Skip to content
Book a risk assessment

Trust.

How we protect you, and how we protect ourselves.

You're letting us into your business. This is exactly what we can reach, how we reach it, and what we can never do.

  1. 1 · Who
    A named analyst
    Vetted, trained, on a managed and encrypted device.
  2. 2 · Sign-in
    Phishing-resistant MFA
    Every time, from a known device. No shared accounts.
  3. 3 · Access
    Just in time
    Approved for one job, scoped to it, and gone in hours.
  4. 4 · Your environment
    Read-only by default
    Changes only with your approval, or within limits you set.
Every step lands in your activity log, with who, what, when and why. You can see it in your portal at any time.
The limits

What we can do in your environment, and what we can't.

We can

  • Read your alerts, logs and security settings
  • Act within the limits you set: end a session, isolate a device, pause an account
  • Make changes you've approved, in a window you've agreed
  • Recommend anything else, with the reason and the risk of not doing it

We can't

  • Hold standing admin access to anything
  • Make a change you haven't approved, in advance or on the day
  • Open the content of your email or files, unless an investigation needs it and you agree
  • Keep any access after you leave
Where your data lives

Your security data stays in your accounts. The portal holds summaries only.

Logs and detections live in your own Microsoft tenancy, in the region you already use. The portal keeps summaries in the region agreed when you sign.

Your tenancy

Logs and detections
Microsoft Sentinel and Defender, in your own subscription

We reach it through delegated access you can see and remove. If you leave, everything stays with you.

Your portal

Summaries only
Google Cloud

Encrypted at rest and in transit. Retention set to match your privacy and industry rules.

The portal holds
  • Incident summaries and verdicts
  • Your Known Normal
  • Risk register, roadmap and reports
  • Contacts, portal users and your activity log
The portal never holds
  • Raw logs. They stay in your security platform
  • The content of your email or documents
  • Passwords, keys or other secrets
  • Card or bank details
Who else touches it
Google CloudHosts the portal
Atlassian Jira Service ManagementTracks incidents and requests between our analysts and you
Our own security

We hold ourselves to the standard we set for you.

A security provider is a target. Here's what we run on ourselves.

  • Phishing-resistant MFA for every staff accountIn place
  • Separate admin accounts, used only with just-in-time approvalIn place
  • Managed, encrypted devices for anyone with accessIn place
Privacy

Privacy in plain English.

The short version of what personal information we handle. The full policy covers the privacy laws that apply to you in detail.

What Why Where
Contacts and portal usersTo reach you and let your team sign inYour portal region
Names and roles in security summariesTo decide alerts and explain incidentsYour portal region
Staff progress in HabitsTo show progress by teamYour portal region
Billing contactsTo invoice you. Kept as tax law requires.Our billing records
Your rights

Ask to see, correct or delete what we hold about you. The privacy policy explains how.

Full policy

Read the privacy policy

Groundwork needs no access at all.

Start with a questionnaire and a workshop. Decide what access, if any, to grant once you've seen the report.

Book Groundwork