Security & Compliance

About Our App

The Field App is a structured reflection and learning environment for the Relational Leadership Cohort. It operates independently from organisational infrastructure — no corporate systems, operational data, or internal documents are connected.

Participants create a private Work Core (a personal leadership narrative). AI-generated responses are grounded in each participant's Work Core, but the Work Core itself is never visible to others.

Infrastructure & Data

Hosting

The application runs on fully managed cloud infrastructure backed by major hyperscale providers (for example, AWS‑based environments). Data is hosted in an EU region by default, with US, APAC, and South America regions available on request.

Encryption

All data is encrypted at rest using industry-standard strong encryption (AES‑256 or equivalent) and in transit using TLS 1.2 or higher.

Isolation

Each customer environment uses a dedicated PostgreSQL database, with Row Level Security (RLS) enforced on all tables containing participant data to ensure tenant isolation and least‑privilege access.

SSO & RBAC

Single Sign‑On (SSO) options include Google, Microsoft Entra / Azure AD, and other SAML‑compatible identity providers. Role‑based access control is enforced in the application and at the database layer via row‑level security policies.

Compliance

The underlying cloud platform operates on security‑audited, compliance‑ready infrastructure (including SOC 2 Type II and ISO 27001 certified services), and the application implements GDPR‑aligned consent and deletion flows. The app itself can inherit many controls from the platform but is subject to its own security and compliance assessment as needed.

AI & Data Use

Data ingestion

No company systems are connected and no operational documents are ingested. The system is intentionally designed for personal reflection, not as a document repository or analytics pipeline.

Model training

Participant data is not used to train foundation models. AI calls are stateless; prompts and responses are processed at runtime and are not retained for training by default, subject to the configuration of the selected AI provider.

Provider flexibility

The platform supports bring‑your‑own AI provider (for example, Azure OpenAI or equivalent) with routing configurable by team or environment, within the capabilities of the chosen provider.