Trust Center

Trust, engineered in.

Every capture and document on this platform belongs to one customer and stays with that customer. We are early and hold no attestations yet, so this page claims only what the platform actually enforces — and says plainly what does not exist. These are the answers your client's security review is going to ask for, and your reviewers are welcome to test every line of them.

Encryption: TLS 1.3 · AES-256
Record: NOTHING OVERWRITTEN · DATED AT CAPTURE
Isolation: PER TENANT · ENFORCED
Attestations: NONE YET · SAID PLAINLY

How GR Brain is governed

Security posture

Claimed only when enforced.

We hold no attestations yet and would rather say so than imply otherwise. Every tile below states what the platform enforces today, and the evidence behind each one goes to your reviewers on request.

Hover, focus, or tap a tile — each one turns over to what it means for you.

STATUS · NONE YET · SAID PLAINLY
Attestations
We hold no third-party security attestation or certification today — none. We are early, and we would rather say so here than let a badge wall imply otherwise.
CLAIMS · ONLY WHAT IS ENFORCED
AUDITS · WHEN DEPLOYMENTS WARRANT
BADGES · NONE
WHAT THIS MEANS FOR YOU
Attestations
You are not reading a badge wall. You are reading the actual state — the same discipline the record itself is built on: nothing asserted that cannot be shown.
EVIDENCE · THIS PAGE · IN FULL
STATUS · ENFORCED · IN THE PLATFORM
Tenant isolation
One organization, one tenant: separate storage, separate indexes, separate encryption keys. Isolation is the tenancy boundary itself, not a filter in front of shared data.
BOUNDARY · TENANCY · NOT POLICY
KEYS · PER TENANT
SHARED LAYER · NONE
WHAT THIS MEANS FOR YOU
Tenant isolation
Your record cannot leak into anyone else's answers because there is no shared layer for it to leak through — the separation is architecture, not a promise in an addendum.
EVIDENCE · ARCHITECTURE WALKTHROUGH
STATUS · BY DESIGN · EVERY PATH
Encryption
TLS 1.3 on every connection including capture upload, AES-256 at rest across the object store and database, keys rotated on a fixed schedule.
TRANSIT · TLS 1.3
REST · AES-256
KEYS · ROTATED · PER TENANT
WHAT THIS MEANS FOR YOU
Encryption
A frame is protected from the moment it leaves the camera to the moment your reviewer opens it, and the keys that protect it belong to your tenant alone.
EVIDENCE · DATA-FLOW DIAGRAM
STATUS · BUILT IN · FIRST COMMIT
Evidence-grade capture
A capture is dated where it is taken and sealed when the session closes, so the record can show it has not been altered since the moment it was made.
DATED · WHERE IT WAS TAKEN
SEALED · WHEN THE SESSION CLOSED
ALTERATION · PROVABLY NONE
WHAT THIS MEANS FOR YOU
Evidence-grade capture
What the camera saw is what the record holds, provably. Capture is built as a legal instrument from the first commit, not hardened into one later.
EVIDENCE · CHAIN OF CUSTODY
STATUS · ENFORCED · NO EDITS
Nothing overwritten
Every answer carries both dates — what was true, and when the record came to know it. Entries are attributed, agent-written entries are marked, and an estimate is never allowed to overwrite a measurement.
WRITES · ADDED · ATTRIBUTED
ESTIMATE ≠ MEASUREMENT · NEVER MIXED
AGENT ENTRIES · MARKED
WHAT THIS MEANS FOR YOU
Nothing overwritten
Nobody — including us — can quietly revise what the record said in March. Corrections are new entries with their own timestamps, and the original stays readable.
EVIDENCE · THE RECORD'S OWN SPEC
STATUS · SETTLED BEFORE THE ANSWER
Access control
Permission is settled before a question is answered, right down to a single zone — so an answer can never carry anything the asker cannot open.
SETTLED · BEFORE THE ANSWER
GRANULARITY · DOWN TO ONE ZONE
MFA · ENFORCED
WHAT THIS MEANS FOR YOU
Access control
The person who asks the question bounds the answer. A bid nobody should see does not surface in a chat, because the tool that would fetch it refuses first.
EVIDENCE · PERMISSION MODEL

Control sheet · what is enforced todayCS-01 · ENFORCED · NOT BADGED

No badge on this sheet — none exists yet, and we would rather say so. What is drawn is what your reviewers can test: one tenant, a record that only ever adds, access cut to the part of the site, and a log of every answer they can query themselves.

AI governance

Your record. Your permissions. Your audit trail.

The Enterprise AI Brain is not a model with your data baked into its weights. It answers through typed, tested tools that read your record under your permissions — every figure carries units, uncertainty, and provenance, and a number without a source is declined, not invented.

