Trust & Security
Designed for confidentiality. Honest about limits.
Your employer funds GRND-0 but does not see private employee conversations. Here's how that's designed — and where its limits are.
Privacy model
Explicit data states.
Private
In your vault. Excluded from all analysis and AI summaries.
Previewed
Redacted draft shown to you. Not yet shared.
Contributed
You approved the redacted text. Stored without your user ID.
Aggregated
Combined with ≥ 10 independent signals before any leader sees a theme.
Threat model
What we defend against.
What we will tell you plainly
Limits, disclosed.
- Corporate SSO verifies you're eligible. Your company's identity provider, Slack or IT may log that you opened GRND-0.
- Slack and Teams are launch-only entry points. No rant content is posted there, and no message-history scopes are requested — but Slack can see the launch event.
- The current build runs on a single database. That cannot guarantee unlinkability; a dedicated credential broker and isolated services are on the roadmap.
- We don't promise “no consequences.” We design so leaders can't see who said what, and we'll tell you if that ever changes.
- Employee expression data is never used for individual productivity, attrition or disciplinary profiles, and there are no public leaderboards.
- Anything you write that is unique enough may still be recognizable to colleagues. The risk score and redaction preview help, but cannot eliminate this.
Certifications
Intent, not claims.
GRND-0 does not currently hold SOC 2, ISO 27001 or HIPAA certifications, and does not claim zero-knowledge or cryptographic anonymity.
These are targets on our roadmap and will be announced only after independent audit. Retention controls shown in the admin console describe intended policy; enforcement is listed as configuration-required until implemented.