Your data. Clear boundaries.

You choose the ground.

Bring in the files, pasted email, and project sources relevant to a project. Choose individual Google Drive files using Google's file picker; email from any provider is added only when you paste it. Groundforth does not request access to your entire mailbox or Drive. Read our Google API Limited Use commitment.

Mail and Drive stay in your workspace.

Groundforth Mail processes the business email for the domain you control so your team can send, receive, and organize it in one place. We handle message content, attachments, and metadata only to run the service you request. Outbound email is delivered through Microsoft Azure Communication Services, and the mail service runs on Microsoft Azure. You own and maintain your domain's DNS records; Groundforth does not change them for you. Groundforth Drive stores the files your team uploads, screens uploads with malware controls, and keeps sharing under your control—public links work only while you leave them enabled. Mail and Drive content is customer workspace content: we do not use customer workspace content to train our AI models.

Access follows the project.

Organization membership and project access are separate. Project permissions determine who can see and act on shared work. Roles and scoped guest access help you bring in the right people without opening every project to everyone.

Your work does not train AI.

Groundforth does not use customer workspace content, project sources, messages, documents, or outputs to train our AI models. When you request AI assistance, only the project sources needed for that request are sent to an approved provider for processing.

AI assists. People decide.

AI uses the project sources you select to synthesize, propose, and revise. People review consequential changes and retain responsibility for approval and external delivery. Sources and named versions give reviewers a clearer basis for their decisions.

Protection across the journey.

Groundforth uses access controls, encrypted transport, and infrastructure-managed encryption at rest. Connector credentials receive additional encryption protection. These are distinct from end-to-end encryption: authorized service processing still requires access to project content.

Our policy is that team access to your core work data is not routine. Operational access is restricted to authorized roles and audited paths. If resolving a support request requires us to inspect customer workspace content, our policy is to explain what access is needed and ask for your explicit permission before proceeding.

Uploads go through file validation and malware-screening controls before processing. Access and operational records support investigation and service reliability.

Deletion with a defined window.

Deleted customer content is retained for up to 30 days after deletion for recovery and cleanup, then removed. Records required by law, security investigations, or a legal hold may be retained for the relevant purpose and duration.

Groundforth Inc acts as a controller for account, contact, and service-administration information, and as a processor for customer workspace content processed on the customer's instructions. Our Privacy notice explains the distinction.

Let's talk about your requirements.

For questions about providers, processing locations, contractual data protections, or your organization's security requirements, contact our team. We will discuss the relevant arrangements with you without treating a product feature as a compliance certification.

Report security concerns through our security contact route. Please don't include credentials or sensitive project content.