01 / 06
No model trained on your data
Nothing of yours is baked into a model — a model cannot carry provenance, so we refuse the architecture outright. Answers are assembled by typed, tested tools reading your record at the moment you ask, which is why every figure can name its source and nothing about you can surface anywhere else.
WEIGHTS · NONE · TOOLS TYPED
02 / 06
One tenant, one record
Your captures, documents, and outcomes live in your tenant and answer only your questions. Separate storage, separate indexes, separate keys — there is no pooled corpus and no shared layer to leak through. Isolation is enforced by the tenancy boundary in the platform, not by a policy document.
ISOLATION · TENANCY · ENFORCED
03 / 06
Every answer logged
Question, answer, the tools that were called, the documents cited, and the person who asked are written to the record at the moment of the answer, where nothing is ever edited. Retained for the life of the contract and queryable by job, by role, or by date, so you can reconstruct what GR Brain said in March and what it read to say it.
LOG · NEVER EDITED · QUERYABLE
04 / 06
Prepared, then released by a person
Consequential actions — a progress claim, a change order, a bid submission, an incident classification — do not move on a model output. The platform prepares the action with its citations; a named person releases it under your delegation of authority, and the release is part of the same record.
GATES · PREPARED VS RELEASED · DoA
05 / 06
Access down to the part of the site
Permission is settled before a question is answered, right down to a single zone. The asker's access bounds every answer, so a document nobody should see never surfaces in a chat — the answer is refused before it is composed, not filtered on the way out.
ACCESS · SETTLED FIRST · PER ZONE
06 / 06
Unsourceable numbers are declined
Every figure GR Brain returns carries units, uncertainty, and the source it came from. Where the record holds no source, GR Brain says so and declines the number — an unanswered question is cheaper than an invented one, on a bid or in front of an arbitrator.
FIGURES · UNIT · ± · PROVENANCE

What the log holds

The log is not a summary of what GR Brain did. It is the record itself: the question as it was asked, the tools that were called to answer it, every document the answer cited, and whether a person signed it off. Your security team can query it, your reviewers can export it, and nobody at Ground Reality can edit it.

How GR Brain answers

Inference audit record

Timestamp: 2026-03-11T02:41:09Z
Tenant: SPECIMEN-BUILDER · TENANT 0001
Actor: J. OKONKWO · PROFILE 04 / 27 · SUPERINTENDENT
Question: DOES THE LEVEL 14 POUR HOLD IF REBAR SLIPS TO THURSDAY?
Tools: SCHEDULE · POUR-QTY · RFI — TYPED · TESTED
Cited: LOOKAHEAD WK34 · DAILY LOG 03-10 · RFI-0047 · DRAWING A-401 REV C
Disposition: DRAFT · SIGN-OFF REQUIRED · APPROVER UNSET
Retention: CONTRACT TERM · EXPORT JSON · PARQUET

Platform controls

The controls, in full.

Reality capture is heavy data and construction records outlive the projects they document, so the platform is built to keep both for years and hand them back intact. These are the answers your questionnaire is going to ask for.

100%

Answers written to the log, never edited

Tenant per record — no shared layer

Figures shipped without provenance

Platform security controls, how each one is implemented, and the evidence available to reviewers.
Control	Implementation	Evidence
Identity	Sign-in through your identity provider, enforced multi-factor, and permissions scoped to the object rather than the module — down to geometry-level ACLs on the record itself.	PERMISSION MODEL · ON REQUEST
Encryption	TLS 1.3 in transit including dock and robot upload, AES-256 at rest across object store and database. Keys are held per tenant and rotated on a fixed schedule.	DATA-FLOW DIAGRAM · ON REQUEST
Network	Private subnets with no public database endpoints, egress allowlists per environment, and administrative access only through short-lived brokered sessions.	ARCHITECTURE · WALKTHROUGH
Monitoring	Structured logging and alerting across platform services, anomalous access flagged for review, and a standing invitation to report what we missed — disclosure is acknowledged inside one business day.	DISCLOSURE · ACK 1 BUS. DAY
Resilience	Backups with point-in-time recovery, restores exercised rather than assumed, and recovery objectives stated in the contract — a record meant to outlive its projects has to come back intact.	RECOVERY OBJECTIVES · IN CONTRACT
Personnel	Least-privilege access for a small, named team, reviewed on a fixed cadence, security training for everyone who touches the platform, and production access revoked on departure.	ACCESS REVIEW · ON CADENCE
Vendors	Every subprocessor is reviewed before it touches customer data, listed with the data it processes and the region it runs in, and changed only after thirty days written notice to you.	SUBPROCESSORS · NOTICE 30D

Disclosure & suppliers

Tell us what we missed.

Security work is public work. Here is how to reach the people who fix things, who we depend on to run the platform, and which documents we will send your reviewers before a contract exists.

Responsible disclosure

Report a vulnerability to our security team directly. We acknowledge inside one business day, triage inside three, and keep you on the thread until it is closed. Good-faith research against your own tenant has safe harbour, and we credit any researcher who wants to be named.

security@groundreality.ai

Subprocessors

Every subprocessor is listed with the data it processes, the region it runs in, and the reason it exists. We give thirty days written notice before adding or changing one, so your review happens before the change, not after it.

Request the current list

Document set

How the platform is put together, where data flows, who can see what, the record's own specification, this page in questionnaire form, and our data-processing terms. Sent on request — and we say plainly which documents do not exist yet.

trust@groundreality.ai

Trust, engineered in.

Claimed only when enforced.

Attestations

Tenant isolation

Encryption

Evidence-grade capture

Nothing overwritten

Access control

Your record. Your permissions. Your audit trail.

No model trained on your data

One tenant, one record

Every answer logged

Prepared, then released by a person

Access down to the part of the site

Unsourceable numbers are declined