Security & data
Security
GroundTruth, a Manoff Technologies product.
Last updated: October 22, 2026
What happens to a document when you upload it to GroundTruth: which services see it, what each one receives, how long anything is kept, and what you control. It is written to be forwarded to your firm’s IT, security or ethics contact. The binding terms are in our Privacy Policy and Terms of Service.
Summary
- One AI provider reads your brief. Its text goes to Fireworks AI, which we run with zero data retention: it isn’t stored and is never used to train AI.
- Sources never see your brief. The services that find and fetch cited sources receive only a citation, search terms or a public URL.
- Encrypted in transit and at rest. Your files, the text we extract and your results.
- You stay in control. You decide what to upload, and you can delete a project or your account at any time. We purge it within about 30 days.
- No training, no selling. We don’t train AI on your documents and we don’t sell them.
How your document moves through GroundTruth
Step 1: Upload
You upload a PDF or Word file over an encrypted connection. We store it in your account, encrypted at rest, with our host, Replit (file storage backed by Google Cloud Storage).
Step 2: Parse
The file goes to LlamaParse, which converts it into plain text. We submit these jobs with caching disabled, so the file is not cached or retained.
Step 3: AI analysis
The text goes to our AI provider, Fireworks AI, to find the claims and citations in your brief. We run Fireworks with zero data retention, so it isn’t stored and is never used to train AI. Apart from the parsing step, and our host Replit, which stores your file and its text in your account (steps 1 and 5), this is the only outside service that sees your brief’s words.
Step 4: Source lookups
For each citation, our lookup services receive only the citation string, search terms derived from the cited authority, or the public URL of a source page — never your brief. The source pages come back to us, and the AI compares each cited passage with the claim in your brief.
Step 5: Results stored
The extracted text, citations and verification results are saved to your account in our database, encrypted at rest, until you delete them.
Who sees what
Every outside service that touches your document or a citation lookup, what it receives and how long it keeps it. These rows come from the same list as the Subprocessors table in our Privacy Policy.
| Service | What it receives | How long it keeps it |
|---|---|---|
| Fireworks AIOur AI provider for documents. Runs the AI models that find the claims and citations in your brief and check each one against its source. | Receives: The text of your uploaded brief and the text of the cited sources we fetch on your behalf. This is the one AI provider that sees your document's actual text. | Keeps it: Zero data retention: not stored after the response is returned, and never used to train AI. |
| LlamaParse (LlamaIndex)Converts your uploaded PDF and Word files into plain text for processing. | Receives: The uploaded document file itself. | Keeps it: Not cached or retained. We submit parse and extract jobs with caching disabled. |
| ExaSearch engine used to locate candidate source pages for cited authorities. | Receives: Search terms derived from the cited authority — not your brief text. No user-identifying information is sent. | Keeps it: Zero data retention. |
| FirecrawlFetches the contents of source web pages so we can compare them to what your brief claims. | Receives: The public URL of the source page being fetched — not your brief text. The page contents are returned to us for verification. | Keeps it: Short-term cache only (about 2 days). |
| ScrapingBeeFallback fetcher used to retrieve harder-to-reach source pages on the open web. | Receives: The public URL of the source page being fetched — not your brief text. The page contents are returned to us for verification. | Keeps it: Zero long-term data storage by default. Scraped data and target URLs are not retained after a request is successfully processed and returned. |
| CourtListenerPublic legal-opinion database (Free Law Project) queried during verification of legal citations. | Receives: Only the citation string itself (e.g. "347 U.S. 483"). No user-identifying information is sent. | Keeps it: Usage logs deleted within ~12 weeks. |
| Legal Data HunterSpecialized legal source-lookup service used to resolve citations to source URLs. | Receives: Citation strings and short search queries derived from the cited authority — not your brief text. No user-identifying information is sent. | Keeps it: Queries not stored. |
| ReplitHosting, the database where your data is stored, file storage (backed by Google Cloud Storage), and cookieless aggregate page analytics for our public marketing website. | Receives: All application traffic (including which homepage version you saw and which sign-up or demo buttons you clicked on the marketing website), plus account records, project metadata, the uploaded files, the plain text we extract from them, extracted citations, and verification outcomes. | Keeps it: While the service operates; removed within ~30 days of an account-deletion request. |
Our account, billing and email providers (Clerk, Stripe and Resend) are listed in the Privacy Policy with what each receives. The advertising and visitor-identification tools on our marketing website (Google Ads, the LinkedIn Insight Tag and RB2B) never load in the signed-in app, where your documents live.
Encryption
Data is encrypted in transit and at rest. Traffic to and from GroundTruth travels over encrypted connections (TLS), and your uploaded files, the text we extract from them and your results are stored encrypted. Sign-in is handled by a specialized authentication provider, Clerk.
Retention and deletion
- Delete a project from inside the app at any time. Its uploaded document and extracted text are deleted from our database within 30 days.
- Close your account by emailing [email protected]. We purge your account data and any remaining project content within about 30 days, except limited records we must keep by law, such as billing records.
- Backups follow standard rolling cycles; data already deleted from the live service is overwritten as those backups age out.
- Outside services keep data only as listed in the table above, under their own terms.
What we don't do
- We don’t train AI on your documents. GroundTruth doesn’t use your uploads to train any model, and Fireworks AI never uses them to train AI.
- We don’t sell your documents or share their contents for advertising.
- We don’t send your brief to source services. They receive only a citation, search terms or a public URL.
- We don’t share your documents with anyone beyond the services listed above, and only to run the checks you ask for, except where the law requires it (see the Privacy Policy).
Your responsibilities
You decide what to upload. Before you upload client-confidential, privileged, sealed or otherwise regulated material, check that doing so fits your obligations to your clients and your firm’s confidentiality, privilege and information-security policies. Keep your sign-in credentials safe, and tell us promptly if you suspect someone else has accessed your account.
Each service listed above handles data under its own published terms, which we don’t control. No system is perfectly secure, and we make no firm guarantee that the Service is secure or that your information will remain private or confidential; you use GroundTruth on that understanding. Our Privacy Policy and Terms of Service set out the full terms.
Security contact
For a security questionnaire, a question about this page, or to report a security issue, email [email protected]. If you’re reporting an issue, include enough detail for us to reproduce it.