> Only the people, links and AI tools you allow can open your content. Data is encrypted in transit and at rest, and artifacts run in a sandbox.

# How Fieldwerk protects your content

You can put client work in Fieldwerk, share it by link and let your AI work on it, because only the people, links and AI tools you allow can open anything, and every one of them is checked the same way. Your data is encrypted in transit and at rest. The full detail, including the services we use, is on [Security at Fieldwerk](https://fieldwerk.ai/trust).

## Who can open what

- Memos, collections and files are private to the people you share them with, plus anyone with a link you've turned on.

- One set of access rules decides every request, whether it comes from the web app, a share link, the API, an AI or live editing.

- Workspace owners and admins can turn off all share links at once, limit members and guests to approved email domains, and require two-factor sign-in. See [Manage your workspace settings](https://help.fieldwerk.ai/uqqr752blk/manage-your-workspace-settings.md).

## Encryption

- Everything travels over encrypted connections (TLS).

- Stored data is encrypted at rest by our database and file-storage providers.

- Link passwords and the tokens of services you connect are encrypted again by Fieldwerk itself before they're stored.

## AI tools

- An AI connects only after you sign in and approve it, using the standard OAuth sign-in. It gets its own token, not your sign-in details.

- It works with your access and no more: it can't open anything you couldn't.

- You can revoke it at any time from **Personal settings**, **Connections**.

## Files and artifacts

- Uploaded files are served from a separate address from the app. Images and video are checked against their actual bytes before they're shown inline; anything else downloads rather than runs.

- HTML artifacts run in a sandbox on a separate domain. They can't reach the internet, use your sign-in, or read files they haven't been allowed. See [Build an artifact that shows your data](https://help.fieldwerk.ai/b2us0x6yyp/build-an-artifact-that-shows.md).

## Standards

We align how we build and run Fieldwerk with recognised security frameworks (NIST CSF, OWASP ASVS and the CSA CAIQ). We claim alignment, not certification.

## Report a security issue

Email [security@fieldwerk.ai](mailto:security@fieldwerk.ai). Read our [disclosure policy](https://fieldwerk.ai/security/disclosure).