Last updated October 25, 2026

FieldStacker is operated by Kiwi Alarms LLC. This page describes the security practices in place today. Our Privacy Policy covers what we collect and why.

Encryption

In transit: every page and app request goes over HTTPS using TLS 1.2 or higher. Older protocols are refused.
At rest: the most sensitive values are encrypted in our database with modern authenticated encryption (libsodium). These include bank-connection access tokens, bank transaction descriptions, account names and last-four digits, and the bank details a business puts on its invoices.
Passwords are stored only as salted one-way hashes. Nobody at FieldStacker can read your password.
Card payments are handled by Stripe. Card numbers go straight to Stripe and never touch our servers.

Bank connections

Bank accounts are connected through Plaid. You sign in to your bank inside Plaid’s window, and FieldStacker never sees or stores your bank username or password.
Before a bank can be connected, we email a one-time code to the address on your account and you confirm the connection. This is on top of your normal sign-in.
Only the business owner can connect a bank. Staff accounts and support access can’t.
Disconnecting a bank removes the connection at Plaid and deletes that bank’s data from FieldStacker. Deleting your account removes every connection and all bank data.

Accounts and access

Every account sees only its own business’s data. Team roles (owner, manager, rep, technician) limit what each person can see and change.
Sign-in codes are single-use and expire after 15 minutes. Repeated wrong guesses lock the code, and code requests are rate-limited.
Our production servers accept administrator logins only with cryptographic SSH keys. Password logins are turned off.
Databases accept connections only from inside the server. They are not reachable from the internet.
Each part of the system runs under its own restricted service account, and customer websites we host are isolated from each other and from the app.

Keeping systems up to date

Servers run a long-term-support operating system with security updates installed automatically every day.
A weekly automatic check alerts us when our hosting control panel has a new release, and we apply security fixes promptly.
Repeated failed logins to our servers are blocked automatically.

Backups

Data is backed up every night, both to separate storage and as on-server snapshots, so we can recover from a hardware failure or a mistake.

Reporting a security issue

If you think you’ve found a security problem, email support@fieldstacker.com with “Security” in the subject. Please give us a reasonable chance to fix it before you tell anyone else. We reply to every report.