How we protect your agency’s data

Summary

• Workspace content is encrypted in the user’s browser. Our servers store only encrypted content and the account details needed to run the service.
• Nobody at Ground Truth Advisors can read your workspace content, and neither can anyone who breaks into our servers.
• Administrators and approvers sign in with passkeys and confirm high-stakes actions with them again.
• Every approval and change is recorded in a tamper-evident, signed audit trail that you can export and check yourself.
• AI features send nothing without the user’s consent for that request. Neither we nor the model provider keep what’s sent, and it’s never used to train models.
• The service runs on Amazon Web Services in the United States, and your data stays in the United States.

Your content is encrypted before it leaves your browser

Answers, notes, tasks, evidence, plans, rosters, and uploaded files are encrypted in the browser with AES-GCM, using the browser’s built-in cryptography (Web Crypto). The key that unlocks a workspace comes from a passphrase (strengthened with Argon2id) or a passkey. It exists in usable form only in the browser while the workspace is open.

Our servers store encrypted content plus the limited information needed to run the service: users, roles, due dates for reminders, licenses, and audit fingerprints. A breach of our servers or database would not reveal workspace content.

Because we don’t hold your keys, we can’t recover a workspace if every way of unlocking it is lost. Each workspace gets a recovery key at setup, and we encourage each administrator to register at least two passkeys.

Email we receive for you

Some products give a workspace its own address for forwarding vendor replies. Those messages are encrypted to the workspace’s key as soon as they arrive, and the readable copy is deleted.

Signing in

• Email sign-in that works with mail scanners. The emailed link opens a page with a Sign in button, and the email also carries a six-digit code. Links and codes are single-use, expire quickly, and are stored only as hashes. Security scanners that open links can’t use them up.
• Passkeys where it matters. Administrators and approvers must register a passkey. They confirm it again before approving changes, opening gates, adding or removing users, changing roles, granting support access, rotating keys, or exporting the audit trail.
• Visibility. Each new sign-in triggers a notice email. Users can see their active sessions and end any of them.
• Agency single sign-on. Multi-Agency licenses can sign in through the agency’s own identity provider using SAML or OpenID Connect. Your identity provider confirms who a user is. It can’t unlock workspace content, and passkeys are still required for high-stakes actions.

Our servers check every request against the user’s workspace and role, so one agency’s users can’t reach another agency’s data.

A tamper-evident audit trail

Each audit entry is signed by the person who acted and linked by hash to the entry before it. Our server adds a receipt with a trusted timestamp, signed with a key held in AWS Key Management Service. Entries can be added but not changed or removed. You can export the audit trail and verify it offline, without relying on us.

AI features

AI features are available only when your order includes them, and your administrator can turn them off.

• Consent each time. Nothing is sent to an AI model unless the user agrees to send it for that request.
• Screening before sending. Phone numbers and email addresses are flagged, and the user must remove them or confirm the agency is authorized to send them. Numbers formatted like Social Security numbers and payment card numbers block the request, and no user or administrator can override that. Recall rosters and staff contact lists are left out by default.
• No retention and no training. We use Amazon Bedrock in the United States with models that support its no-retention setting. Bedrock doesn’t share requests with model providers or use them to train models. Neither we nor the model provider keep inputs or outputs in any form we can access. You can choose to save results in your workspace as encrypted content.
• People decide. Results are labeled “AI-assisted analysis. Review and verify before use.” The AI never changes a rating, gate, task, or date on its own. A person accepts every change.
• Notice before changes. We give customers 30 days’ notice before changing the model provider or the retention setting.

Data that doesn’t belong in the products

These are planning tools, not systems for live call handling or dispatch. Our agreements prohibit putting in criminal justice information (CJIS), 9-1-1 caller and subscriber records such as ALI data and call recordings, protected health information, payment card data, or Social Security, driver’s license, or financial account numbers.

Where your data lives and who handles it

The products run on Amazon Web Services in U.S. commercial regions, and we store customer content and account data only in the United States. AWS’s U.S. commercial regions hold a FedRAMP Moderate authorization, and our service builds on those infrastructure controls. Ground Truth Advisors doesn’t yet hold its own GovRAMP or FedRAMP authorization.

We tell customers before adding a provider that receives account data. Account data means users’ names, email addresses, organizations, and roles; sign-in and security records; billing records; support messages; and usage information such as counts and error codes. We use it only to provide, secure, bill for, and support the service. We don’t sell it or use it for advertising.

How we build and run the service

Because the server can’t read your data, the code your browser runs is part of the security boundary. We protect it accordingly.

• Every code change is reviewed and must pass automated tests and code scanning before it’s merged.
• Dependencies are pinned to exact versions and monitored for known vulnerabilities.
• Deployments use short-lived credentials, and each production release needs a manual approval.
• A strict content security policy limits the scripts a page can run.
• We record a fingerprint of every file in each release, so a changed file in production can be detected.
• Development, staging, and production run in separate AWS accounts.
• Production access is limited to named individuals who sign in with hardware security keys. All access is logged, and sensitive changes trigger alerts.
• Workspace content is never written to logs, and notification emails contain no workspace content.

We maintain a written threat model and test against it with every release that touches sign-in, encryption, the audit trail, email, or AI.

Backups and recovery

Our database has point-in-time recovery, and stored files are versioned. Backups hold only encrypted content. We test a restore every quarter, including a check that the restored audit trail still verifies.

If something goes wrong

We keep a written incident response plan. If we confirm unauthorized access to your account or to systems that store your content or account data, we’ll notify you without undue delay and within 72 hours, and we’ll work with you on your response.

Export and deletion

You can export your data at any time. When an agreement ends, you have 30 days to export, and we delete your workspace content within 60 days after that. We delete account data within 90 days after the agreement ends, except billing, tax, and audit records the law requires us to keep.

Standalone pilot editions

Pilot editions run as a single file in the browser. Content stays in a file the agency holds and in browser storage, encrypted at rest, rather than on our servers. Pilot AI features use the same consent, screening, and no-retention safeguards as the hosted products.

What comes next

We plan an independent penetration test and a GovRAMP assessment as the products grow, and we’ll update this page when each is complete.

Report a security issue

If you think you’ve found a security problem, email sandi@groundtruthadvisors.com with “Security report” in the subject. We’ll acknowledge your report within three business days. Please don’t access data that isn’t yours or disrupt the service while looking into it. Our security.txt file has the same contact details.

Changes to this page

We may update this page as the products and our safeguards change. Updates won’t materially reduce the protection of customer content. The version and date at the top show the latest change.