Security at Groundbook AI
Last updated: 2026-10-10
Groundbook AI processes construction drawings, specifications, calculations, and other project information. We use administrative, technical, and organizational safeguards designed to protect that information while operating the Service.
1. Cloud infrastructure and encryption
- Our primary production application and customer data storage are hosted in the United States on Amazon Web Services (AWS).
- Customer files, the production database, and database backups are encrypted at rest.
- Data transmitted to and from the Service is encrypted using TLS.
- Customer file storage and the production database are private and are not directly accessible from the public internet.
- Organizations that cannot use cloud hosting can run Groundbook AI on-premises. Contact support@groundbook.ai to discuss your requirements.
2. Identity and access controls
- Groundbook AI verifies user identity and authentication before granting access to the application.
- Project data is available only to the project owner and users granted access through the applicable organization or project. Other customers cannot access your projects.
- Our production services use scoped AWS roles to limit access to the resources each service needs. Production secrets are stored in AWS Secrets Manager.
- Enterprise organizations have an audit trail and granular access levels for their members and projects.
- Single sign-on (SSO) and multi-factor authentication (MFA) are available upon request. Contact support@groundbook.ai to discuss your organization's requirements.
3. Customer data ownership and permitted use
You own your documents and project data. Uploading files does not transfer ownership or intellectual property rights to us. You or the original rights holders retain those rights. As between you and us, you own your project-specific findings and reports. We own the application, software, and improvements to them.
- Your project data is not used for model training. We do not use Customer Project Data or de-identified evaluation data to train models, and we do not permit our service providers to do so.
- We store and process your data only to provide and maintain the Service. Authorized personnel may review it when needed for support, quality assurance, debugging, and internal evaluation. Your project data remains confidential.
- Service providers may process information only to deliver services on our behalf and must protect it under their applicable contractual obligations. No AI model provider we use may train models on Customer Project Data, either under its commercial terms or under account settings we control. Our current service providers are listed in our Privacy Policy.
- We do not sell personal information or Customer Project Data, and we do not make Customer Project Data available to other customers.
For details about ownership and permitted use, see our Terms of Service and Privacy Policy.
An NDA is available on request. You can email your NDA to support@groundbook.ai for review, or tell us your requirements and we can provide ours. Your project data remains confidential whether or not a separate NDA is signed.
4. Application and deployment security
- File uploads use time-limited URLs, and uploaded documents are validated before processing.
- Our web application uses security headers that enforce HTTPS and help protect against framing, content-type confusion, and unnecessary browser permissions.
- Web changes pass automated tests, linting, and a production build before deployment.
- Production deployments use short-lived credentials, and production container images are deployed by immutable digest.
5. Backups and deletion
Encrypted automated database backups and versioned object storage support recovery from user or system error. Data you delete in the app can be restored for 90 days in case it was deleted by mistake; after 90 days it is removed from our file storage and backups.
To request permanent deletion of Customer Project Data right away, email support@groundbook.ai. Copies inside our encrypted database backups expire within 90 days. For additional information about retention and deletion, see our Privacy Policy.
6. Report a security concern
If you believe you have found a security issue involving Groundbook AI, email support@groundbook.ai with a description, steps to reproduce, and any affected URLs. Please do not include Customer Project Data or other sensitive information unless it is necessary to explain the issue.
For other security questions or to discuss your organization's requirements, contact support@groundbook.ai.
7. Common security questions
Is it safe to upload confidential construction drawings to an AI review?
Confidential sets are the normal case, so the controls are built for them. Customer Project Data is encrypted in transit and at rest, hosted on AWS in the United States, visible only to the people you invite or your organization, and never used to train models. Review this page and your own confidentiality obligations before uploading a set covered by an NDA.
Where is my project data stored?
On Amazon Web Services infrastructure in the United States, unless your organization runs Groundbook AI on-premises. For cloud-hosted projects, backups are kept in the same region and copied to a second US region. Data centers are operated by AWS under its own compliance programs; application access is controlled by Groundbook AI.
Do AI models train on my drawings?
No. No AI model provider we use may train on Customer Project Data, either under its commercial terms or under account settings we control, and Groundbook AI does not use your project documents to train models or make them available to other customers.
Who can see a project I upload?
Only you, the people you invite by email, and members of your organization if your account belongs to one. Projects are not public, there is no public share link, and Groundbook AI staff access is limited to what is needed to operate and support the service.
Can we review your security terms before uploading anything?
Yes. This page, the Privacy Policy, and the Terms of Service describe the commitments. For organization-specific requirements, security questionnaires, or an agreement review, email support@groundbook.ai.