Common Security Questions - Revision history

Dgreenwood: /* Security Stance */

2026-06-19T16:40:11Z

Security Stance

← Older revision		Revision as of 11:40, 19 June 2026
Line 190:		Line 190:
	* '''Data Collection''' — Grooper does not collect document content, user data, or processing metadata. The only data transmitted to Grooper is volume counts for license compliance purposes. This connection is made via HTTPS. All other application data remains entirely within your infrastructure.		* '''Data Collection''' — Grooper does not collect document content, user data, or processing metadata. The only data transmitted to Grooper is volume counts for license compliance purposes. This connection is made via HTTPS. All other application data remains entirely within your infrastructure.
	* '''Air-Gapped Environments''' — Grooper supports fully offline deployments via a license file. In this configuration no outbound connections are made and volume is tracked internally. If volume is exhausted before the reset period, contact Grooper directly to receive an updated license file.		* '''Air-Gapped Environments''' — Grooper supports fully offline deployments via a license file. In this configuration no outbound connections are made and volume is tracked internally. If volume is exhausted before the reset period, contact Grooper directly to receive an updated license file.
			* '''AI Use''' — AI capabilities are available as optional features and are not required for use of the platform. When enabled, AI functionality may utilize third-party AI services selected by the customer. Any data transmitted to such services is governed by the applicable third-party terms, security commitments, privacy policies, and Data Processing Agreements (DPAs). Customers are responsible for determining whether the use of third-party AI services meets their organizational and regulatory requirements.

Dgreenwood: /* Security Stance */

2026-06-11T16:03:05Z

Security Stance

← Older revision		Revision as of 11:03, 11 June 2026
Line 190:		Line 190:
	* '''Data Collection''' — Grooper does not collect document content, user data, or processing metadata. The only data transmitted to Grooper is volume counts for license compliance purposes. This connection is made via HTTPS. All other application data remains entirely within your infrastructure.		* '''Data Collection''' — Grooper does not collect document content, user data, or processing metadata. The only data transmitted to Grooper is volume counts for license compliance purposes. This connection is made via HTTPS. All other application data remains entirely within your infrastructure.
	* '''Air-Gapped Environments''' — Grooper supports fully offline deployments via a license file. In this configuration no outbound connections are made and volume is tracked internally. If volume is exhausted before the reset period, contact Grooper directly to receive an updated license file.		* '''Air-Gapped Environments''' — Grooper supports fully offline deployments via a license file. In this configuration no outbound connections are made and volume is tracked internally. If volume is exhausted before the reset period, contact Grooper directly to receive an updated license file.


	----		----

Dgreenwood: /* Security Stance */

2026-06-11T16:02:35Z

Security Stance

← Older revision		Revision as of 11:02, 11 June 2026
Line 186:		Line 186:
	* '''Encryption in transit''' — Grooper is designed to operate over HTTPS, ensuring data in transit is encrypted at the transport layer. Current versions of Grooper enforce this by requiring HTTPS to operate. Internal traffic encryption — between the application and database, or between services — depends on your infrastructure configuration, and we strongly recommend enabling TLS on all internal connections.		* '''Encryption in transit''' — Grooper is designed to operate over HTTPS, ensuring data in transit is encrypted at the transport layer. Current versions of Grooper enforce this by requiring HTTPS to operate. Internal traffic encryption — between the application and database, or between services — depends on your infrastructure configuration, and we strongly recommend enabling TLS on all internal connections.
	* '''Encryption at rest''' — Data at rest is encrypted when your database and file store layers have encryption enabled. Grooper is designed to sit on top of encrypted storage — enabling encryption at the infrastructure level ensures application data is protected at rest.		* '''Encryption at rest''' — Data at rest is encrypted when your database and file store layers have encryption enabled. Grooper is designed to sit on top of encrypted storage — enabling encryption at the infrastructure level ensures application data is protected at rest.
	* '''Account access''' — Only service accounts — the app pool account and service accounts — require access to the Grooper database and file store location. The application is designed to operate under least privilege. The permissions granted to those accounts are set by you during deployment.		* '''Account access''' — Only service accounts (the app pool account and service accounts) require access to the Grooper database and file store location. The application is designed to operate under least privilege. The permissions granted to those accounts are set by you during deployment.
	* '''Application access''' — End-user authentication is fully federated through enterprise identity providers such as Active Directory (Windows Authentication) and Microsoft Entra ID (OAuth 2.0). Ensure only correct users and groups have access to the Grooper Repository and major areas through page access restrictions using [[Permission Sets]].		* '''Application access''' — End-user authentication is fully federated through enterprise identity providers such as Active Directory (Windows Authentication) and Microsoft Entra ID (OAuth 2.0). Ensure only correct users and groups have access to the Grooper Repository and major areas through page access restrictions using [[Permission Sets]].
	* '''Data Collection''' — Grooper does not collect document content, user data, or processing metadata. The only data transmitted to Grooper is volume counts for license compliance purposes. This connection is made via HTTPS. All other application data remains entirely within your infrastructure.		* '''Data Collection''' — Grooper does not collect document content, user data, or processing metadata. The only data transmitted to Grooper is volume counts for license compliance purposes. This connection is made via HTTPS. All other application data remains entirely within your infrastructure.

