The answers your IT team will ask for
Fieldbase is bought by agronomists and researchers, and signed off by whoever answers for the firm's security. This page is for them: how people sign in, where data lives, what a lost device can leak, and how you leave. If your review needs more than a page, just ask. A person answers.
Sign-in
OAuth 2.0 with PKCE, through Google or Microsoft accounts. Fieldbase never sees or stores a password. Organisations that run their own identity provider connect it with per-organisation SAML single sign-on, so joiners and leavers are handled where your directory already handles them.
Encryption
Everything in transit is TLS 1.2 or newer (older protocols are refused), and everything at rest is encrypted on Google Cloud managed services. No plan, no setting and no mistake turns either off.
Access control
Organisation roles decide who can administer, record or only read. A new device shows a code and an administrator approves it; sessions are tied to membership, so removing a person removes their access everywhere at once. The same rule binds us: Fieldbase support can only see or control a machine through an explicit invitation on that machine, limited to an allowlisted set of actions.
Devices in the field
Shared field hardware unlocks with a per-person PIN that is never stored or sent anywhere as a PIN. The device and the service hold only a one-way hash of it. A lost machine's access can be revoked at once, and an administrator can order it erased: it wipes itself the moment it next touches the network.
Losing data
The service takes automated backups with point-in-time recovery, so a bad day at our end is measured in minutes, not seasons. And the cloud is never the only place a season exists: every device keeps its own copy, and exports are yours from day one.
The exit
Export is never gated: every format, every plan, whether or not a subscription is active. Security reviews rightly ask how you leave a vendor; with Fieldbase the answer is "with everything, in open formats, whenever you choose".
The principles underneath the specifics
For reviewers who weigh the vendor as much as the product: each of these is a habit the repositories enforce, not a poster.
Infrastructure as code
The entire production estate (network, load balancing, storage, database, services) is declared in Terraform and changed by review, never by hand in a console. Pipelines authenticate with short-lived workload identity, so there are no long-lived keys sitting in CI.
Deny by default
Machine outputs cannot fire until a preflight check passes and an operator arms them; a watchdog returns them to a safe state when the GPS fix degrades; remote support control is an allowlist of actions, not a screen handed over.
Untrusted until validated
Every file the app opens, including its own, is treated as untrusted input: schema-checked, then migrated forward. A malformed file is refused; an old one is upgraded; neither is assumed.
Least knowledge
No passwords held, PINs kept only as one-way hashes, and licensing that gates the interface but never touches the data.
The record does not rewrite
Observations are an append-only log with the author and source on every entry; a retracted value is marked withdrawn rather than deleted, so the record shows its own history.
The questions, answered plainly
Where do credentials live?
With your identity provider. Sign-in is OAuth 2.0 with PKCE via Google or Microsoft, or your own IdP over per-organisation SAML. Fieldbase holds no passwords.
What can a lost tablet leak?
It unlocks by per-person PIN, held only as a one-way hash. Its access can be revoked at once, and an erase order wipes it the next time it touches the network.
What happens to our data if you disappear?
It is already on your devices and in your exports, in open formats. The cloud copy is a convenience, not a hostage.
What can the dealer who sold it to us see?
Nothing, until you say otherwise. A reseller holds no membership in your organisation: they take up none of your seats, appear in none of your people, and have no standing access to your data. Helping you means you naming them first and then reading a code off your own screen, and while they are connected a banner names them with an end button beside it.
Can we cut a support relationship off later?
At any moment, and it takes effect immediately. Any live session ends with it. There is no setting that makes a support link permanent, for a reseller or for us, and there will not be one. One switch in your organisation refuses everybody, Fieldbase included.
For deployments with their own requirements (a security review to sit, a procurement questionnaire, or a dedicated hosted instance of the Fieldbase service for your organisation alone), that is the Enterprise conversation: tell us what your review needs and a person who can answer it will reply.