Security

You are about to put your customer list, your service addresses and your pricing into someone else's software. Here is exactly how it is protected — and what we have not done yet.

Isolation between customers

Every workspace has its own tenant identifier, and every query that touches your records is filtered by it at the database layer. A question asked in another company's account cannot return your job history, your customers, or your pricing. The only material deliberately shared between accounts is manufacturer documentation, which is public.

Access and authentication

• Passwords are stored only as bcrypt hashes. Nobody at CompanyWRX can read them.
• Sessions use signed JSON Web Tokens. Customer portal sessions are separate from technician sessions and are held in session storage, so they end when the browser closes.
• Integration credentials for your field service platform are stored server-side and are redacted whenever a record is read back.

In transit and at rest

All traffic runs over TLS with certificates from Let's Encrypt, renewed automatically. Plain HTTP redirects to HTTPS, and requests arriving at an unknown hostname are refused outright. Documents are stored in DigitalOcean Spaces and the database on DigitalOcean block storage, both encrypted at rest by the provider.

Infrastructure

• The API runs as its own unprivileged service account — not root — with NoNewPrivileges, PrivateTmp and a read-only system tree.
• The database listens on loopback only and is not reachable from the internet.
• fail2ban guards SSH and the web tier; SSH is key-only with no password login.
• An intrusion monitor checks for indicators of compromise every five minutes and alerts before it acts.
• Database backups run nightly and are copied to a second host.

Payments

Card details never touch our servers. Checkout and the billing portal are hosted by Stripe, a PCI Service Provider Level 1. We store only the Stripe customer reference.

What we have not done yet

We would rather tell you than let you assume:

• FieldIQ is not SOC 2 certified. We are a small team and we have not been through the audit.
• There is no HIPAA BAA. Do not put protected health information into FieldIQ.
• Two-factor authentication is not available yet. It is on the roadmap.
• Technician sessions last 90 days on a device. Use Sign out on shared tablets, and tell us if a device is lost so we can rotate your workspace.

Reporting a vulnerability

Email security@gofieldiq.com with enough detail to reproduce it. We will acknowledge within two business days. Please give us a reasonable window to fix an issue before publishing it, and do not access or alter data belonging to anyone else while testing. We will not pursue legal action against good-faith research that follows this.