Optional two-factor sign-in
Members can require a time-based code from an authenticator app. Once enrolled, FieldForge enforces that second factor across the web app, authenticated APIs, database access, and file storage.
Security & trust
Farm records deserve deliberate protection.
FieldForge uses layered safeguards for authenticated workspaces, payments, file storage, and location data. No online service can promise zero risk, so these controls are reviewed and tested as the platform changes.
Account-scoped records
Farm tables use row-level access rules so signed-in users can reach only the records their account is allowed to use.
Abuse and request controls
Sensitive and costly routes use exact-origin checks, bounded request bodies, and distributed limits designed to slow automated abuse without storing raw network addresses.
Encrypted connections
The public release requires HTTPS. Browser security headers restrict framing, content sources, referrers, and sensitive device permissions.
Safer subscription payments
Web card entry happens on Stripe-hosted Checkout. FieldForge stores subscription identifiers and status—not raw card numbers or security codes.
Verified billing events
Subscription changes are accepted only through Stripe signature verification or authenticated mobile billing notifications, and repeated events are safely detected.
Protected server secrets
Supabase administration, OpenAI, Stripe, and webhook credentials stay in server-side deployment secrets and are never sent to the browser.
Restricted uploads
Storage enforces file-size and file-type allowlists and keeps each member's upload path separated by account.
Location by choice
Precise location is requested only when a user starts Tractor GPS. Other FieldForge features remain usable if location permission is denied.
Clear responsibility boundaries
Security controls reduce risk but cannot guarantee uninterrupted access, perfect accuracy, or prevention of every incident. The Terms explain user responsibilities, independent backups, third-party dependencies, and legally permitted limits.
Your choices matter
Set up two-factor authentication in Settings, use a unique passphrase, export eligible records, control device permissions, manage subscriptions through the appropriate billing provider, and request permanent account deletion. Read the full Privacy Policy and Terms, or contact support.