Security and data handling
Your distributorship's records, held the way you would hold them yourself.
FieldRep Ops is the financial system of record for independent surgical device distributorships. It holds the signed delivery orders, purchase orders, commissions and inventory a business runs on, so it has to be trustworthy in the plain sense: nobody else can get in, nothing can be quietly changed, nothing is lost, and the smallest possible amount of patient data is ever involved. This page says exactly what we do about each of those, in a form you can check.
Last reviewed October 30, 2026 · Field Rep Ops LLC, Florida · In production since August 2026
The short version
- One private environment per distributorship. Your own Google Cloud project, database, storage bucket, encryption key and service identity. No customer shares a database with another.
- You sign in with your own Google Workspace. Company accounts only, two-step verification required, text-message codes disallowed. We store no passwords.
- The only patient data we hold is the hospital's patient identifier and the case date. Encrypted at rest with a separately controlled key, permanently deleted 90 days after the case is paid or voided.
- Built for distributorships that are neither covered entities nor business associates under HIPAA. You confirm that at signing. We don't sign BAAs as a standard term; our Data Protection Addendum adopts HIPAA-grade safeguards anyway and names the path to a BAA if the law or a counterparty of yours requires one.
- Signed money records are never rewritten. A correction is a new version with a stated reason; the original stays. Every send and every open of a document is on record.
- Nightly backups to a separate Google Cloud project in a different US region, point-in-time recovery, and a monthly restore drill that actually restores.
- Insured: cyber and technology errors-and-omissions coverage with a $2 million limit, plus general liability. Certificate on request.
- We never hold your manufacturer passwords, never sell or share your data, and never use it to train an AI model.
Where does my data live?
On Google Cloud, in the United States. Each distributorship gets its own environment: its own Google Cloud project, its own PostgreSQL database, its own storage bucket, its own encryption key, and its own service identity with permission to reach only its own resources. There is no shared database with a customer column. A defect, a misconfiguration or a compromised account in one environment has no path into another, because there is no path.
Data is encrypted in transit and at rest. Documents are never served through public or long-lived links: every file is fetched on the server under the signed-in user's own permissions, so a forwarded link cannot bypass them. Public access to storage is prevented at the bucket level and cannot be switched on by mistake.
Who can get in?
Your people, through your Google Workspace. FieldRep Ops has no password database to steal: sign-in is delegated to Google, restricted to your company's domain, and limited to the users your leadership has invited. Our agreement requires two-step verification for every user, with verification codes by text message or phone call disallowed, because those are the methods attackers defeat most often. Sessions expire after seven days.
Inside the system, a rep sees only their own cases and statements. Leadership sees everything. Suspending someone in the app locks them out of the platform at once, even if their Workspace account is still live. Every view of a patient identifier, every export and every secure-link open is written to an access log your leadership can read, and unusual patterns, such as a burst of identifier views or activity in the small hours, are flagged to leadership automatically.
Our own operator access is limited to running and supporting the system, is named to a person, and is logged like everyone else's.
What about patient information?
FieldRep Ops is a business system, not a patient record. The question is not how well we protect patient data but how little of it we need, and the answer is: almost none.
What we hold
The hospital-assigned patient identifier for a case (an MRN, a patient ID, or an encounter number such as a CSN or FIN) and the case date. That is what a distributorship needs to settle a billing dispute with a hospital or a manufacturer, and nothing more. No names, dates of birth, diagnoses, procedures tied to a person, or clinical information of any kind. The fields do not exist, and the acceptable-use policy every user accepts at first sign-in prohibits putting such information anywhere else.
How it is protected
The identifier is encrypted before it is written, using a key in Google Cloud Key Management held under separate access from the database. Someone holding a copy of the database, or of a backup, holds ciphertext. If the key is not configured the system refuses to save rather than storing plaintext. Photos taken in the operating room or sterile processing, where a case tag can land in frame, are treated as protected by default and stored in the protected bucket.
How long we keep it
Ninety days after the case is paid or voided, the identifier is permanently deleted. The deletion runs every day, is irreversible, and applies to backups on their own rolling schedule. Everything commercial about the case stays: case number, date, surgeon, products, prices, commissions. After the window closes, FieldRep Ops cannot tell you which patient a case belonged to. That is the point.
