Privacy Policy
Effective September 6, 2026 · Version 2026-09-06
This policy explains what Groundwork collects through Groundwork(the “Service”), what we do with it, who else touches it and how long it is kept. It is written to be read, not to be survived.
1. Who we are, who this covers, and which hat we are wearing
This policy covers four kinds of people:
- Lender staff — the people who work at a firm that uses the Service, including its outside accountant;
- Investors — people and entities that fund loans through a firm and sign in to see their positions;
- Borrowers and other portal users — the people a lender invites into its borrower portal;
- Visitors — anyone reading our public website.
Two roles, and the difference matters.For everything inside a lender’s workspace — applications, borrower documents, servicing records, investor records, credit reports — the lender decides what is collected and why, and we act as its service provider, processing that data on its instructions and for no purpose of our own. For the account and billing data of the people who sign up with us directly, we are the controller and this policy is our own promise. If you are a borrower or an investor, the firm you dealt with controls your information; §8 explains how to reach both of us.
2. What we collect
- Lender staff. Name, email address, a one-way hash of the password (never the password), an encrypted two-factor secret if the person turns two-factor on, and a record of what they did in the workspace.
- Investors. Identity and contact details, the entity they invest through, tax identification, and banking instructions. Tax ids and banking instructions are encrypted field by field, shown masked, and revealed in full only after the person passes a fresh identity check — and every reveal is written to the audit log.
- Borrowers and portal users.Whatever the lender’s application asks for — identity, contact, income, assets, employment, the property or collateral — together with uploaded documents and messages. Social Security numbers, tax ids and the rest of the sensitive application fields are encrypted field by field.
- Consumer credit reports.Ordered by the lender under its own account with its credit vendor, returned into the lender’s workspace and stored encrypted.
- Payment records. What a borrower paid and when, and what an investor was allocated — recorded by the lender. The Service never moves money and holds no bank credentials for doing so.
- Subscription billing. Handled by Stripe. Card numbers are entered on Stripe and never reach our servers; we keep the subscription state and the invoice history.
- Website visitors. Ordinary server logs, and nothing else. The public website has no analytics, no tracking scripts, no third-party cookies and no embedded images from anyone else.
- Your agreement to these documents. When you accept the Terms of Service and this policy — when you create an account, and again if we publish a material change — we record the version of each document you accepted, the moment you accepted it, the IP address the click came from and the identifier your browser sends about itself. That record is the evidence of what you agreed to, so it is kept for as long as your account exists (§6) and is never edited afterwards.
3. What we use it for
- To run the Service and keep it working;
- to send the messages the lender configures — invitations, document requests, reminders, confirmations and notifications;
- to bill for subscriptions;
- to secure the Service: sign-in checks, rate limits, the audit log, investigating abuse;
- to answer support requests;
- to meet our own legal obligations.
The AI features send less than you would expect. Four features call an AI provider, and no others: the setup assistant, the drafting of an automation rule, the drafting of a stage checklist and the import column mapper. Each one sends something different, so each is set out on its own:
- The import column mappersends the name of the worksheet being imported, the column headers of that sheet and a handful of sample rows, with tax ids, account numbers and similar values masked before anything leaves us — the sheet name included, because a workbook tab can be named anything at all.
- The setup assistant sends the description an administrator typed of how their firm lends, and nothing else — no record from the workspace goes with it.
- Automation-rule drafting and stage-checklist drafting send the request an administrator typed, together with the names of the firm’s own file roles, so that the draft can assign work to a role that exists. Rule drafting also sends the internal identifying number we hold for each of those roles, because a drafted rule has to point at one of them; those numbers mean nothing outside this system. Nothing else about the firm is sent.
Apart from the masked sample rows the import mapper needs, none of these features reads a borrower, investor or loan record. A whole borrower file is never sent, and the AI provider is contractually barred from training on what it receives. What an administrator types into one of those boxes is sent as typed, though, so there is no reason to put somebody’s personal details in it.
We do not sell personal information, do not use it for advertising, and do not use Customer Data to train models of our own.
