Groundwork: security

Your files, your permissions, your rules.

AI that only sees what your people are already allowed to see.

Access follows the permissions you already have.

Groundwork gives every AI tool your team uses one source to answer from. The first fair question is who can see what.

If someone can't open a file on your server, they can't see it in Groundwork. We don't build a second permission system for your IT team to maintain. Groundwork inherits the one you already run.

Departments can be walled off from each other at setup. Finance doesn't see HR. Field crews don't see the board packet. And nothing is visible by default: access starts closed and opens only where it's granted.

Your team signs in the way they already do.

Groundwork uses WorkOS for authentication, so people sign in through the identity provider your company already uses, like Microsoft, Google Workspace, or Okta. Whatever you've configured there, including multi-factor and password rules, carries over.

When someone leaves and IT disables their account, their Groundwork access goes with it. No separate list of logins to remember to clean up.

Only finished documents go in.

Groundwork doesn't copy your whole server. It takes the documents your team has finalized, the decided version of what's true, and leaves drafts, scratch files, and old versions where they are. Less data in the AI layer means less to manage and less to expose.

Your source documents stay the source. AI conversations don't rewrite them.

Your material isn't used to train anyone's AI.

When Groundwork reads your files to organize them, that work runs on a privately hosted model, not a public AI service. Your documents aren't sent off to train someone else's product during setup.

Every change is on the record.

Groundskeepers, the background agents that maintain Groundwork, log what entered the record and when. If a policy document changes on your server, you can see when Groundwork picked it up. You always know where an answer came from.

Shared or dedicated: you pick the isolation.

Smaller teams run on a shared instance with each company's data kept separate. Companies with compliance obligations, or that simply want more distance, get a dedicated cloud account of their own. We'll help you decide which fits your risk.

What it runs on.

Groundwork is hosted on Amazon Web Services. Your records are stored in Amazon S3, encrypted at rest and in transit, in AWS's US West (Oregon) region. Companies that want full separation get their own dedicated AWS account, not just a separate folder in ours.

We build on AWS so your data sits on infrastructure your IT team already knows how to evaluate. AWS secures the cloud. We're responsible for how Groundwork is configured inside it, and we'll walk your team through that configuration before anything goes live.

We work alongside your IT provider.

Groundwork needs your files in the cloud, or synced to it, with permissions in order. If you have a managed IT or security partner, they're part of the setup, not bypassed by it. We bring the knowledge layer. They keep owning the infrastructure.

Saying yes to AI, safely.

Your team is probably already pasting company documents into ChatGPT. A policy that says "don't" rarely stops it. Groundwork gives you something to approve instead: one sanctioned source, inside your permissions, that every tool can answer from.

Where we are today.

Groundwork runs in production in our own shop, and every client deployment includes a review of your access model before anything goes live. We don't hold a SOC 2 report today. If your organization requires one, tell us early and we'll walk through what we can document.

Questions IT teams ask

Does Groundwork see everything on our server?

No. It reads finalized documents you've chosen to include, and each person only sees what their existing permissions allow.

How do people sign in?

Through your existing identity provider, via WorkOS. Your multi-factor and password policies apply, and disabling someone's company account removes their Groundwork access.

Where is our data stored?

In Amazon S3, in AWS's US West (Oregon) region, encrypted at rest and in transit. A dedicated AWS account per company is available.

Is our data used to train AI models?

No. Ingestion runs on a privately hosted model, and your material isn't sent to public AI services to train them.

Can we keep departments separate?

Yes. Departments can be firewalled at setup, and access starts closed by default.

Does it change our source files?

No. Groundwork reads from your documents. AI chats don't edit them.

Do we need to involve our IT provider?

We recommend it. Groundwork works best when your files and permissions are already in good order, and your IT partner usually owns both.

Do you have SOC 2?

Not today. Tell us your requirements up front and we'll be direct about what we can and can't document.