Who FieldRep Ops is built for
FieldRep Ops is built for distributorships that are neither covered entities nor business associates under HIPAA: the ordinary distribution business, where a rep supports a surgeon's case and the distributorship bills the hospital and is paid by the manufacturer. Whether that describes your distributorship is a question for your own counsel, not for us, and nothing on this page is legal advice about your status. What we do is ask. At signing, your agreement includes a short set of factual questions about how you operate, and you confirm the answers. If any of them points the other way, at signing or later, we talk about whether FieldRep Ops is the right fit before anything else happens.
On that footing, FieldRep Ops does not sign business associate agreements as a standard term, and our Data Protection Addendum says plainly that it is not one. It adopts HIPAA-grade safeguards voluntarily anyway, and it carries a change-in-law clause: if the law or a counterparty of yours ever requires it, we negotiate a Business Associate Agreement in the form the regulation requires. The infrastructure beneath us, Google Cloud, operates under Google's own Business Associate Addendum.
If a hospital or manufacturer asks your distributorship for a BAA from its software vendor, tell us before you sign. We will say plainly what we can and cannot do; it may change the price, and you can walk away without penalty if the terms do not suit.
Can my money records be quietly changed?
No. Once a delivery order is signed it is never edited in place. A correction creates a new version with a stated reason, and the original stays on file. The document number stamped on the paperwork that left the building is never rewritten. Every change to a case or order is written to an audit log with who, what and when.
Every send is recorded, and so is every open: when a delivery order goes to a hospital or manufacturer through a secure link, you can see that it was sent, when, and when it was opened. That is what makes a manufacturer-statement dispute a matter of evidence rather than memory.
The figures themselves are checked, not trusted. A set of fifteen reconciliation checks runs against the ledger on every release, so a total that disagrees with its own parts is caught before it reaches you. The commission engine is verified on every build against a fixed set of real, paid delivery orders, so a change to the code cannot silently change a rep's pay.
What happens if something goes wrong?
The database is backed up automatically with seven days of point-in-time recovery, and a full encrypted export is copied every night to a separate Google Cloud project in a different US region, under access rules that do not allow it to be overwritten. Uploaded files are copied the same way. Every month a restore drill brings a backup up in a scratch environment and checks it, so recovery is a thing we have done, not a thing we believe. Production resources carry deletion protection and project-level liens.
The fleet is monitored around the clock with alerts that page a person. Our service-level agreement commits to a 99.0% monthly availability target with planned maintenance notified 48 hours ahead. A public status page with current and historical uptime is coming soon.
If a security incident is confirmed, our Data Protection Addendum commits us to notify you without undue delay and in any event within five calendar days of confirming it, in time for you to meet any obligations of your own, with the facts you need and our cooperation throughout.
Are you insured?
Yes. FieldRep Ops carries cyber and technology errors-and-omissions coverage with a $2 million policy limit, and commercial general liability with a $2 million aggregate limit, through a carrier specialising in technology companies. A certificate of insurance is available to any customer on request, and the coverage is stated on your Order Form so it forms part of the agreement.
Who else touches my data?
As few parties as possible, and each one is named in the Data Protection Addendum.
- Google Cloud runs the application, database, storage and encryption keys, and reads the text of a product-label photo when a user chooses to scan one. Google Cloud operates under its own Business Associate Addendum and independent audits.
- Google Workspace, yours, is the identity provider.
- FedEx receives tracking numbers so the system can follow a shipment. It receives no patient data.
We give notice before adding any vendor that would process patient data, and if you object on data-protection grounds and we cannot agree within 30 days, you may terminate without penalty. Email that leaves the system carries no patient detail in its body.
What if I leave?
Your leadership can export the distributorship's records in a machine-readable format at any time, without charge and without asking us. Those exports are de-identified by design, keyed by case number, so they can go to your accountant without engaging any of the obligations above. For 60 days after any termination, for any reason, the export stays available and we will provide a complete one on request, never conditioned on payment, a release, a reference or a kind word. We give at least 30 days' written notice before any termination we initiate. The agreement can be assigned only to a successor in a merger or sale of the business, with notice to you. Patient identifiers are returned or deleted within 30 days of termination, at your election, with written certification on request.
What will you never do?
