Your data is yours. We treat it that way.
How FieldMarkup handles project files, customer floor plans, install photos, and the systems that hold them. The specifics.
Your data is yours
Project files, floor plans, photos, and BOM data are stored privately, scoped to your account. We never sell data, never share it with advertisers, and never train AI models on your project content.
- Project files and photos live in private cloud storage (Cloudflare R2), scoped per-account
- Authentication runs on Clerk; we don't store passwords ourselves
- Your data is yours to export or delete at any time
- We don't sell data, ever
Built with security in mind
Multiple pre-launch security audits, browser security headers, file-content verification on every upload, and continuous monitoring.
- Pre-launch security audits completed in multiple rounds before going public
- Browser security headers on every page: nosniff, frame-ancestors, strict referrer
- Content Security Policy in report mode while we tighten rules
- File-content magic-byte verification on every upload: a file claiming to be a JPEG must actually be a JPEG
- Constant-time token comparison on share links to defeat timing attacks
- Rate limiting on share links, sign-in attempts, and the public API
Usage analytics and website traffic
We use internal usage analytics to improve FieldMarkup and Vercel Web Analytics to measure website traffic. These are separate reporting systems with different coverage and filters.
- Our internal page-view records include the page, referrer, device information, country, and signed-in account ID when available
- Internal page-view reporting filters identified admins and common bots, excludes embedded tools, and uses a daily IP-and-browser hash rather than storing the raw IP in those records
- Vercel Web Analytics receives page-view and request information for traffic reporting, including visits to signed-in pages and embedded tools; our internal filters do not apply to it
- See our Privacy Policy for the information collected by each system and how we use it
Share links done right
Share a marked-up plan with a customer without handing over your account. Read-only, one markup at a time, killable in one click.
- Share links never expose install photos or BOM cost data
- Tokens are 122 bits of entropy; brute-forcing them is not practical
- One-click revoke immediately makes a token invalid
- Search engines are told not to index share links
- Public viewer is rate-limited per IP
Reliability we monitor ourselves
We watch our own systems instead of waiting for customer complaints. Health checks ping the database, file storage, and authentication every day, and any failure pages the operator.
- Daily health checks on every backing service (database, storage, auth)
- Error budgets with email alerts to the operator on every client-side crash
- Daily digest of upload failures and operation errors
- Cross-device live sync with explicit sync indicator so you always know your work is saved
- Auto-save every change, with last-saved timestamp visible at all times
Things we don't pretend to have yet
Honest about the line between what's shipped and what's roadmap. Most LV shops don't need enterprise compliance to mark up a floor plan; if you do, here's where we are.
- SOC 2 Type 2: not started. Targeting after first enterprise customer demands it
- Cyber liability / E&O insurance: planned alongside V1 launch
- SSO / SAML: not built. Available if you ask and we have the budget for it
- Penetration test by an external firm: planned after V1 launch with real customer data
Found something we should fix?
We treat responsible security reports seriously. If you have found a vulnerability or believe something in our practices needs attention, send a note to security@fieldmarkup.com. We respond within 48 hours, the same as customer feedback. Want credit in the release notes? Just say so.
That's the posture. Want to try the tool?
Free during early access. Accounts created during the founding window keep Pro at $19/mo for as long as they stay subscribed.