Security
Security and your data
Your sites, contacts and visit notes are your company's pipeline. Here is how we keep them separate, who can see them and how you take them with you.
The short version
- Each company's data is walled off from every other company's, in the database itself.
- Owners, managers and reps see what their role allows, and the database enforces it, not just the screen.
- We never track location in the background, and the app carries no analytics, advertising or third-party tracking code.
- Your data belongs to your company. Download it as spreadsheets whenever you like.
Each company's data stays its own
Every table that holds customer data has row-level security switched on: the database checks, on every read and every write, that the person asking belongs to the company that owns the row. We run an isolation test that tries to read one company's data while signed in as another, and it must come back empty.
A spreadsheet you upload, such as a project-lead export you license, is read in your browser and only the rows you choose are saved, to your company alone. It is never pooled with or shown to another company.
Who can see what
- Reps see the sites in their own book, their company's offices and the visits they log. When they drop a pin, they're told if a teammate's site is within 150 m, so no jobsite gets added twice. The manager website is not for reps.
- Managers see their team's sites, visits and reports, and can invite and switch off reps.
- Owners can do everything a manager can, invite managers, make someone else an owner, and connect or disconnect HubSpot.
These rules live in the database's own functions, so a changed screen or a hand-made request can't get around them. Switching someone off stops their access straight away; their visits stay with the company.
Signing in
People sign in with their email and a password. Passwords are stored only as a secure hash, never as the password itself, and a forgotten password is reset with a code sent to the account's email. New people join only with an invite code from an owner or manager, which works for a set number of days and people and can be stopped at any time.
Where the data lives
- Database and photos: Supabase, hosted in the United States (eastern US). Data is encrypted in transit between the app, the website and our servers, and encrypted at rest by the hosting provider.
- Photos: kept in private storage. The app and the manager website open them through links that expire within an hour; links in a spreadsheet export expire after 7 days by default.
- On the phone: your company's data is kept on the phone so the app works without signal. Changes wait on the phone and send when you're back in range.
- Manager website: served by Cloudflare. It holds no customer data; it reads from the same database, under the same rules.
What the app doesn't do
- It doesn't track your location in the background. Location is used only while the app is open, to show where you are and to drop a pin. Managers never see where a rep is.
- It doesn't read your address book, your calendar or your photo library. Business-card photos are read on the phone and not saved.
- It doesn't record your microphone.
- It carries no analytics, advertising or tracking code, and we don't sell data or use it for advertising.
Services we use
A few services handle data so the app can work. The privacy policy lists exactly what each one receives.
| Service | What it does for Groundbreaker |
|---|---|
| Supabase | Database, photo storage, sign-in and server functions |
| Google Workspace | Sign-up, password-reset and Monday team emails |
| Apple Maps | Directions, search and drive times; nothing it returns is kept |
| US Census Bureau and Geocodio | Finding a site's position from its address |
| ElevenLabs | The voice that reads the morning brief |
| US National Weather Service | The forecast in the morning brief, from one map point |
| Anthropic | Works only with public news headlines for the brief; never receives your data |
| Quo | Carries map pins texted to Groundbreaker |
| HubSpot | Only if your company connects it: visit notes and follow-ups go to your own HubSpot account |
| Cloudflare and OpenStreetMap | Serve the manager website and its map pictures |
Connecting HubSpot
Only your company's owner can connect HubSpot, from the manager website. The keys for the connection are stored encrypted and can be read only by our server. Groundbreaker adds notes and tasks and matches HubSpot's companies and contacts without changing them. Disconnecting stops the connection, deletes our keys and cancels them at HubSpot; what was already sent stays in your HubSpot account.
Getting your data out, and deleting it
Owners and managers can download sites, contacts and visits as CSV files from the app, and the team table, each rep's visits, site lists and every report from the manager website. Anyone can delete their own account in the app. To close your company's account, email us and we'll delete it within 30 days. When something is deleted it is removed from our database straight away. The privacy policy has the details.
What we don't have yet
Groundbreaker is a young product, and we would rather tell you than have you find out. Single sign-on, two-step sign-in and an independent security audit such as SOC 2 are not in place yet. If your company needs one of them before signing up, tell us; it moves that work up the list.
Report a security problem
If you think you've found a security problem, email support@usegroundbreaker.com with the subject "Security report." We'll reply within two business days and keep you posted until it's fixed.