How we protect your data

All supported connections between users and Fieldlink are protected using modern encrypted transport such as TLS.

Connections between Fieldlink services and supported infrastructure providers are also configured to use encrypted transport where supported and appropriate. Fieldlink uses TLS-encrypted connections for supported production communications.

Passwords are not stored in plain text. Fieldlink uses secure one-way password hashing for account credentials, and currently uses bcrypt password hashing.

Passwords are transmitted over encrypted connections and are not stored in plain text. Repeated failed login attempts are rate-limited per email and per IP address to help protect accounts, and account signup is protected by Cloudflare Turnstile, a privacy-respecting CAPTCHA alternative that helps block automated signups.

Fieldlink is a multi-tenant platform. Customer records are associated with an organisation identifier and access is restricted through application-level authentication, authorisation and organisation-scoping controls.

Backend services are designed to prevent users from accessing another customer organisation's information. File access and API requests are subject to permission and organisation checks. Fieldlink continually maintains and improves these controls as the platform evolves.

Access by authorised Fieldlink personnel is restricted and should occur only where reasonably necessary for support, security, maintenance, legal obligations or other legitimate operational purposes. Where practical, customer support access is logged and controlled.

Fieldlink's production database infrastructure uses encryption at rest provided by its hosting and database providers. Fieldlink currently uses MongoDB Atlas for primary database infrastructure, and MongoDB Atlas provides encryption at rest for supported persistent storage.

Sensitive information may also be protected through additional application or access controls where appropriate.

Fieldlink production traffic is served over HTTPS/TLS. Connections to supported databases and third-party services are configured to use encrypted transport where supported and appropriate.

Cloudflare may be used for network security, DDoS mitigation and traffic protection.

Fieldlink maintains backup and recovery processes designed to support business continuity and disaster recovery. Recovery time depends on the nature and scale of the incident.

Backup retention periods may vary depending on the system, data and infrastructure configuration. Backups are not a substitute for a customer's own retention requirements.

Some Fieldlink AI features may send specific information submitted by a user to third-party AI providers in order to provide the requested feature. Only the information reasonably required for that AI action should be sent.

Fieldlink does not intentionally use Customer Data to train Fieldlink's own general-purpose AI models. Where Fieldlink uses commercial AI APIs, data handling is subject to Fieldlink's arrangements with those providers and their applicable enterprise/API terms.

Customers should avoid entering information into AI functionality where they are not authorised to do so. See our Privacy Policy for additional information.

If Fieldlink becomes aware of a suspected security incident affecting customer information, we may:

• investigate the incident;
• take reasonable steps to contain it;
• secure affected accounts or credentials;
• preserve relevant logs and evidence;
• work with affected service providers;
• assess the information involved;
• assess the likely consequences;
• communicate with affected customers where appropriate; and
• make notifications required under applicable law.

Where an incident constitutes a notifiable privacy breach under the New Zealand Privacy Act 2020, Fieldlink will follow the applicable statutory notification requirements. Fieldlink aims to communicate material incidents promptly once enough reliable information is available.

Following a significant incident, Fieldlink may provide affected customers with information about the incident, its impact and relevant remediation where appropriate, taking into account security, legal and confidentiality considerations.

Fieldlink protects the platform and infrastructure within its control. Customers also play an important role in protecting their information. Customers should:

• use strong, unique passwords;
• protect account credentials;
• use available authentication security features;
• only provide access to authorised users;
• promptly remove users who no longer require access;
• review account permissions;
• secure devices used to access Fieldlink;
• protect downloaded and exported information;
• review third-party integrations; and
• promptly report suspected unauthorised access.

Fieldlink cannot prevent security incidents caused solely by compromised customer-controlled devices, credentials or systems, although we may assist customers in responding to those incidents.

Like most modern cloud software, Fieldlink relies on carefully selected third-party infrastructure and service providers. Depending on the Fieldlink functionality used, providers may assist with:

• cloud infrastructure;
• databases;
• email delivery;
• network protection;
• mapping;
• analytics;
• artificial intelligence;
• authentication;
• payments;
• communications; and
• monitoring.

More information about how third parties may process personal information is available in the Fieldlink Privacy Policy.

Fieldlink takes security seriously and uses safeguards designed to protect customer information. However, no internet-connected service, database, network, device or cloud platform can be guaranteed to be completely secure or continuously available.

Security threats change over time, and Fieldlink continually reviews and improves its safeguards. Nothing on this page limits Fieldlink's obligations under applicable law or the Fieldlink Terms of Service.

If you believe you have discovered a vulnerability affecting Fieldlink, please report it responsibly to security@fieldlink.co.nz.

Please include:

• a description of the issue;
• affected URL or feature;
• steps required to reproduce it;
• screenshots or evidence where appropriate; and
• your contact details.

Please do not:

• access another customer's data;
• alter or delete production information;
• perform denial-of-service testing;
• use automated high-volume attacks;
• publicly disclose an unremediated vulnerability; or
• intentionally exceed what is reasonably necessary to demonstrate the issue.

Fieldlink will review good-faith security reports and respond where appropriate.

Security: security@fieldlink.co.nz

Privacy: privacy@fieldlink.co.nz

General support: support@fieldlink.co.nz