Security
Every claim below verified against the running system · 1 November 2026
Groundplane asks you to put a collector inside a network you are answerable for. That is a reasonable thing to be careful about. This page states what the product actually does, how each statement was checked, and, in its own section, what Groundplane is not and does not hold.
Where your data is
United States (us-east-2, Ohio)
All customer data is stored in a single United States region. There is no replication outside the United States.
What is enforced
Collector tokens cannot be recovered from the database
A collector authenticates with a 256-bit token. Only the SHA-256 of that token is stored. A full database dump yields nothing that can be replayed against the ingestion endpoint.
Verified by · Column inspection and function read on the live database.
Enrolment codes are single-use and expire
An enrolment code carries 48 bits of entropy, works exactly once, expires after 24 hours, and is selected under a row lock so two collectors cannot race the same code. It is erased from the row the moment it is used.
Verified by · Function definition read on the live database; entropy computed from the generator.
The audit trail cannot be edited by the people it records
Every action against an environment records the actor, their email and the time. The table has row-level security enabled and forced, with a read-only policy and no insert, update or delete path for any user. Only the database trigger writes it. Retention cannot be set below 90 days.
Verified by · Policy inspection on the live database; the 90-day floor was tested by attempting to set a lower value.
One tenant cannot read another
Separation is enforced in the database with row-level security, not in the interface. It was tested adversarially as a real signed-in user from one tenant attempting to read another across 19 different paths, with a control proving the same user does see its own data.
Verified by · Live adversarial query as a non-privileged user. 19 paths, zero foreign rows.
Two-step sign-in is available on every account
Time-based one-time codes, enrolled from account settings. When a factor is present, the application refuses to render until it is satisfied. The second step is enforced at the gate, not offered as a setting that changes nothing.
Verified by · Enforcement is covered by tests that fail closed on a missing or malformed assurance level.
No service keys reach the browser
The shipped site carries one publishable key. That key is a public identifier and grants nothing without a signed-in session, because every tenant table enforces row-level security regardless of which key made the request. No service-role key, no Stripe secret, no private key material.
Verified by · Pattern scan of the built bundle, with the scanner itself tested against planted secrets first.
The collector does not take secrets, and the stored record shows it
Groundplane records what a device reports about itself: ports, VLANs, neighbours, learned addresses, software versions and control state. It does not collect passwords, pre-shared keys, API keys, private keys or SNMP community strings. Where a device reports that a secret is set, the record stores that it is set and never what it is.
Across the stored collector reports in production, 1,103 reports and 13 MB of payload, there are zero secret-shaped fields, zero private-key blocks and zero configuration lines containing a credential. The search was checked against known-positive samples before it was run, so the zero means the search works.
What Groundplane is not
If any of these is a requirement for you, it is better that you know now than after a procurement review.
Groundplane holds no compliance certification
No SOC 2, no ISO 27001, no FedRAMP authorisation. If a certification is a requirement for you, Groundplane does not meet it today and this page will say so until it does.
It is not authorised for classified or CUI environments
Groundplane is a commercial cloud service. It is not FedRAMP authorised and is not suitable for classified systems or for environments where configuration data is itself controlled unclassified information. Ask before deploying it where that is in question.
It does not scan for vulnerabilities
Groundplane records what an environment is and what changed in it. It does not probe for known vulnerabilities, it is not an endpoint protection product, and it does not watch traffic.
It cannot reach into your network
There is no remote shell. The collector reports outward and accepts no inbound connection. Configuration changes happen only through a console cable, in your browser, with a person confirming each one in the session.
Evidence for an assessment
Groundplane produces evidence for an assessment. It does not make anyone compliant, and no part of it should be read as a certification. Where a framework asks you to show what a system is and how it changed, these are the questions Groundplane can answer with a record rather than an assertion.
- Inventory and baseline configuration
- What exists, read from the device rather than typed from memory, with the time it was observed and which collector saw it.
- Change control
- What was intended, the commands it produced, what the checks said at the time, what the device replied, and who confirmed it. Frozen once it reaches a device.
- Coverage of what was assessed
- Measured over total, with the unmeasured items named. A control that could not be read is excluded from the score and reported as unread, never counted as a pass.
- Accountability
- Every action recorded against an individual, in a trail that individual cannot edit.
Who else touches your data
Groundplane runs on four third parties. This is all of them.
Supabase
United States (us-east-2)Database, authentication and file storage
Holds the environment records, observations, findings and issued reports.
Cloudflare
Global edge, origin in the United StatesStatic site hosting and content delivery
Serves the application and marketing pages. No customer records are stored here.
Stripe
United StatesSubscription billing
Holds billing contact and payment details. Card numbers never reach Groundplane’s own systems.
Google Fonts
GlobalWeb font delivery
Loading a page requests two fonts from Google, which receives the visitor’s IP address. No account or environment data is involved.
Reporting a vulnerability
If you believe you have found a security issue in Groundplane, write to security@groundplanes.com with enough detail to reproduce it. We will confirm receipt, and we will not pursue anyone who reports a genuine issue in good faith and does not access, modify or retain other people’s data while finding it.