Why this matters

How Seal makes its sealed packages auditable, signable, and accountable, and where to find each artifact in the platform.

Seal does something many of your other vendors do not: it modifies open-source packages and ships them back to you under a sealed version string. That is a useful operation, and one that needs to be backed by enough evidence that you, your security team, your auditors, and the scanners reading your software can all verify what Seal did and trust the result.

This section is the catalog of that evidence. Each chapter that follows covers one piece of it.

The artifacts Seal publishes per sealed package

• Code diff. The source code changes between the origin version of a package and its sealed iteration, viewable per vulnerability in the Seal UI.

• Attestations. Two formats: a PDF attestation (human-readable, suitable for compliance reviewers) and a VEX record (machine-readable, suitable for SBOMs and VEX-aware scanners).

• Patch validation prompt. A Seal-generated prompt that ships with the diff embedded, ready to paste into an LLM for an independent, customer-driven check of the patch.

• Cryptographic signing and hash verification. Every sealed artifact carries an ECDSA signature, automatically verified by the Seal CLI on every fetch. Hashes for each artifact are published so you can verify integrity yourself.

The commitments Seal makes around them

• SLAs. Seal handles critical- and high-severity vulnerabilities within 72 hours of disclosure.

• Compliance certifications and frameworks. Seal Security holds SOC 2 Type II and ISO 27001 certifications. Audit material is available through the trust portal at trust.sealsecurity.io. Seal supports customers working under PCI DSS 4.0, FedRAMP, DORA, and NYDFS.

How the pieces fit together

The four per-package artifacts complement each other. They are not redundant; each answers a different question.

Artifact	Question it answers
Code diff	What did Seal change?
PDF attestation	Can I show this to my compliance team?
VEX record	Can a scanner consume this without knowing about Seal?
Signing	Can I be sure the artifact I downloaded is the one Seal published?
Patch validation prompt	Did the patch fix the vulnerability without breaking the consumer?

Related

• Code diff

• Attestations

• Patch validation prompt

• Cryptographic signing and hash verification

• SLAs and compliance frameworks