Fieldwerk is built and operated by Fieldwerk Limited, a New Zealand company. We take the security of your documents seriously. This page describes the controls we run today. To request our security documentation or ask a question, contact security@fieldwerk.ai.
Your data is encrypted, in transit and at rest
All traffic to and from Fieldwerk is encrypted in transit with TLS. Your data is encrypted at rest by our database and object-storage providers. Sensitive values, including shared-link passwords and any third-party tokens you connect, are additionally encrypted at the application layer with AES-256-GCM before they are stored.
Access to every document is centrally controlled
A single authorisation model decides access on every surface: the web app, the API, AI and MCP integrations, and realtime editing. The document owner sets the ceiling, sharing grants combine on a most-permissive basis so the highest role a person holds applies, and restricted documents fall back to an explicit allowlist. File and realtime connections are authorised with signed, short-lived, single-purpose URLs; our realtime tickets are additionally verified in constant time.
Sign-in and multi-factor authentication
User sign-in is handled by Clerk, with multi-factor authentication available to end users. Every administrative and infrastructure account we operate, including hosting, database, and source control, has multi-factor authentication enforced. Programmatic and AI access uses OAuth 2.0 with PKCE and rotating, theft-resistant tokens.
Security protections are on by default
- App-wide security headers, including a strict Content Security Policy.
- All inputs are validated at the boundary, and database access is fully parameterised, so there is no SQL injection surface.
- Uploaded files live on a separate origin. Media we render inline, such as images and video, is validated against the file's actual bytes; everything else is served as a forced download, so an uploaded file cannot run in the context of the app.
- User-authored HTML is sandboxed on a separate domain under its own strict policy, so it cannot reach your Fieldwerk session.
- Server-side request protections stop our systems being used to reach internal networks.
Changes reach production through checks, not by hand
Every change reaches production through a pull request on a protected main branch, and must pass automated checks (type-checking, tests, linting, and a dependency audit) before it can merge. Dependencies are scanned automatically with Dependabot, and platform infrastructure is patched by our providers.
Monitoring and abuse protection
We run error monitoring with sensitive URLs redacted, rate limiting, and per-object brute-force protection on shared links.
Built on certified infrastructure
Fieldwerk runs on managed, redundant cloud infrastructure. Our core providers hold their own independent certifications:
| Provider | What it does for Fieldwerk | Certifications |
|---|---|---|
| Vercel | Application hosting and delivery | SOC 2 Type 2, ISO 27001:2022 |
| Cloudflare | Realtime editing, file and artifact storage | SOC 2 Type II, ISO 27001:2022, ISO 27018, ISO 27701, PCI DSS Level 1 |
| Neon | Primary database | SOC 2 Type II, ISO 27001:2022, ISO 27701 |
| Clerk | Authentication | SOC 2 Type 2 |
| Upstash | Rate-limiting cache | None on our plan |
| Sentry | Error monitoring | SOC 2 Type II, ISO 27001 |
| PostHog | Product analytics (EU) | SOC 2 Type II |
| GitHub | Optional git sync and our build pipeline | SOC 1 Type 2, SOC 2 Type 2, ISO 27001:2022, CSA STAR Level 2 |
Cloudflare names Workers, Durable Objects, and R2 explicitly in scope for its SOC 2 Type II and PCI DSS Level 1 attestations. Other providers do not publish per-product scope, so we make no claim about which of their individual services are covered.
If you connect an AI application to Fieldwerk, for example over our MCP integration, content you access through it is processed by that provider under your agreement with them; Fieldwerk does not route your content to any AI provider itself.
Standards we align to
We align our controls to the NIST Cybersecurity Framework, the OWASP Application Security Verification Standard, and the CSA CAIQ, which map onto the SOC 2 Trust Services Criteria and ISO 27001. We claim alignment, not certification, and we are careful about the difference.
Privacy and your data rights
Fieldwerk is a New Zealand company and handles personal information in line with the New Zealand Privacy Act 2020. Ben Pujji is our Privacy Officer. Our Privacy Policy is available at /privacy.
Export and erasure are built in, not serviced by hand. Any memo, collection, workspace, or your whole account exports self-serve. Account deletion is self-serve too: it removes your content, your uploaded files, and your identity with our providers, and destroys the key linking you to your pseudonymised usage history, making that history permanently unlinkable. Named security-audit records are kept for up to 13 months for accountability, then deleted.
Reporting a vulnerability
We welcome responsible disclosure. Our responsible-disclosure policy at /security/disclosure sets out the ground rules and where we stand on research that follows them. Email security@fieldwerk.ai and we will respond promptly. Our disclosure contact is also published at /.well-known/security.txt.