4. Who else processes it
We use a small, fixed set of service providers (“subprocessors”) to run the Service. Each is contractually limited to processing data for us, and every one of them processes it in the United States. This is the complete list:
| Service provider | What it does | Where |
|---|---|---|
| Render | Application hosting, the managed Postgres database and the scheduled jobs that run the product. | United States |
| Amazon Web Services S3 | Storage for every document uploaded to a workspace — applications, statements, signed files. | United States |
| Postmark | Delivery of the email the product sends: invitations, document requests, reminders and confirmations. | United States |
| Stripe | Subscription billing. Card details are entered on Stripe and never reach our servers. | United States |
| OpenAI | The AI setup assistant, automation-rule drafting, stage-checklist drafting and import column mapping. The import mapper sends the worksheet’s name, its column headers and a few sample rows, with tax ids, account numbers and similar values masked first — the sheet name included; the setup assistant sends the description an administrator typed and nothing else; the two drafting features send the request an administrator typed plus the firm’s own file-role names, and rule drafting also sends the internal id of each of those roles so a drafted rule can point at one. A borrower file is never sent. | United States |
| Xactus | Consumer credit reports, ordered under the lender’s own Xactus account. | United States |
| EsignCenter | Electronic signature — a service we operate ourselves on Render. Signed documents and audit certificates are filed back into the customer’s workspace. | United States |
When this list changes we publish the change on this page as a new version of this policy, with its own version number and effective date (§12).
We may also disclose information where the law requires it, to protect the rights and safety of people using the Service, or as part of a merger or sale — in which case this policy continues to apply to the data collected under it. Inside the Service, what a person sees is decided by the lender’s own roles and file permissions.
5. How it is protected
- The Service is hosted on SOC 2-certified infrastructure (Render for the application and database, Amazon Web Services for document storage).
- Traffic between your browser and the Service, and every connection from the Service to an outside provider, is encrypted with TLS; the database sits on the hosting provider’s private network beside the application. Data at rest is encrypted.
- On top of that, the most sensitive values are encrypted field by field before they are written — Social Security numbers and tax ids, investor banking instructions, credit report payloads, message bodies and the integration secrets a firm connects. Encryption keys are versioned, so a key can be rotated and the old data re-encrypted without downtime.
- Passwords are stored only as one-way hashes; two-factor authentication is available to lender staff and to investors, and two-factor secrets are themselves encrypted.
- Access inside a workspace is governed by roles and by per-file permissions, and security-relevant actions are written to an audit log the firm can read.
- Each firm’s workspace is isolated from every other firm’s; every query is scoped to the workspace it belongs to.
- Uploads are checked by file type and size before they are stored.
We do not claim certifications we do not hold, and we do not describe programmes we do not run. What is written above is what the software does today.
6. How long we keep things
| What | How long | Why |
|---|---|---|
| Workspace data after a trial or subscription ends | 90 days read-only, with export available throughout; deletion is then scheduled a further 30 days out | A lapsed invoice should not cost a lender its book. Subscribing at any point in either window restores everything and cancels the scheduled deletion. |
| Workspace data after an owner asks us to delete it | 30 days, then permanent deletion | The grace period exists so that a deletion requested by mistake can be cancelled by the owner before anything is removed. |
| Outbound email log (recipient, subject, delivery status) | 90 days | Long enough to answer "did that reminder actually reach them?", and no longer, because every row repeats an email address. |
| Electronic-signature event log (the provider’s delivery notices) | 90 days | It exists to explain a signature request that looks stuck. Once the request has finished, the rows are of no further use. |
| Provider-side copy of a signed document | Archived 30 days after the request finishes; when the workspace is deleted we ask the signing service to archive each submission, and our credentials for that account are destroyed | The signed file and its audit certificate are filed in the workspace first, so the signing service’s copy is a convenience rather than the record. Archiving retires the signing link and cannot be undone. Deleting the workspace destroys the keys that reach the account and asks the signing service to archive what is still open there; if it cannot be reached, or refuses, before the deletion finishes, the copies it still holds stay with it, under the provider’s own retention. |
| Consumer credit report — the raw report received from the credit vendor | 25 months after the pull finishes | At the clock the report itself is destroyed, and so is everything read out of it: the scores and the liability lines it produced. What is left is the record that the pull happened — who ordered it, when, and under which consent — together with that consent, any adverse-action record, and the liabilities your staff typed themselves, none of which is report content. A report that a decline relied on is held past the clock until the record-keeping floor for that decision has run. |
