Your business data sits at the centre of everything GroundWork does for you. Here's exactly how it's protected — each promise in plain English, and the actual mechanism that backs it.
Good security isn't one wall — it's many, so that no single mistake exposes your data. These are the layers your information passes through, from the network to the individual permission.
Every customer gets a separate application and a separate database. Your system is built so it structurally cannot reach into another customer's data — and theirs cannot reach yours. It's a wall in the architecture, not a setting someone could flip.
When you connect Xero, ProjectWorks, Microsoft or Google, the access keys are encrypted before they're stored, unlocked only for the instant needed to talk to that service, and never sent back to your browser.
You sign in with a one-time link, or with your own Microsoft 365 or Google account. GroundWork never stores a password — so there is no password database for anyone to breach in the first place.
The tokens that let systems talk to each other are stored only as one-way fingerprints. If a database copy ever leaked, it would contain no key anyone could actually turn — the real value is shown once, at creation, and never kept.
Every screen and every action is locked by default and only opened by an explicit grant. Change someone's access and it takes effect on their very next click — no waiting for a session to expire.
Every build is automatically scanned for known security flaws in its building blocks, and blocked if any turn up. We keep those building blocks deliberately few — less code means less that can ever go wrong.
All traffic between you and GroundWork is encrypted end to end using Cloudflare's network-level TLS encryption. And the private calls between GroundWork's own services never travel across the public internet at all — they stay on an internal network.
You can evolve your system just by describing what you want. Every change passes an automated safety check first, anything sensitive is held for a human review before it goes live, and every change is recorded against the person who made it.
Security isn't a claim you make once and frame on the wall. Every build runs through automated security and CVE audits — AI-assisted review tooling probes the code for known flaws and common attack patterns before anything reaches production.
Everything on this page reflects what those checks actually verify in the code. Not a brochure promise: the checked result.
And underneath all of it — your data stays yours.
GroundWork replaces the rented software you'd otherwise scatter your business across. Your information lives in one system you own, that you can export in full at any time. We don't sell it, we don't mine it, and we don't hand it to third parties you didn't connect yourself.
If your IT team or security advisor wants to go deeper on any layer above, we'll walk them through the specifics — mechanism by mechanism.