Security

At a glance

• Nothing writes to your CRM until you approve it
• AES-256 encryption at rest, TLS in transit
• Hosted in the US (AWS us-east-1)
• AI provider (Anthropic) does not train on your data
• Read-only email access. FieldDrive cannot send, delete, or modify emails
• Raw transcripts and email bodies are not stored after analysis
• OAuth tokens only. FieldDrive never sees your CRM password

Approval-first architecture

FieldDrive never writes to your CRM without explicit user approval. Every AI-generated suggestion stays in a pending state until the rep clicks Accept. There is no background sync, no auto-write, and no bulk update without the user reviewing each change. This is a core architectural decision, not a setting.

Minimal permissions

FieldDrive requests the narrowest access scope available from each provider:

• Gmail:read-only (gmail.readonly). FieldDrive cannot send, delete, or modify emails.
• Outlook:read-only via Microsoft Graph. FieldDrive cannot send, delete, or modify emails.
• Call recorders (Gong, Fathom, Fireflies, Granola): read-only transcript access.
• CRM (Salesforce, HubSpot): read + write, limited to the fields the rep approves. Writes happen through the rep's own session, not a service account.

Encryption

All data in transit is encrypted via TLS (HTTPS). OAuth tokens and connection credentials are encrypted at rest using AES-256. The database is hosted on Supabase in AWS US-East-1 with encryption at rest enabled at the storage layer.

Authentication

Users authenticate with email and password. Passwords are hashed before storage. Sessions use signed JWT tokens that expire and must be refreshed. Every API request from the Chrome extension is authenticated via an Authorization header.

No model training

FieldDrive uses the Anthropic API (Claude) to analyze transcripts and email. Your data is sent to Anthropic solely to produce suggestions for that specific analysis. Under Anthropic's commercial API terms, customer data is not used to train models. FieldDrive does not fine-tune or train any model on your data.

What we store

FieldDrive stores the minimum data needed to operate:

• Suggestions:the AI-generated field updates and your accept/skip/edit decisions.
• Field metadata:which CRM fields you selected, custom hints your team defined, and aggregate acceptance stats to improve suggestion ordering.
• Account and connection records:your user profile, team membership, and encrypted OAuth tokens.

Transcript and email content are processed in memory to produce suggestions. Raw transcripts and email bodies are not persisted in our database after analysis completes.

Third-party processors

• Supabase:database and authentication (US-East-1, AWS)
• Anthropic:AI analysis (data not used for training under commercial API terms)
• Vercel:application hosting

Your control

You can disconnect any integration (Gmail, Outlook, your call recorder, or your CRM) at any time from the Chrome extension. Disconnecting revokes the stored token immediately. To request full data deletion, email us and we will remove your account and all associated data.

Data residency

All infrastructure runs in the United States. The database is hosted in AWS us-east-1 via Supabase. Application hosting runs on Vercel. AI processing happens through Anthropic's US-based API infrastructure. No customer data leaves the US.

Compliance roadmap

FieldDrive is actively working toward the following certifications and capabilities:

• SOC 2 Type I:planned
• SSO (SAML/OIDC):planned

If your team requires specific documentation for a vendor security review, reach out and we will provide answers promptly.

Responsible disclosure

If you discover a security issue, please report it to security@fielddrive.ai. We take every report seriously and will respond within 48 hours.

Questions

For security questions or to request documentation for your team's vendor review, email security@fielddrive.ai.