Privacy Policy
Last updated: October 21, 2026
Groundcrew reads what it needs to map, deploy, and repair your systems, and as little else as it can. It never reads secret values. This page lists what it reads, what it stores, who else sees it, and how to delete it.
Your account
- From GitHub sign-in: your GitHub user id, login, name, avatar URL, and email address with whether GitHub verified it.
- From email sign-in: your email address and when you confirmed it. Sign-in links are single use; only a hash of each link is stored.
- Your workspaces, your role in each, and invitations you sent or received.
- An audit log of actions in each workspace: who approved or rejected what, member and connection changes, and the network address the request came from.
What Groundcrew reads from your connections
AWS
Through the read-only role you create from our CloudFormation template: resource inventory and configuration (for example ECS services, task definitions, load balancers, databases, Lambda functions), tags, CloudWatch logs and metrics during an incident, and secret metadata such as names and version dates. The role has an explicit deny on secretsmanager:GetSecretValue, ssm:GetParameter*, kms:Decrypt, s3:GetObject, and s3:GetObjectVersion, so secret values, decrypted data, and the contents of your S3 objects cannot be read. Task definitions you already have may contain plain environment values, which AWS returns with their configuration.
Kubernetes
Through the service account you create: namespaces, workloads, services, ingresses, pods, events, and pod logs. Secrets are never read. If you turn on the optional ConfigMap or Secret change detection, Groundcrew asks only for their metadata (name and change times), never their contents.
GitHub
Through the GitHub App, only on the repositories you choose: repository files (to detect how an app is built, to build it, and to write fix pull requests), workflow runs, commits, and pull requests. Clones are temporary and deleted after use.
Vercel
With the token you paste: projects, linked repositories, domains, recent production deployments, and the names and types of environment variables. The only values kept are plain variables whose names end in _URL or _HOST; every other value is dropped before it is stored or logged.
What Groundcrew stores
- The resource graph built from what it read: names, types, configuration, relationships, and tags.
- Runs, their steps, approvals, incidents with the evidence lines they cite, and pull requests opened.
- No AWS access keys. Groundcrew assumes your role with a workspace-specific ExternalId and keeps the resulting one-hour session in memory only.
- Credentials you paste (a Vercel token, a kubeconfig, a container registry token, a Slack webhook) are encrypted before they are stored and are never shown again.
- Environment values you give a deploy are encrypted while the deploy job runs and deleted when it ends. Secret values for an AWS deploy go into Secrets Manager in your account; Groundcrew writes them and never reads them back.
- Server logs, which may include your email address, workspace ids, and request addresses, kept for 30 days.
The database has no backups. If the server is lost, the data in it is lost too. Your own systems are not affected.
Who else processes data
- Nebius Token Factory runs the language models (NVIDIA Nemotron). Prompts contain the information an agent needs for its step, such as resource configuration, repository files, and log lines. Tokens and keys found in that text are redacted before it is sent.
- Tavily receives web search queries built from error messages during an incident. Queries hold no secrets and no identifiers.
- Our email provider sends sign-in links, invitations, and the notifications you turn on.
- Slack receives the incident notifications you set up, at the webhook you provide.
- Amazon Web Services hosts the Groundcrew server in the United States (us-east-2).
We do not sell your data and do not use it to train models.
Deleting your data
- A connection: owners delete it on the Connections page. Its stored credential and every resource and relationship it discovered are deleted. Remove access on your side too (delete the CloudFormation stack, uninstall the GitHub App, or delete the Kubernetes service account).
- A workspace: owners delete it in Settings, with its connections, runs, incidents, approvals, and audit log.
- Your account: delete it in Settings. Workspaces you own alone are deleted with it; in shared workspaces your name stays on past approvals in the audit log.
Server logs expire after 30 days. To ask what we hold about you, or for any privacy question, write to privacy@groundkrew.com.
Security
How access is limited, approved, and audited is described on the Security page.
Changes
We will update the date above when this policy changes and tell you in the app when a change matters.