About Grounded: who runs it and how it works

Who runs this

Operator: Grounded Builds — a sole proprietorship, meaning one person trading under that name rather than a registered company. There is no company number or registered office to quote, because there is no company. If that changes, this line names the entity.
Jurisdiction: State of Missouri, United States. This is the governing law of the Terms and the forum where a dispute is heard, which makes it the one field here that carries legal weight on its own.
Postal address: None published — see below.
Contact: jkaos0725@gmail.com, or the contact form; both reach the same inbox and neither needs an account.
Service: groundedbuilds.dev — the hosted Grounded platform.

No geographic address is published yet, and this page will not imply one. With no company there is no registered-agent address to give, and the only other address there is to give is a home one — which is not something to post on the open web. That is a gap rather than a policy: the EU e-Commerce Directive's identification duty expects a geographic address from a service offered into the EU, and California's automatic-renewal rules expect one for a cancellation notice sent on paper. Neither is met today. Until it is: every route on the contact page reaches a person by email, cancelling a plan is self-service and never needs a letter (plans and billing in the Terms), and if you need a postal address for a legal notice, ask at the email above and you will be given one directly. When the entity is formed, its registered address replaces this paragraph and joins the list above.

Who to write to, and about what, lives on the contact page so there is only one copy to keep true. It names the points of contact for users and for public authorities, and the separate routes for a legal notice, a copyright complaint and a report of illegal content — each with what the notice has to contain and how quickly it is answered.

Grounded is actively maintained. The product changes on a rolling basis rather than on a release calendar, and the dated legal pages (privacy, terms, accessibility) are the authoritative record of what is true at any moment.

What it does

You give a bot a knowledge base — pasted text, ingested pages and documents, CSV files, or a connected database — and describe what it is for. It then answers questions using only that material.

Every answer carries its sources. The passages the model actually used are attached to the answer and can be expanded and read in place.
Answers are checked against the knowledge before you see them. A claim the sources do not support is marked as unsupported rather than presented as fact.
Out-of-scope questions get a refusal, not a guess. "I don't have that information" is a correct answer here, and the product is built to prefer it.
You choose who can reach it. Public, unlisted, invite-only, password-gated, sign-in-required, or embedded on your own site behind an origin allow-list.

Try it without an account: the demo bot on the home page is a real bot answering from a real knowledge base, and it will refuse an off-topic question in front of you. The directory lists other public bots.

What we do and don't claim

We claim: a bot answers from the knowledge its owner approved, shows which parts of that knowledge it used, is checked against those sources before answering, and refuses rather than inventing when the material does not cover the question. Those are mechanisms you can watch working, not adjectives.

We do not claim perfect accuracy, and we will not. Answers are generated by a large language model. A model can misread a source, combine two passages badly, or answer confidently from material that was wrong or out of date when it was uploaded. Grounding narrows the failure modes; it does not remove them.

What citations buy you is auditability. When an answer is wrong you can see the passage it came from, which turns "the bot said something odd" into a specific, fixable knowledge-base problem. That is a materially different position from an unsourced answer you can only disbelieve.

This matches the Terms, which state that AI-generated answers are not warranted to be accurate, complete, or current. Do not rely on any bot's answer as professional advice; check anything that matters against the source it cites.

How it is built

Deliberately plain, because the failure modes of a chatbot platform are mostly operational rather than architectural.

No framework and no build step on the front end — hand-written HTML, CSS and ES modules. Nothing between the source and what your browser runs.
Edge-hosted on Cloudflare Pages, with the API as Pages Functions, so a page is served from close to whoever asked for it.
One database, strictly partitioned per bot. Every query is scoped by the bot id taken from the session, never from the request — a bot you do not own returns "not found", not "forbidden", because even the existence of another tenant's bot is not yours to learn.
Capabilities are opt-in. A bot with nothing but a knowledge base makes no network calls beyond the model. Web search, file uploads, voice, generated artifacts and external tools are each switched on individually by the bot's owner.

Security and data handling

Transport — HTTPS only.
Content-Security-Policy — scripts load from this origin and from Cloudflare's analytics host, and from nowhere else. No inline script is permitted; the one exception is pinned by hash. Framing, MIME sniffing and referrer leakage are all restricted at the header level.
Passwords — stored only as PBKDF2-HMAC-SHA256 hashes with a per-account random salt. Single sign-on is available and stores no password at all.
Owner-supplied model keys — encrypted at rest with AES-256-GCM, never displayed again after saving, never returned by any API, never logged.
Payments — card details are entered on the payment provider's own hosted page. No card number or security code exists anywhere in this system, in any form, encrypted or otherwise.
Telemetry — one cookieless page-view measurement, described in full in the privacy notice. No advertising, no session recording, no cross-site tracking.

Found a security problem? The security route on the contact page is triaged within two working days. Please report rather than demonstrate against another tenant's bot.

Support

The help pages cover setup, knowledge, access control, embedding, invitations and billing troubleshooting, and are searchable.

For anything else — including privacy requests and accessibility barriers, neither of which requires an account — the contact page lists what each topic covers and how quickly it is answered.