diff --git a/src/mounts.js b/src/mounts.js
index d6fe8e58e..9c7a8511f 100644
--- a/src/mounts.js
+++ b/src/mounts.js
@@ -40,6 +40,7 @@ function validateMountOptions(type, options) {
         if (typeof options.password !== 'string') return new BoxError(BoxError.BAD_FIELD, 'password is not a string');
         if (typeof options.host !== 'string') return new BoxError(BoxError.BAD_FIELD, 'host is not a string');
         if (typeof options.remoteDir !== 'string') return new BoxError(BoxError.BAD_FIELD, 'remoteDir is not a string');
+        if ('seal' in options && typeof options.seal !== 'boolean') return new BoxError(BoxError.BAD_FIELD, 'seal is not a boolean');
         return null;
     case 'nfs':
         if (typeof options.host !== 'string') return new BoxError(BoxError.BAD_FIELD, 'host is not a string');
@@ -87,7 +88,7 @@ function renderMountFile(mount) {
     case 'cifs':
         type = 'cifs';
         what = `//${mountOptions.host}` + path.join('/', mountOptions.remoteDir);
-        options = `username=${mountOptions.username},password=${mountOptions.password},rw,iocharset=utf8,file_mode=0666,dir_mode=0777,uid=yellowtent,gid=yellowtent`;
+        options = `username=${mountOptions.username},password=${mountOptions.password},rw,${mountOptions.seal ? 'seal,' : ''}iocharset=utf8,file_mode=0666,dir_mode=0777,uid=yellowtent,gid=yellowtent`;
         break;
     case 'nfs':
         type = 'nfs';