Security & Trust
Security your team can stand behind
FieldTempo is built with the controls enterprise buyers expect: strong authentication, strict tenant isolation, encryption, and a full audit trail, with two-factor auth included on every plan, not locked behind an upsell.
Identity & access
Strong authentication, on every plan
The right people in, and nobody else.
Two-factor authentication is available to every FieldTempo account, not reserved for a premium tier. Owners can require it org-wide, and it's verified on the server on every request, including the admin path.
- TOTP two-factor authentication (authenticator app) on every plan
- Org-wide Require MFA policy, enforced server-side via the session's assurance level
- SAML single sign-on with Okta, Microsoft Entra ID, or Google Workspace (Enterprise)
- SCIM 2.0 automated user provisioning and deprovisioning (Enterprise)
- Owner-only control over security, SSO, and SCIM settings
- Two-factor
- TOTP · every plan
- Enforcement
- Org-wide Require MFA (AAL2)
- Single sign-on
- SAML · Okta / Entra / Google
- Provisioning
- SCIM 2.0
Tenant isolation
Your data is walled off from every other business
Isolation the database enforces, not just the app.
Every organization's data is separated at two layers. Beyond application-level scoping on every query, Postgres row-level security is enforced on the API path: requests run as a role that cannot bypass it, so a forgotten filter returns zero rows instead of leaking another tenant's data.
- Postgres row-level security enforced on the API path by default
- Requests run under a non-privileged role with per-transaction identity claims
- Application-layer organization scoping on every query, in addition to RLS
- Per-location scoping within an org, so pinned members can't reach other locations
- Privileged bypass reserved for tenant bootstrap only
- Model
- Multi-tenant, per-org isolation
- Enforcement
- Postgres RLS on the API path
- Default posture
- Fail-closed (zero rows, no leak)
- Scoping
- Organization + location
Data protection
Encrypted secrets, hashed keys, daily backups
Sensitive data is protected at rest and in transit.
Integration secrets are encrypted before they ever touch the database, access keys are stored only as hashes, and your data sits on managed cloud infrastructure with encryption at rest and automated daily backups.
- QuickBooks tokens and webhook signing secrets encrypted at rest (Fernet, HKDF-derived key)
- API keys and SCIM tokens stored as SHA-256 hashes with constant-time comparison, never in plaintext
- All traffic served over HTTPS with HSTS preload
- Hosted on managed cloud infrastructure with encryption at rest and automated daily backups
- Public links use 256-bit, unguessable tokens
- Secrets at rest
- Fernet (HKDF-derived key)
- Keys & tokens
- SHA-256 hashed, constant-time
- In transit
- HTTPS + HSTS preload
- Backups
- Automated, daily
Payments
Card data never touches our servers
Payments are handled by Stripe, so you inherit their compliance.
FieldTempo never stores raw card numbers. Card payments (deposits, pay links, hosted invoices, and card-on-file auto-charges) are processed and vaulted by Stripe, a PCI-DSS compliant payment processor, and reconciled through signature-verified webhooks.
- Card payments processed by Stripe, a PCI-DSS compliant processor
- FieldTempo never stores raw card numbers. Cards are vaulted by Stripe
- Card-on-file auto-charge is off-session and consent-gated
- Every charge reconciled via signature-verified Stripe webhooks
- Merchant payouts run on Stripe Connect
- Processor
- Stripe (PCI-DSS compliant)
- Card storage
- None on FieldTempo, vaulted by Stripe
- Auto-charge
- Off-session, consent-gated
- Reconciliation
- Signature-verified webhooks
Monitoring & audit
A record of every sensitive action
See who did what, and keep the surface hardened.
Sensitive actions are recorded to a tamper-resistant audit trail, outbound webhooks are signed and replay-protected, and the whole surface is rate-limited and locked down with strict security headers.
- Audit logs across ~50 event types: who, what, and when, with IP and user agent (Business+)
- Signed, replay-protected, SSRF-hardened outbound webhooks (HMAC-SHA256, private-IP blocking, DNS-rebind pinning, no redirects)
- Per-IP and per-route rate limiting on auth, booking, and public endpoints
- Strict security headers: HSTS preload, a nonce-based Content Security Policy, COOP/CORP, permissions-policy, and strict CORS
- Structured errors with correlation IDs, so internal details never leak to clients
- Audit trail
- ~50 event types (Business+)
- Webhooks
- Signed + replay-protected + SSRF-hardened
- Rate limiting
- Per-IP and per-route
- Headers
- HSTS, nonce CSP, COOP/CORP, CORS
Defense in depth
More safeguards, working quietly
Security isn't one feature. It's dozens of small decisions across the stack. Here are more of the controls protecting your account.
Least-privilege field access
Field techs get server-side field redaction, so pricing, client contact details, and addresses are hidden unless the owner grants them.
Scoped API keys
Public-API keys carry explicit read/write scopes, are shown once, and are revocable at any time.
Verified inbound webhooks
Every inbound webhook (Stripe, Stripe Connect, QuickBooks, RevenueCat, Twilio) is signature or token verified before it's trusted.
Injection-safe exports
Queries use a parameterized ORM throughout, and every CSV export is guarded against spreadsheet formula injection.
SMS consent & compliance
Consent timestamps, STOP/START handling, carrier opt-out mirroring, and sender identification on every message.
OAuth CSRF protection
Third-party connections (QuickBooks, Stripe) use database-backed state tokens to prevent CSRF on the OAuth handshake.
Hardened infrastructure
Non-root application containers, modern dependency pins, and debug surfaces disabled in production.
Monitoring
Sentry error and performance monitoring across the web app and background jobs, with a live database health check.
Have a security question, need documentation for procurement, or want to walk through our controls for your compliance review? Talk to our team. You can also read our Privacy Policy and SMS Messaging Terms.
Enterprise
Talk to our team about enterprise security
SSO and SCIM rollout, tenant-isolation questions, a security review for procurement, or a walkthrough for your IT team, we're happy to help. Book a demo and we'll tailor it to your requirements.