Know what you are standing on.
Groundplane establishes what a technology environment currently is, records what changes against that reference, and keeps the evidence behind both.
- Knownwhat exists
- Changedwhat moved against the reference
- Evidencehow we know
- Unmeasuredwhat remains unestablished
Observe. Measure. Record.
Deploy a collector.
One collector runs inside the environment and belongs to it alone. It enrols with a single-use code, holds its own token, and reports outward over HTTPS. No inbound ports, no VPN, no credentials collected.
Nothing is known yet.
Watch the reference.
Each observation establishes what exists and grades what could be measured. Controls that could not be read stay unread rather than counted as passing, and what moves against the reference is recorded with the evidence behind it.
Measured regions resolve. Unmeasured regions stay open.
Hand off the evidence.
An issued report freezes the environment, its coverage, its findings and the moment it was observed. It carries your mark, it does not change afterwards, and it still reads correctly a year later.
The reference becomes a record.
The reference, in your hands.
Everything on the record.
Sites, assets, addressing and circuits. Every device carries an identifier, an address, a location and a support horizon, so a finding has somewhere to attach and a report has something to count.
| Asset | Identifier | Address | Site | Status | End of support |
|---|---|---|---|---|---|
| Edge firewall | FW-HQ-01 | 10.7.20.1 | HQ | up | 2029-06-30 |
| Core switch | SW-HQ-CORE | 10.7.20.10 | HQ | up | 2028-11-30 |
| Access switch | SW-BR-01 | 10.7.20.11 | Branch | up | 2027-03-31 |
| Wireless controller | WLC-HQ | 10.7.20.12 | HQ | degraded | 2027-09-30 |
| Hypervisor | ESX-DC-02 | 10.7.20.13 | Data Center | up | 2030-01-31 |
A claim, and what it rests on.
Each finding carries the observation, the evidence behind it and the recommended action, in that order. Nothing asserts a state without naming where the state came from.
What is watching, and from where.
A collector belongs to exactly one environment and cannot report to another. Enrol it with a code that works once, revoke it whenever you like, and see the moment it stops reporting.
| Collector | Location | State | Last reported |
|---|---|---|---|
| hq-desk | HQ | Reporting | 1 min ago |
| branch-nas | Branch | Reporting | 4 min ago |
| dc-jump | Data Center | Awaiting enrollment | never |
Including what nobody looked at.
Unmeasured is a first-class state. A control that could not be read is excluded from the score and reported as coverage, so a high number on thin coverage never passes for a strong posture.
The three unmeasured controls are excluded from the score rather than counted as passes. A score is only defensible if the method is visible.
Groundplane for MSPs
Every client environment has a history.
Groundplane keeps it.
You are answerable for networks you did not build, inherited from people who did not document them, and are asked about months after the fact. Groundplane keeps an evidence-backed record of each one: what exists, what changed, what needs attention, and what it could not measure.
It is not an RMM and it does not replace one. There is no remote shell, no remediation, no agent that changes anything on the host. Groundplane observes and keeps the record. That is the whole job.
A portfolio, not a pile of tabs
Every client and every environment on one table, sorted so whatever needs you is at the top. Reporting collectors, stale collectors, critical findings, recent changes, coverage and the date of the last report you issued.
One reference per environment
Sites, assets, addressing and lifecycle on record for each environment you manage, kept current by a collector that sits inside the network rather than by someone remembering to update a spreadsheet.
Collector state you can trust
Reporting, stale, never reported, revoked or error. A stale collector is never drawn as current, and a working collector is never presented as a healthy environment. Those are two different questions and they get two different answers.
Findings that carry their evidence
Every finding shows the observation it came from, the evidence underneath it, the assessment and the recommendation, with the time it was observed and which collector saw it. Nothing asks you to take its word for it.
Coverage, stated as a fraction
Controls measured over controls total, with the unmeasured ones named. A control that could not be read is excluded from the score and reported as unread, never counted as a pass. You can tell a client what was not checked.
Change history worth reading
A device appearing, a device going missing, a control moving from pass to fail, a firewall changing state. Before, after, when, and which collector saw it. Enough to answer "was it already like that in June" from the June record.
Reports you can hand over
An issued report is an immutable snapshot: it freezes the environment, the coverage, the findings and the observation time, and it carries your own name and mark. It still reads correctly a year later.
Client isolation in the database
One client’s environments, findings and reports are not readable from another client’s context, and an environment cannot be filed under a client belonging to another firm. The separation is in the schema, not in the interface.
Operator is the plan for this. Ten client environments included, client and environment switching, per-client isolation, and your own mark on issued reports.
$349 / month. Additional environments arranged directly.
One price per environment.
An environment is one managed technology scope: a site, an office, a plant. It is what a collector reports on and what a report covers, so it is what you are billed for. Not devices discovered, not seats, not agents.
Watch
1 environment
One environment, documented and measured.
- 1 environment
- 90 days of history
- Assets, sites and addressing
- Findings with evidence and coverage
- Issued PDF reports
Managed
Up to 5 environments
Everything on the record, and the work that happened to it.
- Up to 5 environments
- 1 year of history
- Everything in Watch
- Environment comparison
- Change record
- Incident log
Operator
10 client environments included
Additional environments arranged directly
Built for firms managing multiple client environments.
Start Operator Pilot- 10 client environments included
- Client and environment switching
- Per-client isolation
- 2 years of history
- Everything in Managed
- Your own mark on issued reports
Operator Scale
$749 / month
30 client environments included
For a portfolio large enough that client review is a weekly rhythm.
Talk to salesEnterprise
Custom
Priced on the shape of the estate
Governance and scale for large portfolios, regulated organizations and internal security teams.
Talk to GroundplaneEnvironments beyond your plan are never blocked: a collector that starts reporting is never turned away for a commercial reason. They are not billed automatically either. We see the count and come to you. One collector belongs to exactly one environment, and an enrolment code only ever works where it was issued.
Know what you are standing on.
Groundplane turns infrastructure reality into a reference you can explain.