| Consumer credit report — the record of the pull (who, when, with what consent) | at least 12 months | A lender has to be able to show why a report was pulled and that the consumer consented. That evidence outlives the report itself. |
| Borrower portal sign-in sessions | 7 days of inactivity, and 30 days in total whatever happens | A borrower on a shared or borrowed computer is signed out on a clock they cannot extend by staying active. |
| Investor portal sign-in sessions | 7 days of inactivity, and 30 days in total whatever happens | The same rule as the borrower portal, applied to accounts that can see participation and payment figures. |
| Record of your acceptance of the Terms and Privacy Policy (the versions, the time, the IP address and the browser identifier) | For the life of your account | It is the evidence of which documents you agreed to and when, so it is never edited or thinned while the account it belongs to exists. A firm’s rows are deleted with the firm, by the same nightly purge that removes the rest of its data; an investor login is global rather than a firm’s, so an investor’s rows are kept for the life of the investor login. |
| Audit log of actions taken inside a workspace | For the life of the workspace | It is the record of who did what, so it is not thinned while the workspace it describes still exists. It is deleted with the workspace. |
| Backups taken by the hosting provider (database snapshots) | Retained per the hosting provider’s backup schedule | These roll on the provider’s cycle rather than ours, so deleted data can persist in a snapshot for a short while after it leaves the live system. |
| Off-provider database dumps (our own second copy) | 35 days | A copy held away from the hosting provider is what makes a restore possible if the provider itself is the problem. It expires on a clock so a deleted workspace is not carried indefinitely in an old dump. |
| Replaced or deleted document versions in the live bucket | 90 days | Versioning is what lets a file overwritten by mistake be recovered. A deletion of the workspace removes every version at once; these are the versions left behind by ordinary day-to-day replacements. |
Inside those limits the lender controls its own workspace. A loan file is archivedrather than deleted — it leaves the working views and can be brought back — and an owner or an administrator can request a full export of the workspace at any time from Settings › Exports & data. Every export arrives with a manifest naming what is in it and which fields were masked or left out for security, so nothing is missing without being named. Deleting the whole workspace is self-service for its owners, on the grace period in the table above.
7. If there is a breach
No system is perfectly secure. If we confirm a breach affecting your data, we will tell the affected workspace’s owners by email without undue delay, and no later than 72 hours after we confirm a breach affecting your data — with what we know about what happened and what was involved, so that the firm can meet its own duties to its borrowers and its regulators. We will cooperate with a firm’s reasonable investigation and notification effort.
8. Your rights, and how to exercise them
- Information inside a lender’s workspace— a borrower’s application, an investor’s position — is controlled by that lender. Ask them. We will pass a request we receive to the lender it belongs to and help them answer it, and we will act directly where the law requires us to.
- Your own account data — the name, email and settings on your login — can be changed in your profile, or write to us at evan@processorteam.com. We answer within 30 days.
- Exportis self-service for a firm’s owners and administrators, at any time, including through the read-only window described in the Terms of Service.
- Deletion of a whole workspace is self-service for its owners, with the grace period in the table above.
9. Cookies
The public website sets no cookies for a visitor who is not signed in — no analytics, no advertising, nothing to consent to. Inside the Service, cookies exist only to keep you signed in; a signed-in person carries that same sign-in cookie onto the public pages, which is why the sentence is worded that way. Form submissions are checked against the site they came from, so a page on someone else’s website cannot act as you.
- A borrower portal session lasts 7 days of inactivity and 30 days in total, after which the person signs in again.
- An investor portal session lasts 7 days of inactivity and 30 days in total.
10. Where the data lives
The Service is hosted in the United States (Virginia / AWS us-east-1), and every service provider in §4 processes data in the United States. We do not operate the Service outside the United States. If you use the Service from another country, you are asking us to process your information in the United States, and you consent to that transfer.
11. Children
The Service is a business tool for adults. It is not directed to anyone under 18, and we do not knowingly collect personal information from anyone under 18. If you believe a child’s information has been entered into the Service, write to us at evan@processorteam.com and we will work with the firm that holds it to have it removed.
12. Changes to this policy
Every version of this policy has a version number and an effective date, both shown at the top of this page. The current version is 2026-09-06. A material change — a new subprocessor, a new purpose, a shorter or longer retention period — must be accepted again: the next time you sign in after it takes effect, the Service asks you to accept the new version before you go anywhere else. A non-material change is posted as a new version with its own effective date and asks nobody to click anything.
13. Contact
Privacy questions and requests:
- Groundwork
- Write to us at evan@processorteam.com.