Dgreenwood: /* Security Stance */

2026-06-11T16:01:53Z

Security Stance

← Older revision		Revision as of 11:01, 11 June 2026
Line 188:		Line 188:
	* '''Account access''' — Only service accounts — the app pool account and service accounts — require access to the Grooper database and file store location. The application is designed to operate under least privilege. The permissions granted to those accounts are set by you during deployment.		* '''Account access''' — Only service accounts — the app pool account and service accounts — require access to the Grooper database and file store location. The application is designed to operate under least privilege. The permissions granted to those accounts are set by you during deployment.
	* '''Application access''' — End-user authentication is fully federated through enterprise identity providers such as Active Directory (Windows Authentication) and Microsoft Entra ID (OAuth 2.0). Ensure only correct users and groups have access to the Grooper Repository and major areas through page access restrictions using [[Permission Sets]].		* '''Application access''' — End-user authentication is fully federated through enterprise identity providers such as Active Directory (Windows Authentication) and Microsoft Entra ID (OAuth 2.0). Ensure only correct users and groups have access to the Grooper Repository and major areas through page access restrictions using [[Permission Sets]].
			* '''Data Collection''' — Grooper does not collect document content, user data, or processing metadata. The only data transmitted to Grooper is volume counts for license compliance purposes. This connection is made via HTTPS. All other application data remains entirely within your infrastructure.
			* '''Air-Gapped Environments''' — Grooper supports fully offline deployments via a license file. In this configuration no outbound connections are made and volume is tracked internally. If volume is exhausted before the reset period, contact Grooper directly to receive an updated license file.

	----		----

Dgreenwood: /* Authentication and access control */

2026-06-11T15:58:50Z

Authentication and access control

← Older revision		Revision as of 10:58, 11 June 2026
Line 36:		Line 36:
	'''What permissions does the Activity Processing service user need?'''		'''What permissions does the Activity Processing service user need?'''

	~~The Activity Processing service automates task processing for Batches in Grooper. They need a minimum set of permissions in order to execute tasks.~~		{{Template:LeastPrivilegeServiceAccounts}}

	{~~\|class="wikitable"~~
	\|
	~~'''Permission'''~~
	\|
	~~'''Type'''~~
	\|
	~~'''Reason'''~~
	\|-
	\|
	~~Users~~
	\|
	~~Local~~
	\|
	~~Run the installed applications (Grooper)~~
	\|-
	\|
	~~File store access~~
	\|
	~~NTFS\Share~~
	\|
	~~Read and write access to the Grooper file store location~~
	\|-
	\|
	~~db_datareader~~
	~~<br>~~
	~~db_datawriter~~
	\|
	~~SQL database roles~~
	\|
	~~Read and write access to the Grooper database~~
	\|-
	\|
	~~Logon As Service~~
	\|
	~~Local Security Policy~~
	\|
	~~Run services installed via Grooper Command Console~~
	\|}

	~~''Other Grooper services may require additional permissions. For example, an Import Watcher's user may need access to directories used for importing file content.''~~

Dgreenwood: /* Authentication and access control */

2026-06-11T14:00:03Z

Authentication and access control

← Older revision		Revision as of 09:00, 11 June 2026
Line 31:		Line 31:
	'''What permissions does the Grooper app pool user need?'''		'''What permissions does the Grooper app pool user need?'''

