Security & Compliance

Field data is irreplaceable. FieldTap is purpose-built to protect the records your team collects on-site - location confidentiality, sensitive data controls, role-based access, immutable audit trails, and end-to-end encryption are not add-ons. They are the architecture.

Location Confidentiality

GPS coordinates, georeferenced photos, and site locations are access-restricted by default and never publicly accessible. Signed, time-limited URLs ensure field imagery cannot be shared via permanent links. Sensitive locations stay protected whether you are documenting environmental sites, infrastructure assets, or survey points.

Sensitive Data Controls

FieldTap provides a four-level sensitivity classification - public, restricted, confidential, and protected - enforced at the database query level. Protected records are invisible to all users except project leads and organization administrators. Control exactly who sees what, down to the individual record.

Immutable Audit Trail

FieldTap maintains an append-only audit log that cannot be modified or deleted, recording every action: record creation, edits, status transitions, approvals, rejections (with reasons), team changes, and exports. This provides the chain-of-custody documentation required for regulatory compliance, client reporting, and internal review.

Role-Based Access Control

Five-tier organizational roles and four-tier project roles let you match access to your real team hierarchy: project managers, field leads, field technicians, and read-only viewers. Row-level security policies are enforced on every database table - data isolation is not a UI feature, it is a database guarantee.

Encryption at Rest & In Transit

All data is encrypted at rest using AES-256. Data in transit is protected with TLS 1.3. Photo attachments are stored in private, authenticated-only storage with time-limited signed URLs - never permanent public links. This applies to all data: field records, GPS coordinates, photographs, EXIF metadata, and audit logs.

Strong Authentication

Industry-standard OAuth 2.0 authentication with secure HTTP-only cookie sessions. Passwords require a minimum of 10 characters with uppercase, lowercase, and numeric complexity. Support for multi-factor authentication and single sign-on for organizations that require them.

Upload Validation & File Security

File uploads are validated at both client and server with strict MIME type whitelisting (JPEG, PNG, WebP, HEIC, TIFF), a 25 MB size limit, and filename sanitization. Uploaded files are stored with randomized paths to prevent enumeration. No executable files can be uploaded to the platform.

Data Portability

FieldTap exports in CSV, Excel, Word, PDF, GeoJSON, and KML. Your data is always yours - exportable in full at any time, with no vendor lock-in. Open, non-proprietary formats ensure your records are suitable for long-term archival and client deliverables.

Hardened Infrastructure

Enterprise-grade cloud infrastructure with automatic HTTPS, DDoS protection, and a global edge network. Managed PostgreSQL with automated daily backups, point-in-time recovery, and strict network isolation. Every HTTP response includes hardened security headers: HSTS with preload, X-Frame-Options DENY, strict content type enforcement, and restricted permissions policy.

Offline Security

Fieldwork happens where cell service does not. Data stored locally for offline use is held in secure on-device storage with conflict detection on sync. When connectivity is restored, records sync over TLS with timestamp-based conflict resolution to prevent data loss or silent overwrites.

Backup & Disaster Recovery

Automated daily database backups with point-in-time recovery up to 7 days. Backups are encrypted and stored in a separate availability zone. In the event of a failure, your data can be restored to any point within the recovery window - no fieldwork lost.

API & Integration Security

Third-party integrations (ArcGIS Online, Google Drive) authenticate via OAuth 2.0 with short-lived access tokens and automatic refresh. Outbound webhooks are signed with HMAC-SHA256 so your endpoint can verify every payload. All integration tokens are encrypted at rest and scoped to the minimum permissions required.

Backups & Recovery

Three layers of backup. Two regions. Zero single points of failure.

Field data is irreplaceable, so we don’t put it in one basket. Daily snapshots, encrypted offsite copies in a separate cloud account, and an append-only audit log mean a bad day in any one place can’t take your records with it.

Daily

automated snapshots

AES-256

GPG-encrypted offsite

2 regions

geographically siloed

Append-only

audit ledger

LAYER 01

Managed daily snapshots

Postgres logical backups every night, stored on the managed database platform with point-in-time restore on customer-tier plans.

LAYER 02

Encrypted offsite copies

Daily pg_dump archives, encrypted client-side with AES-256 (GPG), shipped to S3 in a separate cloud account behind Object Lock — even a compromised primary account can’t delete them.

LAYER 03

Different region, different keys

Offsite bucket lives in a different geographic region from the primary database. Encryption passphrase is held separately from the cloud credentials. Two failures, not one.

Least-privilege write keys

The backup uploader can write new objects, not delete existing ones. Leaked credentials can’t erase history.

Restore drills, not promises

Backups are decrypted and restored to a throwaway Postgres on a recurring cadence. A backup nobody has restored is a hope, not a plan.

Your data, your exit

On request, you get a current encrypted dump of your organization’s records. No lock-in, no exit fees, no ‘managed offboarding.’

Need a copy of your encrypted dump or a custom retention policy? Get in touch.

See plans

Regulatory Compliance

FieldTap is designed to support compliance with regulations that govern field data collection, environmental reporting, and data privacy across the industries we serve.

Regulation	Scope	How FieldTap Helps
NHPA Section 106	Cultural resources	Immutable audit trails, SHPO-format exports (DPR 523, IMACS, UASF), locked records for defensible documentation
NEPA / CEQA	Environmental review	Structured field forms, photo documentation with GPS, chain-of-custody logs for environmental impact assessments
ARPA	Archaeological site protection	Location confidentiality controls, sensitivity classification, access-restricted GPS coordinates
OSHA 1910 / 1926	Workplace safety	Daily monitoring forms, inspection records with timestamps, approval workflows for safety sign-offs
GDPR	EU data privacy	Data portability (full export), right to deletion, encryption at rest and in transit, role-based access control
CCPA	California data privacy	Data access and deletion rights, no sale of personal information, transparent data collection practices

Our Security Commitment

We understand that you're trusting us with data that represents months or years of fieldwork - data that can never be recollected. That responsibility shapes every decision we make.

Security is not an afterthought at FieldTap - it is built into the database layer. Access controls are enforced by the database itself, not just the application UI. Sensitive data classifications restrict records at the query level. Audit logs are append-only and immutable by design. Location data is never publicly accessible.

Our team regularly reviews security practices and conducts dependency audits. We are actively working toward SOC 2 Type II certification.

If you have questions about our security practices or need a compliance statement for your organization, please contact us.

Report a Vulnerability

Found a security issue? We appreciate responsible disclosure and will work quickly to address any verified vulnerabilities.