Security & Privacy — FieldNotes by BharatField AI
How FieldNotes protects NGO field data: TLS in transit, AES-256 at rest, bcrypt-hashed passwords, organisation-isolated data, Google OAuth and Email OTP authentication, offline-first resilience. Hosted on Google Cloud Platform via Replit Deployments.
- Encryption in transit — All connections use TLS (HTTPS). Data is never sent in plain text.
- Encryption at rest — Database storage uses AES-256 encryption.
- Password security — Passwords are hashed with bcrypt before storage. Plain-text passwords are never stored.
- Organisation isolation — Each organisation’s data is logically separated. No cross-organisation data leakage.
- Authentication — Google OAuth 2.0, Email OTP, and local workspace accounts with role-based access control.
- Application hardening — Helmet HTTP headers, brute-force rate limiting on auth endpoints, CSRF protection on all state-changing requests.
- Data Processing Agreement — A downloadable DPA template is available for procurement teams and donors.
Contact security@fieldnotesin.app to report vulnerabilities or request the DPA.
