Security and privacy
Your acquisition targets are not our training data
A land intelligence platform holds a list of the properties you are about to bid on. That is among the most commercially sensitive data a developer has.
Commitments
- We do not train models on customer data, and we do not sell it
- You own your queries, uploads, projects, assumptions and generated reports
- Configurable retention, with permanent deletion that actually deletes
- Confidential project mode disables share links and strips project identifiers from operational logs
- Enterprise data processing agreement with a published subprocessor list and change notice
- Encryption in transit and at rest; per-organisation isolation enforced in the data layer, not in route handlers
- Administrative access to customer data is logged to an append-only audit sink and reviewed
- Setting the Copilot provider to deterministic makes zero outbound AI requests — the full workflow runs with no model provider involved
Programme
| Area | Control | Status at launch |
|---|---|---|
| Access | Role-based access control, least privilege, MFA | RBAC and MFA on every plan; single sign-on available on Enterprise |
| Tenancy | Organisation scoping enforced in the persistence layer; cross-tenant access raises rather than returns empty | At launch, with automated tenant-isolation tests |
| Encryption | TLS 1.2+ in transit, AES-256 at rest, managed key rotation | At launch |
| Secrets | Managed secret store, no secrets in source or images | At launch |
| Audit | Append-only audit log of authentication, authorisation, data access and administrative action | At launch |
| Vulnerability management | Dependency and container scanning in CI, patch service levels by severity | At launch |
| Penetration testing | Annual third-party test, remediation tracked to closure | Before first municipal contract |
| SOC 2 Type II | Full control set with a named auditor | Target: month 18 |
| Incident response | Documented plan, named roles, customer notification commitments | At launch |
| Backup and recovery | Point-in-time recovery, restore tested quarterly | At launch |
A dependency you cannot audit is a risk you cannot manageThe Groundline analysis core, report generator and API run with zero third-party runtime dependencies. Report generation handles the most sensitive data in the product; giving it a large dependency tree would put the highest-value asset behind the widest attack surface.