Skip to content

Security

FSM Navigator® is built with security at its core. Your field service data — customer records, job details, financial information — is protected by multiple layers of defense, from encryption to strict access controls.

Security principles

Principle What it means for you
Encryption everywhere Sensitive data is encrypted when it is stored and whenever it travels between your devices and FSM Navigator
Role-based access Every user has a defined role that controls exactly what they can see and do
Multi-factor authentication Add a second layer of protection to every account with TOTP-based MFA
Data isolation Each company's data is kept separate — no other company can see it
Audit logging Every significant action is recorded in an immutable audit trail
Secure communications Every connection uses HTTPS — nothing is sent unprotected

Security features

  • Multi-factor authentication

    Protect accounts with time-based one-time passwords. Enforce MFA across your entire company.

    Set up MFA

  • Roles and access control

    Assign roles to control who can create jobs, manage inventory, view reports, and more.

    Roles and permissions

Encryption

Stored data

Sensitive details — including customer contact information, financial data, and personal details — are encrypted before they are saved.

Data on the move

Every connection to FSM Navigator uses HTTPS. API calls, dashboard access, customer portal sessions, and the mobile app are all protected on the way between your device and FSM Navigator.

Data isolation

Many companies use FSM Navigator, and each company's data is kept strictly separate:

  • Everything you see is limited to your own company — you can never see another company's data.
  • API keys, sign-ins, and user accounts all belong to a single company.
  • Another company can't reach your data, and you can't reach theirs.

Audit logging

Every significant action is automatically recorded in your company's audit log:

  • Who performed the action
  • What was changed (with before/after values)
  • When it happened
  • Where the request originated (IP address)

Owners can review the audit log at any time from Reports → Audit Logs. Audit logs are append-only within the application (no edit or delete function exists) and retained for at least three years before archival.

Learn about audit logs

Security activity

FSM Navigator watches for unusual access to your company's data, such as someone viewing or exporting far more records than normal. Owners can see what was noticed in Settings → Company Settings → Security, in the Security activity card below the multi-factor authentication settings.

The card lists the last 30 days, newest first:

Column What it shows
When The date and time, in your company's time zone
What happened A plain description, for example "Unusually large amount of data viewed" or "Repeated data exports"
Who The team member, API key, or customer portal account involved
Action taken What FSM Navigator did about it, for example "Logged for review", "Security team alerted", or "Signed out of all sessions"

Select Refresh to load the latest entries. When nothing unusual happened, the card shows No unusual data access.

The card only ever shows activity in your own company. Access by FSM Navigator support staff is not listed here; it appears in the Support Access Log on your audit log page instead.

Seeing an entry you recognise?

A large export by your bookkeeper or a busy day of reporting can show up here. If an entry matches work you expected, no action is needed. If it does not, change the person's password, review their role, and check the audit log for what else they did.

Sign-in sessions

Stay signed in

When someone ticks Remember me on the sign-in page, they stay signed in on that browser for up to 7 days. Without it, a sign-in ends after 8 hours.

Owners can turn this option off for the whole team in Settings → Company Settings → Security, in the Stay signed in card:

  1. Turn Allow "Remember me" on the sign-in page on or off.
  2. Select Save.

The change applies from each person's next sign-in. With the option off, every web sign-in ends after 8 hours. The mobile app is not affected.

Signed out after a change of browser or location

Each web sign-in belongs to the browser and place it started in. If the same sign-in is suddenly used from a different browser, or from a new network in another country, FSM Navigator signs it out straight away. The next sign-in then needs the password plus a second check: the authenticator code if multi-factor authentication is set up, or a code sent by email.

The sign-out is recorded in the audit log. No email is sent.

Customer portal sign-ins are protected the same way. A customer who is signed out this way requests a new sign-in link; no email goes to the owner.

Got an email you did not expect?

If the person did not switch browser or travel, their sign-in may have been copied. Ask them to change their password and turn on multi-factor authentication.

Infrastructure security

Layer Protection
Network Firewall rules, intrusion detection, DDoS mitigation
Application Input validation, parameterized queries, CSRF protection
File uploads Automatic malware scanning on every uploaded file
Sessions Secure session management with automatic timeout
Passwords Stored only as one-way hashes — passwords are never stored in plain text

Compliance

FSM Navigator's security practices align with industry standards:

  • SOC 2-aligned controls — our data-handling and access controls follow the SOC 2 framework (formal certification not yet obtained)
  • OWASP Top 10 mitigations applied across the application
  • PCI-compliant payment processing through Stripe (FSM Navigator never touches card numbers)

Reporting a vulnerability

If you discover a security vulnerability, please report it responsibly:

  • Report: Submit vulnerabilities through our contact page
  • Response time: We acknowledge reports within 24 hours and provide a detailed response within 72 hours.

Responsible disclosure

We appreciate researchers who report vulnerabilities responsibly. Please do not publicly disclose a vulnerability until we have had an opportunity to address it.