Your admins reset passwords. Not us.
Only your business owner, the admins you choose and, if you use one, the agency you appoint can reset your team’s passwords. GridOnBoard respects your data and protects your privacy.
Our approach to security
Clear ownership.
Deliberate access.
A connected workspace needs thoughtful boundaries. These principles guide the product we are building, alongside ongoing implementation and release qualification.
Designed around access
You own it. We run it.
Your business holds the keys.
GridOnBoard runs the service. Your business decides who gets in, what they can do and who resets a password. Not us.
2FA on every account.
Every account must set up an authenticator app within 7 days. After that: no code, no access to the business.
You decide who sees what.
Access is given person by person and permission by permission, and enforced on our servers and in the database, not just hidden on screen.
Your business stands alone.
Each business is kept separate in the database itself. No other business can see your mail, files or records.
People leave. The work stays.
Remove a person’s access and the business keeps its client mail and files. A job title never unlocks admin powers.
Every file is checked first.
Uploads are virus-scanned in a separate, isolated system before anyone can download them.
Mailbox handover and some controls are still in preview or development. See product availability.
Built around the business
Connection should
come with clarity.
These are product and engineering principles. They are not a certification, a security guarantee or a claim that every production control is already active.
Distinct business spaces
Business identity is the basis of ownership. A similar company name, shared industry or selected interface role must not grant access to another business.
Explicit permissions
People receive capabilities for particular work. Organizational labels and job titles describe a person’s role; they are not a shortcut to administrator access.
Considered file access
Viewing, adding, updating, downloading and deleting are separate operations. The intended service rechecks current permission when protected work is performed.
Privacy within the workspace
Shared work.
Personal boundaries.
Storage Vault distinguishes company folders from Employee Storage Vault space. The intended policy gives access to Employee Storage Vault contents only to that employee through the application.
Assigning an employee’s storage allowance does not itself grant access to their files. Shared-folder powers and agency management roles are separate from personal-file access.
Experience Storage VaultAccess is specific
Shared-company access should cover its defined company content, without including private employee contents.
Delegation has limits
Agency and client responsibilities stay distinct. Delegating shared-file permissions does not grant account-recovery authority.
Help has a defined scope
Product-support Assistant uses reviewed help. It does not gain account-management or recovery powers from a conversation.
Honest about readiness
Trust starts with
saying where we are.
GridOnBoard remains in private preview. Live identity, file handling, payment, recovery and operating workflows are being integrated and qualified before a full paid launch.
- Preview workflows are identified as sample or simulated
- Product status distinguishes foundations from live services
- No production certification or uptime guarantee is claimed here
Using GridOnBoard during the private preview
A working account does not establish production readiness for every live service. Check each product’s status before you rely on it.
Do not yet treat GridOnBoard as your only production file store or as a substitute for your current business services.
Check product availabilityAccount security update
2FA on every account.
Every GridOnBoard account requires multi-factor authentication. New accounts have 7 days to set up an authenticator app.
MFA adds a separate verification factor to your password. The email code used during signup verifies your email address; it does not replace MFA. This requirement applies to business users, agency users and staff.
The rollout must cover new sign-ins, existing sessions and controlled account recovery. The 7-day setup requirement applies to every account. Recovery of a lost authenticator goes through your business admin or managing agency and is still being qualified.
Security questions
Understand the boundaries.
If you need account help, use the responsible business administrator or managing agency and the existing console support flow.
Find the right support pathIs signup email verification the same as MFA?
No. Email verification establishes control of an email address. Multi-factor authentication is a separate account-security step, and every account requires it.
Does a company-folder permission unlock every file?
No. The intended policy separates company access from Employee Storage Vault contents and uses explicit operation permissions. A job title or agency relationship alone does not grant file access.
Can Assistant reset a password or change my access?
No. Product support is separate from deterministic account-recovery and administration workflows. Recovery decisions remain with the authorized business administrator or managing agency.
Does this site collect messages or payment details?
This review site has no message submission or payment form. Its help search filters the guides on this page. Account actions take place in the separate console.
See your work come together.
Take the product tour through a sample business day.