding (we keep the hash, redact the cleartext).
Out of scope. Sealed is not currently designed for HIPAA-protected health information or FERPA-protected student education records. Talk to us if you need a covered-entity-compliant deployment.

Vulnerability disclosure

Report a vulnerability via the structured form at /security/report. We acknowledge within 24 hours, triage within 5 business days, and credit reporters in our public hall of fame on request. Encrypted attachments welcome — PGP key fingerprint at /security/pgp.txt.

Researcher-side details (in-scope endpoints, severity guidance, safe-harbor language) live in /.well-known/security.txt per RFC 9116.

In scope: seal.epochpay.today, chain.epochcoreqcs.com, the verifier and intake endpoints, the receipt index. Out of scope: social engineering, denial-of-service, physical access, third-party services we don't operate.

Want a deeper conversation?

Request SOC 2 bridge letter

Convinced?

See the live demo See pricing