This site holds one
thing: your request
for a briefing.
You're probably here to work out how much attention this domain needs before you let a colleague fill in the form. The short answer is below, followed by the longer one.
Maintained by Groundwork · last updated 31 August 2026 · security@groundwork4ai.com
The site itself
groundwork4ai.com is a static marketing site. Pages are built ahead of time and served as files. There is no login, no customer account, no database of customer records, and no product data of any kind on this domain. Nothing you can reach from the navigation reads or writes a customer system.
It's served over HTTPS. The only dynamic path is the briefing form's submission endpoint, described next.
How briefing-form data is handled
The form collects name, work email, company, role, domain of interest and free text. On submit, the fields are validated server-side and sent as a single email to briefings@groundwork4ai.com through Resend, our transactional email provider. Your address is set as the reply-to so a person can answer you directly.
The submission is not written to a database on this site, not pushed into a CRM, and not enriched against a third-party data source. Transport to the email provider is over TLS.
Who can see it
The Groundwork team members who run briefings, in the briefings@groundwork4ai.com inbox. No contractors, no agency, no sales-tooling vendor. We keep requests for up to 24 months and delete on request — see the privacy notice.
Analytics and third parties
Plausible runs on most of this site, but not on our contract documents under /legal, which load no analytics at all. It is cookieless, stores no identifiers, and cannot follow an individual across sites. There are no advertising pixels, no session recording, and no chat widget. The full third-party list for this domain is two entries long: Plausible for analytics, Resend for the one email the form sends.
Reporting something
If you find a vulnerability in this site, email security@groundwork4ai.com with enough detail to reproduce it. We'll acknowledge you, fix it, and credit you if you want the credit. Please don't run automated scans that degrade the site for other people, and don't access data that isn't yours.
What this page is not
This is content we maintain about our own site. It isn't an audit, a certification, or independent verification, and we don't claim any here. Where we hold something formal, we'll name it and show you the paperwork.
How the product handles credentials
That's about this website. The question you're really here for is how the product connects to your systems, so here is the short version. Credentials for a source connection live on a custodian surface that is write-only — entered once, never displayed back, not to us and not to the person who entered them. The data steward who signs off on what a field means never touches a secret and has no surface on which one is visible. They are two different jobs, and the product enforces the separation rather than recommending it.
Least privilege is a check, not a policy. When a connection is registered with a credential that can write to your system, the registration is refused — not accepted with a warning, not flagged for later. A connection that could change your data is not a connection we will hold.
Separation of duties, enforced in the surface. Not a policy document.
Request the
governance appendix.
The questions a reviewer actually has — how permissions are declared and enforced, what the gate checks before a build ships, what evidence a run leaves behind, how rule ownership sits with the domain team — are answered about the product, not about this website. We keep those answers in a governance appendix and send it to reviewers who ask. It goes further than the section above.
Ask on the contact form and say you want the appendix. A person will send it and take your questions.
Sent by a person, to a named reviewer, on request.