Hold or use your manufacturer portal logins. FieldRep Ops stores no passwords, yours or anyone else's, and never signs in to a manufacturer's or any third party's system on your behalf. Your relationship with each manufacturer is yours.
Sell or share your data. It is not sold, not shared beyond the vendors above, and not used to set, verify or adjust your rates. The only commercial use is metering your invoice, which reads two figures, the number of delivery orders finalized in the month and their aggregate gross value, and prints both on the invoice so you can check them against your own export.
Use your data to train an AI model. No AI service outside Google Cloud ever receives customer data, and nothing is used for training.
What about SOC 2?
FieldRep Ops does not hold a SOC 2 report, and we are not pursuing one for this design. A SOC 2 report is an auditor's opinion on a vendor's internal controls, and most of what it examines is how a vendor keeps many customers safe inside one shared system. We chose not to build a shared system. Each distributorship has its own environment, so the controls that matter most are the ones on this page, and the infrastructure beneath them is covered by Google Cloud's own independent audits: SOC 1, SOC 2, SOC 3 and ISO 27001, available from Google on request.
What we do instead: we answer any security questionnaire in writing, we provide the Data Protection Addendum and the certificate of insurance before you sign, and we will tell you plainly, before any agreement, if your situation requires an audited attestation we cannot meet.
Straight answers
Does FieldRep Ops handle patient data? Is it HIPAA compliant?
It is a business system, not a patient record. The only patient-linking data it holds is the hospital's patient identifier and the case date, encrypted and deleted 90 days after the case is paid or voided. No names, dates of birth, diagnoses or clinical information. FieldRep Ops is built for distributorships that are neither covered entities nor business associates under HIPAA, and you confirm that about your own operations at signing; whether it describes you is a question for your own counsel. We don't sign BAAs as a standard term and adopt HIPAA-grade safeguards voluntarily under the Data Protection Addendum. See What about patient information?
Will you sign a BAA?
Not as a standard term today. FieldRep Ops is built for distributorships that are neither covered entities nor business associates, and the agreement names the path if a BAA is ever required. If a hospital or manufacturer requires one from your distributorship, we will negotiate a BAA in the form the regulation requires. It may change the price, and you may exit without penalty if the terms do not suit. Tell us before you sign.
Where is it hosted? Is my data mixed with other customers'?
Google Cloud, in the United States, in a private environment per distributorship: own project, own database, own storage, own encryption key, own service identity. Nothing is shared and nothing moves between environments.
Do you have a SOC 2 report?
No, and we are not pursuing one for this design. One private environment per customer on Google Cloud, which carries its own SOC 1, SOC 2, SOC 3 and ISO 27001 audits. We answer questionnaires in writing and will say before any agreement if an attestation you need cannot be met. See What about SOC 2?
Can your staff see my data? Do you use AI on it?
Operator access is limited to running and supporting the system, is named to a person, and is logged. Your data is not sold, shared or used to train any AI model, and no AI service outside Google Cloud ever receives it. The only commercial use is metering the invoice: the count and aggregate gross value of the month's delivery orders, both printed on the invoice.
What happens to my data if I leave, or if you shut down or are acquired?
Export any time, in a machine-readable format, without asking. For 60 days after any termination the export stays available and we provide a complete one on request, unconditionally. At least 30 days' notice before any termination we initiate. Assignment only to a successor in a merger or sale, with notice. Patient identifiers returned or deleted within 30 days, at your election, with certification on request.
Do you hold our manufacturer portal logins or log in to manufacturer systems for us?
No, and we never will. We hold no passwords of any kind. Users sign in through their own Google Workspace, and the system never stores or uses your credentials for any manufacturer portal or third-party site.
Are you insured?
Yes. Cyber and technology errors-and-omissions coverage with a $2 million policy limit, and general liability with a $2 million aggregate. Certificate of insurance on request.
Who is behind FieldRep Ops?
Field Rep Ops LLC, a Florida company, founder-operated. The platform has run a working distributorship's money in production since August 2026: cases, signatures, sends, purchase orders, commissions, inventory and shipments, end to end.
Questionnaires, documents and reports
Security questionnaires, requests for the Data Protection Addendum or certificate of insurance, and reports of a vulnerability all go to security@fieldrepops.com. We answer questionnaires in writing and acknowledge vulnerability reports promptly. For how this website itself handles your information, see the Privacy Policy.