Nothing leaves your browser
that you did not send.
Groundwork Cloud is a static site. It loads no script, style, font or image from another origin, sets no tracking cookie, and runs no analytics. The one thing it stores is an address you type into the launch list, on this site's own host.
Public references and examples only.
Public references and examples only. Do not send credentials, regulated or controlled data, client evidence or production data. The courses teach with fictional organizations. Nothing on this site, in a lesson or in the Guardrails kit asks for your organization's evidence, and nothing here is a place to put it.
Static pages, one origin, no third parties.
- HostingStatic files on Cloudflare, served over HTTPS with HSTS. The content security policy allows nothing from another origin.
- ScriptsA menu, a course filter and the launch-list form. No analytics, no tag manager, no embedded video or font service.
- The launch listYour address is stored on this site's own host, used to tell you when a course opens, and removed on request to advisory@groundworkcloud.com. It is not sold or shared.
- Protected areasThe studio with its fictional demonstrations sits behind a sign-in. The lessons open to enrolled learners in November 2026.
An engineering self-assessment, with the evidence kept.
On 18 October 2026 the workbench behind the Guardrails program and this site's public pages were walked in two browser engines with fictional data, and the results were recorded as numbers. The summary:
- Pages walked in two browser engines55 pages; 0 requests left the machine in Chromium, 0 in WebKit
- The workbench's own network use19 requests in a full walk, 0 to another origin
- Hostile pasted contentscript and event-handler payloads in every typed field: 0 executed, 0 dialogs
- Workflow checks76 of 76 passed, from a blank record to export, reload and recovery
- Response headersa content security policy that allows nothing from another origin, plus nosniff, referrer, framing and permissions policies and HSTS, on every public page
- Third-party code0 runtime dependencies and 0 development dependencies; no package to audit
A developer-run self-assessment. It is not an independent penetration test, a signed attestation or an authorization of anything, and it says nothing about your own endpoint, browser policy or data handling.
Training, not a ruling.
The courses teach preparation and method. They certify no one, grant no approval or authorization, and do not stand in for your assessor, auditor, regulator or quality unit. Readings on the method page are dated research from public sources, not legal advice.
One address for all of it.
Security reports, corrections to a lesson or a source, and removal from the launch list all go to advisory@groundworkcloud.com. The machine-readable contact is /.well-known/security.txt.
Public references and examples only. Do not send credentials, regulated or controlled data, client evidence or production data.