"Where does our data live" is the first question a regulator, an insurer, or a careful customer asks. This page gives you the answer for FieldScroll in enough detail to repeat it accurately, and it draws the line between what is true today and what is contract language rather than architecture.
Two kinds of environment
Builder is a shared workspace. It is FieldScroll-branded, meant for learning the platform and building before production, and not permitted for commercial use. Organizations inside it are isolated the same way they are everywhere else, but the environment is not yours.
Launch and Partner run on a dedicated instance:
- Your own database.
- Your own media storage.
- Your own web dashboard deployment at your domain.
- Your own branded mobile app.
Nothing is pooled across partners. Another FieldScroll partner cannot see your instance, and you cannot see theirs. What is shared is the platform codebase: every instance runs the same release, which is how monitoring and updates are handled for you.
Inside an instance: organizations
Within your instance, each of your customers is an organization. Isolation between organizations is enforced in the database itself through row-level security policies:
- Every dashboard and mobile query is filtered by the requesting user's organization membership and current organization, so an application bug in those surfaces cannot widen the result set.
- API keys are bound to one organization (or to the instance, for keys you mint as the owner) and checked on every request and again inside the database functions that do the work.
- The policies are tested, including tests that attempt cross-organization access and verify it fails.
The full mechanism, including what is shared versus isolated, is in multi-tenancy. Roles inside an organization are in role-based access.
What a record carries
For an evidence conversation, the facts on every submitted record are: the submitting user, the submission timestamp, the device model and app version, GPS coordinates when the form captures location, a SHA-256 checksum of the field values computed on the device, and the exact published form version the record was captured against. Records cannot be deleted from the dashboard. See security.
Encryption, backups, retention
- In transit: TLS on every connection — dashboard, app, API.
- At rest: managed Postgres with storage encrypted at rest by the hosting provider.
- Backups and retention: described in security, with the retention term for your instance written into your order form.
- Subprocessors: the vendors that host and operate the platform are listed on the subprocessor page.
What FieldScroll does not claim
- No SOC 2 report, ISO 27001 certification, or contracted SLA percentage. The security documentation says this plainly, and so should you.
- No customer-hosted or on-premise deployment as a standard offering. Private cloud, on-premise, or customer-hosted deployment is quoted separately and may not be available for every engagement.
- No per-customer database inside your instance. Customers are organizations isolated by policy in one database, which is the design, not a shortcut.
What to tell a regulator or an auditor
A sentence you can use, because each clause is backed above: Our platform runs on a dedicated environment operated for us by a named provider under published terms; each of our customers' data is isolated by database policy; every record carries who, when, where, and an integrity checksum, tied to the exact form version used; and the provider does not claim certifications it has not earned.
Anything more specific than that — region, retention term, incident response times — belongs in the order form and the Data Processing Addendum, where it is a commitment rather than a web page.