A finance corpus is the most sensitive thing a company owns short of payroll, and payroll is usually in it. This page says, in order, what the documents touch, who can see what, what the model provider sees, and what the tests pin. I wrote it from the engineering record, so every claim links to the decision or the test behind it.
1. The documents stay documents
Files are uploaded to the instance’s own storage and database. Grounded reads them in place for every answer. Nothing is extracted into a separate table of figures that then has to be trusted on its own (ADR 0001). When a document is deleted, its chunks, citations and retrieval rows go with it. The audit packages that reference it keep the answer and the source reference, so the record of the answer survives without the document’s content.
2. Who can see what
Each organisation is a tenant. Every content table carries an organisation id and a visibility column, private or organisation, and all five retrieval functions apply the organisation inside the database. A citation can only point at a chunk retrieval was allowed to surface, so an answer cannot leak a document through its footnotes. The scope rules are written in one module, and row-level security mirrors them as a backstop; a drift test fails the build if the two diverge. (ADR 0009, isolation.md)
Public sign-up is off on every instance. Users are created by an administrator.
Pooled by default, dedicated on request: one shared database for small tenants, or a customer’s own database with their own model keys as the premium tier. The pool is cheaper by a factor of four; the dedicated instance is for the customer whose auditor asks.
3. What the model provider sees
The model sees the question, the retrieved passages, and the conversation. Before it does, personal data is replaced:
- Reversible entities (people, emails, phones, places, dates, URLs) become consistent fake surrogates. “Jane”, “Ms Smith” and “J. Smith” map to one fake person for the whole thread. The answer is de-anonymised before you read it.
- Hard entities (card numbers, national identifiers, bank numbers, IBANs, passports) become type markers and are never reversed.
- Figures are never touched. A test pins every numeral through the round trip, because a date surrogate once turned “December FY26” into a random date and broke every date-bearing question on the demo. A salary is a number and a number is evidence. Who may see it is a question for access control, and redaction leaves the figure alone. The mapping lives in a vault table readable by the service role only. Trace events leaving for the observability store get a second, regex-based mask. (pii-pipeline.md)
Where the model provider sits: Grounded calls the provider the instance is configured with, through that provider’s API. What the provider retains and whether it trains on API traffic is governed by the provider’s own terms, which you should read for the provider you choose. A dedicated instance can use your own key, or a zero-retention endpoint where the provider offers one. Grounded does not add a second provider for redaction; the redaction pass runs on the same configured provider so no extra party sees raw content.
4. Policies an organisation can set
- Documents only. Answers are scoped to the organisation’s own documents; a question the corpus cannot answer is declined rather than answered from the model’s general knowledge.
- Web search off. The web search tool is hidden and blocked for the organisation, in chat, deep mode and the skills. When it is on, web results are always labelled external and never blended with company figures. Both are set by the administrator, read per turn from the organisation’s settings, and fail to the permissive default rather than break chat. (org_policy.py)
5. Keys and secrets
Per-organisation model keys are envelope-encrypted with a master key held in the environment; the table has row-level security on and no policies, so only the service role can read it. Organisations choose a model from an allow-list and cannot set a base URL, which closes the request-forgery route through a shared key. Platform secrets live in the host’s variables, never in the database or an admin screen. The trace store’s key never reaches the browser; a test asserts it is absent from the front-end bundle. (ADR 0011, isolation.md)
6. Agents and the sandbox
An agent connected through MCP runs as one Grounded login and sees what that user sees. Instructions planted inside a document do not become tool calls, and eight tests pin that. Where the sandbox is on, sandboxed code can call back into the application through a bridge that exposes seventeen read-only tools and fails closed on anything else, so code the model wrote cannot do more than the model could.
7. What the tests pin
95 security and isolation tests, by what they prove:
| Suite | Tests |
|---|---|
| A user cannot read, cite or list another user’s private content | 40 |
| Same-org works, cross-org is a wall, unshare revokes | 13 |
| Every table has RLS on; function grants match the pinned list | 13 |
| Injection through document names, folder names, query strings | 9 |
| JWT downgrade, expired tokens, unknown key id | 8 |
| Instructions inside documents do not become tool calls | 8 |
| A shared skill cannot exfiltrate through tool arguments | 2 |
| Errors do not leak other tenants’ identifiers | 2 |
| Writing the pins found two gaps that were then closed: one retrieval function was | |
| executable by the anonymous role, and the notes table had no pin. That is in the | |
| record because it happened. |
8. What this page does not claim
- There is no “your data is never used for training” line here. That is the provider’s promise to make, under its terms, not mine to repeat.
- No penetration test has been commissioned. The tests above are mine.
- Error reporting is not wired up. If I ever wire it, it must send no request bodies and it gets disclosed as a subprocessor.
Related
Use cases: The audit trail · It says no. Technical: MCP · Engineering record.
Posts: How to use AI at work without leaking data. Record: ADR 0009, ADR 0011, isolation.md, pii-pipeline.md, incidents.md.
