GroundworkGroundwork
Get a demo

Security

Last updated: August 2026

Groundwork handles project, financial, and payroll-adjacent construction data, so security is a design constraint, not a checklist. This page summarizes our practices at a level appropriate for a prospective customer's security review; a fuller technical questionnaire or SOC 2 report is available under NDA on request.

Encryption

  • All traffic to and from the Service is encrypted in transit (TLS).
  • Data at rest is encrypted using provider-managed disk/volume encryption.
  • Application-level encryption is applied to particularly sensitive fields (e.g. certain financial and identity data).

Access Control

  • Role-based access control at both the application and database layer.
  • Row-level tenant isolation for multi-tenant deployments, enforced at the database layer, not just the application layer.
  • Least-privilege access for Groundwork staff; production access is logged and time-bounded.

Audit and Integrity

  • Append-only, hash-chained audit logging on financial journal entries and other sensitive record types, so tampering is structurally detectable, not just logged.
  • Activity logs covering authentication, permission changes, and record-level access to sensitive modules.

Deployment Options

Groundwork can run as a hosted multi-tenant SaaS, or self-hosted by the customer under a separate license. Customers with the strictest data-residency or air-gap requirements can run the platform entirely within their own infrastructure.

Data Portability

Because the platform is built on an open, AGPL-3.0 core, customer data is never locked behind a proprietary export format. Standard export paths (CSV, XLSX, JSON, PDF) are available for all major record types at any time.

Vulnerability Reporting

Report a suspected vulnerability to security@groundworkai.io. We aim to acknowledge reports within 2 business days.

Compliance Posture

Groundwork maintains an internal control-mapping program against FedRAMP Moderate (NIST SP 800-53 Rev. 5), CMMC Levels 1–3 (NIST SP 800-171 / 800-172), and the AICPA SOC 2 Trust Services Criteria. This is a self-assessed readiness posture, not a claim of current certification. Groundwork is not currently FedRAMP-authorized, CMMC-certified, or SOC 2-audited. Details available on request.