Trust and security

Card payments

Card numbers are entered into Stripe's own fields and never touch our servers.

Every message we receive from Stripe must carry Stripe's valid signature; unsigned or altered messages are rejected.

Keeping each business's data separate

Each business's data is kept separate in software: every database request is scoped to that business's account, and an automated check blocks any new code that skips that scoping.

Staff access and sign-in

Roles and permissions control what each staff member can do; access is denied unless granted.

Sign-in uses one-time codes by email or text, or Google; we do not store passwords.

How changes reach you

Development, staging and production are separate environments with separate databases; changes reach production only after passing through staging.

The server software that runs in production is the same build that was tested in staging, matched by fingerprint and checked again after deploy.

Connections and browser protections

All traffic uses HTTPS; pages send standard browser protections including a content security policy and protection against being embedded in other sites.

Keeping software up to date

Automated tools check the software packages we depend on for known security problems every day, and updates are proposed every night.

Fixes ship to customers in regular releases. You can see them in the list of recent releases on our status page.

Passwords and keys our systems use

Every code change is scanned for accidentally included credentials.

Credentials are kept in a dedicated vault and tracked against rotation dates, with alerts when one is overdue.

Monitoring and backups

Automated monitoring runs around the clock: error tracking, uptime checks from outside our platform, and paging.

Database backups are checked automatically and a missing backup pages the on-call engineer.

What we do not claim yet

• We do not have third-party certifications such as SOC 2 yet.
• Businesses share one production database and are separated in software.
• Backup restores are not yet on a tested schedule.

Reporting a security concern

We have not set up a separate address for security reports yet.

Until we do, please email our support team at support@fieldspartan.com and put "Security" in the subject line.