Security at FieldCard
Your customers, prices and documents are the crown jewels of your business. Here is exactly how we protect them.
Tenant isolation
Every business's data is keyed to its own workspace and every query is scoped server-side. A build-time check fails the deploy if a query on tenant-owned tables is missing its workspace filter.
Private document & photo storage
Job photos, customer signatures, inspection photos and expense receipts live in private storage and are only served as short-lived (1-hour) signed URLs after an access check. Branding assets (logos/letterheads) are the only public files.
Encryption
Payment gateway credentials are encrypted at rest with AES-256-GCM. Technician PINs are hashed with scrypt and never stored in plain text. All traffic is over HTTPS (HSTS enabled).
Field access control
Technicians sign in with a company code + PIN, locked after repeated failures. PIN rotation instantly revokes old sessions. Role-based permissions (50+ granular flags) control what every office user can see and do.
Payments verified server-side
Every payment gateway webhook is signature-verified and cross-checked against the invoice before anything is marked paid. Card details never touch FieldCard servers — they go straight to your gateway.
Audit trail
Key business events (scheduling, status changes, billing, recurring generation, messaging fallbacks) are written to an append-only audit log visible to account admins.
Responsible disclosure
Found a security issue? Email security@sweetphoenix.co.za with details and we will acknowledge within 2 business days. Please do not share the issue publicly until we have had a reasonable chance to fix it.
Related: Privacy Policy · Data deletion · Terms