Security overview
FieldVoice is built so that one technician's records can never be seen by another, your company's data can never be seen by another customer, and every sensitive action leaves a trace. These controls are in the product today.
Every request is scoped to the signed-in technician and their company before any data is read or written. Isolation is enforced centrally by the platform, not left to individual features, so a defect in one screen cannot expose another account's records.
Checklists, photos, issues, visits and accounts are referenced by long random identifiers. Nothing is sequential or enumerable, and a record you are not entitled to is indistinguishable from one that does not exist.
All traffic between the app, the admin console and FieldVoice is encrypted in transit. Data, backups and evidence photos are encrypted at rest. Voiceprints used for optional speaker verification are additionally encrypted with keys held separately from the data.
Every voice session is opened with short-lived, signed credentials tied to the technician who started it. Vex refuses to act for any participant it cannot verify, and everything it records is attributed to that technician alone.
Site-check photos are fingerprinted at upload and verified every time they are viewed. A photo that has been altered after capture is refused and the attempt is logged. Uploads are validated and size-limited.
Passwords are stored using industry-standard one-way hashing; sessions expire automatically; sign-in attempts are rate-limited. Admin console access is role-based, and Enterprise plans add single sign-on.
Every administrative action — who did what, to which record, from where — is written to an append-only audit history that owners can review and export. Voice usage is metered per technician per session.
FieldVoice runs on isolated, least-privilege infrastructure with no direct access to data stores from the internet. Software dependencies are verified before every build, and production changes are reviewed and tested before release.
The platform undergoes independent security testing before every major release, with load testing at the concurrency we commit to in your agreement. Summaries are available to Enterprise customers under NDA.
Owners can export all company data at any time and request deletion when they leave. Enterprise plans add data-residency and retention controls. We never use customer data to train models, and we never share it with third parties except the processors needed to deliver the service.
Use the contact form with "security" in the subject line. We acknowledge reports within two business days and coordinate disclosure with the reporter.
Contact us
FieldVoice