Every client environment has a history.
Groundplane keeps it.
You are answerable for networks you did not build, inherited from people who did not document them, and are asked about months after the fact. Groundplane is where you document each one from the switch itself, make the changes it needs, and keep the record of both, including what it could not measure.
Configuration happens where you already are: a console cable, in the browser, with the commands checked against the device’s live configuration before a single line is sent. There is no remote shell, no agent that changes anything, and nothing is pushed without a person confirming it in the session.
Some of your clients answer to somebody else. When one is asked what their network looked like in June, which controls were in place and which were never measured, the June record answers it. Groundplane produces that evidence. It does not certify anyone against anything, and it says so plainly on its own security page.
It is not an RMM and it does not replace one.
The switch documents itself
A console cable and one button. Groundplane runs the show commands, reads back the model, serial, ports, VLANs, trunks, neighbours and configuration, and strips every password before any of it is stored. The port map stops being a spreadsheet you maintain by hand.
Changes that are checked before they are sent
Pick ports, say what should be true, and the commands are written for you, then checked against the live configuration. DHCP snooping with no trusted uplink, the last local user removed, a limit of one MAC on a port with a phone and a PC behind it: blocked or flagged before anything reaches the device.
A portfolio, not a pile of tabs
Every client and every environment on one table, sorted so whatever needs you is at the top. Reporting collectors, stale collectors, critical findings, recent changes, coverage and the date of the last report you issued.
Collector state you can trust
Reporting, stale, never reported, revoked or error. A stale collector is never drawn as current, and a working collector is never presented as a healthy environment. Those are two different questions and they get two different answers.
Findings that carry their evidence
Every finding shows the observation it came from, the evidence underneath it, the assessment and the recommendation, with the time it was observed and which collector saw it. Nothing asks you to take its word for it.
Coverage, stated as a fraction
Controls measured over controls total, with the unmeasured ones named. A control that could not be read is excluded from the score and reported as unread, never counted as a pass. You can tell a client what was not checked.
Change history worth reading
A device appearing, a device going missing, a control moving from pass to fail, a firewall changing state. Before, after, when, and which collector saw it. Enough to answer "was it already like that in June" from the June record.
Reports you can hand over
An issued report is an immutable snapshot: it freezes the environment, the coverage, the findings and the observation time, and it carries your own name and mark. It still reads correctly a year later.
Client isolation in the database
One client’s environments, findings and reports are not readable from another client’s context, and an environment cannot be filed under a client belonging to another firm. The separation is in the schema, not in the interface.
Operator is the plan for this. Ten client environments included, client and environment switching, per-client isolation, and your own mark on issued reports.
$349 / month. Additional environments arranged directly.
Know what you are standing on.
Groundplane turns infrastructure reality into a reference you can explain.