Our own file

Examined by Hadley & Crane LLP.

Observation period

1 Apr 2025 – 31 Mar 2026

Report issued

8 May 2026

Opinion

Unqualified

Exceptions

One, described in T2

Hadley & Crane audits us. Ardwell Pike audits our customers. We keep them apart on purpose: if the firm examining our controls also examined yours, its opinion of us would sit next to the business we send it. Hadley & Crane has no Fieldproof customers as clients, and we don’t refer any to them.

The full report is available under NDA, and you can request it without talking to sales. The request goes to a security engineer.

Request the report

In Q3 2025, our quarterly access review for the production AWS account was completed 9 days after the quarter’s deadline. No access was found that should have been removed.

We now open the review on the first day of the quarter, and the Okta Tap blocks the quarter from closing until it’s done. We’d rather show you this than a report with nothing in it you can check.

We count every Opinion customer since our first, in March 2025, against the report date Countback gave them on the day they signed. That’s 71 reports. 68 were issued on or before that date.

Three weren’t:

• Two customers used their free fieldwork move, and their reports issued 7 days late. We count those as misses anyway, because the date on the order form is the one their prospect heard.
• One was ours. In February 2026, Ardwell Pike’s engagement lead was out the week of fieldwork, and the report issued 3 working days late. Every fieldwork week now has a second auditor booked.

Figures as of 12 October 2026. 9 customers are mid-window and aren’t counted until their date passes.

Our own 47 controls sit in our own Ledger, pulled by the same six Taps, reviewed by a colleague who doesn’t report to the person being reviewed.

The GitHub Tap reads metadata: pull requests, approvals, branch rules and alerts. It cannot read file contents, so there is nothing to store. Each evidence item records the commit hash, not the diff.

metadata:read · pull_requests:read · administration:read

Evidence records (setting values, user lists, timestamps), uploaded files, and your Binder. Stored in AWS us-east-1, encrypted at rest with AES-256 under keys that rotate yearly, and copied to us-west-2 for backup. Deleted 90 days after you leave, or sooner if you ask.

Write to security@fieldproof.example. We reply within one working day, won’t take legal action against good-faith research, and will credit you here if you’d like.

PGP key fingerprint4A1F 9C2E 77B0 13D8 5E6A  0C94 F2B1 8D37 1E05 6A2C

The companies that touch your data, and why. We give 30 days’ notice before adding one.