	The Grooper "application pool identity" is a Windows account that runs the Grooper application installed on a Grooper web server. This account must be given certain permissions in order to launch the Grooper website in a web browser and run Grooper from that browser.		{{Template:LeastPrivilegeAppPoolAccounts}}

	~~From a security standpoint, it is best practice to only give a minimum number of permissions to this account.~~
	* It is unadvisable to give full local admin privileges to the Grooper application pool identity.
	* The minimum number of permissions required are as follows:

	{~~\|class="wikitable"~~
	\|-
	\|
	~~'''Permission'''~~
	\|
	~~'''Type'''~~
	\|
	~~'''Reason'''~~
	\|-
	~~\|colspan=3\|~~
	~~'''''Always Required'''''~~
	\|-
	\|
	~~Read Member Of~~
	\|
	~~Active Directory~~
	\|
	~~Required for checking user's group membership~~
	\|-
	\|
	~~Users~~
	\|
	~~Local~~
	\|
	~~Run the installed applications (Grooper)~~
	\|-
	\|
	~~File store access~~
	\|
	~~NTFS\Share~~
	\|
	~~Read and write access to the Grooper file store location~~
	\|-
	\|
	~~db_datareader~~
	~~<br>~~
	~~db_datawriter~~
	\|
	~~SQL database roles~~
	\|
	~~Read and write access to the Grooper database~~
	\|-
	~~\|colspan=3\|~~
	~~'''''Conditionally Required'''''~~
	\|-
	\|
	C:~~\Release~~
	\|
	~~Local\NTFS~~
	\|
	~~Run MsBuild for compiling Object Libraries and custom scripts in Grooper~~
	* Required when implementing Object Libraries or other scripting.
	\|-
	\|
	~~Logon As Service~~
	\|
	~~Local Security Policy~~
	\|
	~~Run services installed via Grooper Command Console~~
	* Required if also using the application pool identity as a service account running Grooper services
	\|}

Dgreenwood: /* Security Stance */

2026-06-11T13:33:16Z

Security Stance

← Older revision		Revision as of 08:33, 11 June 2026
Line 280:		Line 280:
	* The security of the servers and operating systems hosting the application		* The security of the servers and operating systems hosting the application
	* Network configuration, firewalls, and access controls		* Network configuration, firewalls, and access controls
	* ~~Enforcing~~ HTTPS for all user-facing access to ensure data is encrypted between users and the application		* Enabling HTTPS for all user-facing access to ensure data is encrypted between users and the application
	* Enabling TLS on internal connections to ensure end-to-end encryption within your environment		* Enabling TLS on internal connections to ensure end-to-end encryption within your environment
	* Enabling encryption at rest on the database and file store layers hosting application data		* Enabling encryption at rest on the database and file store layers hosting application data

Dgreenwood: /* Security Stance */

2026-06-11T13:27:53Z

Security Stance

← Older revision		Revision as of 08:27, 11 June 2026
Line 260:		Line 260:
	== Security Stance ==		== Security Stance ==

	Grooper is built with security as a core design principle, hardened at the application layer through secure coding practices~~, encrypted data handling~~, role-based access controls, and a commitment to timely vulnerability remediation.		Grooper is built with security as a core design principle, hardened at the application layer through secure coding practices, role-based access controls, and a commitment to timely vulnerability remediation.

	Because our software is deployed within your own infrastructure, the overall security of the system depends equally on the environment it runs in. We operate on a shared responsibility model:		Because our software is deployed within your own infrastructure, the overall security of the system depends equally on the environment it runs in. We operate on a shared responsibility model:

Dgreenwood: /* Security Stance */

2026-06-11T13:23:41Z

Security Stance

← Older revision		Revision as of 08:23, 11 June 2026
Line 270:		Line 270:
	** Grooper does not maintain local application user accounts for interactive login		** Grooper does not maintain local application user accounts for interactive login
	** Access is fully federated through enterprise identity providers — Active Directory (Windows Authentication) or Microsoft Entra ID (OAuth 2.0) depending on install path		** Access is fully federated through enterprise identity providers — Active Directory (Windows Authentication) or Microsoft Entra ID (OAuth 2.0) depending on install path
	* Enforcing HTTPS at the application level — Grooper requires HTTPS to operate and will not function correctly over an unencrypted connection		* Enforcing HTTPS at the application level — Grooper now requires HTTPS to operate and will not function correctly over an unencrypted connection
	* Producing application updates, including updates to security, and communicating when updates are available or recommended		* Producing application updates, including updates to security, and communicating when updates are available or recommended
	* Designing database connectivity around dedicated service accounts		* Designing database connectivity around dedicated service accounts

Dgreenwood: /* Security Stance */

2026-06-11T13:23:29Z

Security Stance