SSP is different from the statechain entity fwiw. the statechain entity (SE) coordinates reassignment of spending keys in spark. this is a federation of three companies and that code is open source.

SSP is an additive service that makes spending arbitrary amounts easier, and facilitates lightning payments, through atomic swaps. i.e. when you use a "spark lightning wallet" all your payments go through the SSP service (i think this is bad). you could use spark w/o the SSP, but the UX would really suck. SSP makes spark more trusted as well because lightspark is the previous owner in every leaf so your trust assumption is lightspark+lightspark run federation to not rug you.

ark relies on a central server, yes. but all user funds are held in a n-of-n multisig where they have full control over spending (your leaf is server+you to spend plus you get the presigned exit to spend the leaf if server goes offline). now, when you receive offline, you must update your balance to get your newly received funds into a new n-of-n multisig... which is really complicated so you have this trust in server until you "update" your balance on bitcoin.

but if you deposit from bitcoin, into the ark, and then just do payments... the server can't rug you per se. trust us always in receiving offline and that intermediary period where your offchain balance isn't yet reflected on bitcoin

note that ark server can't really steal... it must collude with previous owner to double spend you if have not updated your balance on bitcoin by entering new n-of-n multisig