Data Security & Encryption

FieldPad uses industry-standard encryption at multiple layers:

In Transit: All data transmitted between your devices and FieldPad servers is encrypted using TLS 1.2/1.3 (HTTPS). This includes web browser connections, mobile app communications, database connections, and file uploads.

At Rest: All stored data is encrypted using AES-256 encryption. This includes databases, file storage, backups, and application data.

FieldPad uses complete data segregation to ensure your organization's data never mixes with others:

Database Level: All queries are automatically filtered by your organization. This is enforced at the application level on every operation.

Application Level: Every request validates your organization context. Database constraints prevent cross-tenant relationships.

Result: Even if a bug occurred, it's architecturally impossible for one organization to access another's data.

Your data is stored in the AWS Canada (Montreal) region (ca-central-1).

What's Stored in Canada:
• Application servers and databases
• All uploaded files and photos
• Backups and system data

Email Notifications:
Email notifications are processed through Amazon SES. Emails are transient (sent and not stored long-term) and do not contain your stored data.

Why Canadian Data Residency Matters:
• PIPEDA Compliance: Simplifies compliance with Canada's federal privacy law
• Provincial Requirements: Meets data residency requirements for provinces like BC and Nova Scotia
• Government Contracts: Satisfies Canadian government data sovereignty requirements

All data storage infrastructure is hosted in the Montreal region with SOC 2 Type II certification.

Yes. FieldPad encrypts all data at rest using AES-256 encryption:

Database: All database records encrypted at rest

File Storage: All uploaded files automatically encrypted with AES-256

Backups: All backups are encrypted

Application Data: All application data encrypted at rest

FieldPad uses secure session-based authentication with multiple security layers:

Secure Sessions: Encrypted tokens stored in secure cookies that can't be stolen by malicious websites

Device Verification: Device-level access control ensures only authorized devices can access your account

Session Timeouts: Sessions automatically expire after inactivity to protect unattended devices

Rate Limiting: Protection against unauthorized access attempts

This multi-layered approach ensures that even if credentials are compromised, unauthorized access is prevented.

FieldPad's architecture is designed to support compliance with various regulatory frameworks:

Encryption: Industry-standard encryption (TLS 1.2/1.3, AES-256) meets requirements for HIPAA, PCI-DSS, and other frameworks

Data Isolation: Complete tenant isolation ensures data segregation required for healthcare and financial compliance

Audit Trails: Available via the Compliance Package for complete activity logging

Infrastructure: AWS SOC 2 Type II certified infrastructure

However, compliance is ultimately your responsibility. We recommend consulting with your compliance team to ensure FieldPad meets your specific regulatory requirements.

Yes. Contact our support team if you need security information for your compliance reviews. We're happy to answer questionnaires and provide details about our security architecture.

Your data retention depends on your plan and settings:

Data Retention: Standard retention policies apply unless you have legal holds in place (Compliance Package feature)

Export: You can export PDF copies of your reports at any time. For a full data export in CSV format, contact our support team before cancelling your account.

Deletion: After cancellation and any grace periods, data is permanently deleted according to your retention settings

Legal Holds: If you have active legal holds, data remains protected even after cancellation

We recommend exporting your reports before cancellation if you need to preserve them.

Security is an ongoing priority:

Automatic Patching: AWS infrastructure includes automatic security patching for the underlying systems

Application Updates: FieldPad application updates are deployed regularly, including security patches

Dependency Updates: We regularly update dependencies to address security vulnerabilities

Monitoring: We monitor for security threats and respond to incidents promptly

Critical security updates are deployed as soon as possible, often within hours of discovery.