Security at FieldLasso

Maintained by FieldLasso Editorial · Reviewed July 17, 2026 · Corrections: support@fieldlasso.com

This page describes the controls FieldLasso actually ships today, in plain terms. It deliberately makes no claims about certifications, audits, uptime, or guarantees that we cannot evidence. The Privacy Policy covers what data we collect and why.

Account security

Passwords are hashed with bcrypt and never stored in plain text. New accounts verify their email address before operating. Sign-in is rate-limited per network address and per account to slow credential attacks. Sessions are token-versioned: changing a password, disabling a user, or revoking access invalidates existing sessions on their next request.

Tenant isolation and roles

Every business is a separate tenant. Records carry their organization's identifier and queries are scoped to it; switching companies is honored only after the signed-in identity's membership in the target organization is re-verified. Inside a tenant, role-based access separates owners, office staff, field technicians, and customers — technicians work in the field app, customers in their portal.

Payments

Card entry is hosted by Stripe. FieldLassonever receives or stores complete card numbers, and customer payments for service businesses run on each business's own connected Stripe account. Provider webhooks are signature-verified before they change any payment state. Fictional demo companies settle payments only through a visibly simulated test mode — no real money moves in a demo.

Secure links and stored objects

Public quote links use high-entropy bearer tokens stored only as cryptographic hashes, with expiry and revocation; approving a quote records an auditable acceptance of the exact displayed revision. API keys are stored hashed. Job and request photos live in private object storage and are served through time-limited signed URLs. Traffic to the production service is encrypted in transit with TLS.

Accountability

Tenant-scoped audit events record consequential actions (quote lifecycle, job completion, billing changes) with their actor. Application errors are monitored. On public quote pages, monitoring drops events and breadcrumbs that contain secure quote-link paths, and session replay is disabled.

Your data rights

Authenticated users can export their data or submit a deletion request at any time. Deletion requests are reviewed so records that must be retained for legal or financial reasons are restricted or de-identified instead of silently kept.

What we do not claim

This page makes no certification, third-party audit, uptime, or incident-statistics claim without published evidence. As documented controls change, this page will record what changes — dated, like the changelog.

Reporting a vulnerability

If you believe you have found a security issue, email support@fieldlasso.com with enough detail to reproduce it. Please do not access data that is not yours while demonstrating an issue; the fictional demo sandbox is a safe place to explore the product.