Security practices
Security is handled as part of architecture and delivery, with controls matched to the system, its data, and its risk.
Last updated August 12, 2026
Website safeguards
The public Groundcrew website is served over HTTPS and uses security headers that restrict framing, mixed content, browser permissions, and unapproved content sources. Forms use server-side validation and abuse controls where appropriate.
Project access
Access to client systems is limited to the people and environments needed for the agreed work. We prefer named accounts, least-privilege permissions, separate development environments, and client-owned repositories and production accounts where practical.
Secrets and production data
API keys, database credentials, and deployment secrets should be stored in approved environment or secret-management systems rather than committed to source control. Production data access is scoped to the engagement and avoided when representative test data is sufficient.
Engineering controls
Security requirements vary by product, but common controls considered during delivery include:
- Authentication, authorization, tenant isolation, and role boundaries
- Input validation, rate limits, webhook verification, and safe error handling
- Dependency review, logging, backups, and deployment separation
- Pull-request review, testing, and documented handoff
AI models and data handling
Agents run on OpenAI and Anthropic models accessed through their standard business APIs. Client data sent to these providers is not used to train their models, consistent with their standard API terms. Important actions wait for a person's approval before anything runs unsupervised, which is a design choice built into every agent, not just a policy statement.
Client data is retained only for as long as the engagement needs it and is removed from Groundcrew-managed systems after offboarding, unless the client asks for a different retention arrangement in writing. If an incident affecting client data occurs, we notify the affected client promptly with what is known and what is being done about it.
Responsible reporting
If you believe you found a security issue affecting an Groundcrew-owned public system, email hello@groundcrew.studio with the affected URL, a clear description, and safe reproduction steps. Do not access, alter, download, or disclose data that does not belong to you.
Engagement-specific controls
This page describes general practices, not a certification or a guarantee that every client system uses identical controls. Security scope, compliance obligations, testing, incident handling, and support commitments are documented separately for each engagement.
Questions about this page can be sent to hello@groundcrew.studio. You can also use the contact form.
Questions about security? Book a call.