Playing Field Security

Last Updated: November 4, 2026

This page describes how Playing Field, Inc. (“Playing Field,” “we,” “us,” or “our”) protects our Services and the data our Customers entrust to us. Our written security policies are approved by our leadership and reviewed at least once a year.

1.CUSTOMER DATA

We collect and keep only the data the Services need. Each Customer’s data is kept separate from every other Customer’s data, and access inside a Customer’s organization follows the permissions that Customer sets.

2.INFRASTRUCTURE

The Services are hosted by Amazon Web Services in the United States. AWS is responsible for the physical security of its data centers. The systems that run the Services are isolated, and access to them from the internet is limited to the connections the Services need.

3.ENCRYPTION

Data is encrypted in transit with TLS 1.2 or newer, and encrypted at rest. Credentials that connect the Services to a Customer’s other systems receive an additional layer of encryption.

4.ACCESS CONTROL

Our staff get the least access their work needs, and each person has their own account. Access to the systems that hold Customer Data is limited to authorized personnel. We review access every quarter, and we remove access promptly when someone leaves.

5.SECURE DEVELOPMENT

Every change to our software passes required automated checks before it is released, and releases are made only through our release process. We scan our software for known vulnerabilities and fix them within set time limits based on severity.

6.MONITORING AND INCIDENT RESPONSE

We log and monitor activity in our systems and watch for threats continuously. We keep a written incident response plan. If an incident affects a Customer’s data, we notify that Customer without undue delay.

7.BACKUPS AND CONTINUITY

Customer data is backed up automatically, and copies are kept in more than one location so the Services can be recovered after a failure. We keep a written business continuity and disaster recovery plan.

8.DATA DELETION

A Customer can export its data and permanently anonymize it from inside the Services. When a Customer Agreement ends, we anonymize the Customer’s data within 30 days unless the agreement says otherwise.

9.VENDORS

We review the security of each vendor that stores or processes Customer Data before we use it, and we review our most important vendors again every year. Our terms with these vendors cover confidentiality and data protection.

10.COMPLIANCE

We are preparing for a SOC 2 audit, and we monitor our security controls continuously.

11.REPORTING A SECURITY ISSUE

If you believe you have found a security issue in Playing Field, please contact us at hello@playingfield.ai with the word “Security” in the subject. Please give us a reasonable time to investigate and fix the issue before you share it with anyone else.