Is there a security or compliance white paper for vendor review?

Ask every vendor for one, plus the independent report behind it (for example a SOC 2 Type 2 report) and its period. If a vendor does not have a report, ask what it offers instead, such as a recent penetration test and written questionnaire answers, and decide whether that meets your policy.

What is the difference between SOC 2 Type 1 and Type 2?

A Type 1 report describes controls at a point in time; a Type 2 report also tests whether they operated effectively over a period of time. For an ongoing SaaS vendor, Type 2 is the one to ask for.

Do we need SCIM as well as SSO?

SSO lets users sign in with your identity provider; SCIM (RFC 7644) creates, updates and removes their accounts automatically. Without SCIM, someone has to remove leavers by hand.

Can security levels limit who can control the AI agents?

They should. Ask whether AI connections have their own scopes, whether admins can see and revoke every connected app, and whether AI writes need a person to confirm.

Can we get a sandbox on our own data before buying?

Ask for it. A week on a sample of your own customers, sites and job types shows more than any scripted demo.

How do we avoid lock-in?

Get export scope, format and timing in the contract, export a full table during the trial, and prefer vendors whose API and exports are included on every plan.

FieldproxyAI-native field service software

Buying enterprise FSM

What should be on an enterprise field service software evaluation checklist?

Thirteen areas, each tested in the demo rather than ticked on a form: security evidence (an independent audit report and penetration test, not a logo), sign-in and user provisioning (SSO and SCIM), roles and permissions down to region and record, an audit log, where the data is hosted, the API and AI access (including MCP) and how it is limited, offline work on the technician app, integrations with your ERP, accounting and help desk, the implementation plan, data migration, the pricing model, and how you get all your data out when you leave. For each one, ask for proof you can see on screen or in writing, and log in as a restricted user during the demo.

Send the security questionnaire before the first demo, not after you have picked a vendor.
Ask for the audit report itself (for example a SOC 2 Type 2 report) and its date, not a badge on a website.
Test permissions by logging in as a restricted user, not by reading a feature list.
Get the exit terms in writing: format, tables, files and how long you have to export.
Run the demo on a sample of your own data, including one ugly real job.

Book your demo

60 minute video call · Step 1 of 2: your details, then pick a time

Your nameWork emailPhone

Number of employees

This checklist is for companies with an IT or security team that will review the vendor. A 10-person contractor can skip half of it; an enterprise should not skip any of it.

Facts checked as of November 2026. Sources at the end of the page.

Step by step

How to run an enterprise evaluation, step by step

1. Write down the process before the requirements

Walk one job of each type from first request to paid invoice and list the records, statuses, approvals and systems it touches (ticket in ServiceNow, quote approval, parts from the ERP, invoice to accounting). Requirements written from a real job catch what generic RFP templates miss.

2. Send security and IT questions to every vendor up front

Security, architecture review and procurement take longer than the product evaluation. Buyers on our calls lost a budget cycle because the vendor's security documentation and the internal architecture review started after the shortlist was chosen.

3. Script the demo

Give each vendor the same three or four scenarios from step 1 and the same restricted test users. Unscripted demos show each vendor's strongest screen, not your hardest job.

4. Ask for a sandbox on your own data

A trial account loaded with a sample of your customers, sites, assets and job types, used by two technicians and one dispatcher for a week. Ask for it on airplane mode in a basement too.

5. Check references at your scale

Talk to a customer with a similar number of technicians, branches and integrations. Ask what took longer than promised and what they would set up differently.

6. Negotiate the exit before the entry

Put data export format, scope and timing in the contract, along with what happens to integrations and AI connections when the contract ends.

Where it breaks

Why enterprise evaluations go wrong

These are the patterns buyers described on our sales calls, from oil and gas OT support, a pest control roll-up with several hundred technicians, commercial facility maintenance, and equipment makers with their own service teams.

Security review starts too late

An OT support team picked a tool, then hit an architecture review, a vendor security review and the next year's budget deadline in sequence. The evaluation that took weeks was followed by a review that took months.

Every form change goes through IT

Teams on large platforms told us that changing a field form meant joining the enterprise IT backlog, which could take months. If the field team cannot change a checklist, ask who can and how long it takes.

The integration lands on the buyer

A roll-up buyer described their current vendor's integrations as 'a lot put on our shoulders'. Ask who builds, tests and maintains each integration, and what happens when the other system upgrades.

Permissions by role only

Facility maintenance buyers needed users who see only certain trades or regions, and permission tiers for who may control the AI agents. A role list in an RFP answer does not show whether a regional manager can see another region's customers.

No audit trail when something goes wrong

With hundreds of users, 'who changed this?' is a weekly question. Several buyers had moved off tools that could not say who moved or deleted a job.

The demo used the vendor's data

A renewable energy buyer felt the demo did not reflect their assets at all. Generic sample data hides the hardest part of your process.

The checklist

The checklist: what to ask and how to test it

Area	What to ask	How to test it in the demo	Red flag
Security evidence	Which independent reports do you have (for example SOC 2 Type 2, ISO 27001), their dates and scope? Latest penetration test?	Ask for the report under NDA and check which system and period it covers	A badge on the website and no report
Sign-in and provisioning	SSO with our identity provider? SCIM to create and remove users automatically? MFA?	Sign in through your IdP; disable a test user and check they are locked out	Leavers removed by hand in each system
Roles and permissions	Can a user be limited by region, branch, trade or customer, and by field (for example prices)?	Log in as a regional manager and a technician; try to open another region's job	Permissions by role only, or custom development for row-level limits
Audit log	Is every change logged with who, when, old and new value? Can deleted records be restored?	Move and delete a job, then find both in the log	Only a last-modified date
Hosting and data residency	Which region is our data stored in? Is our data separated from other customers'?	Get the region in writing in the order form	'The cloud' with no region named
API and webhooks	Is the API included on our plan? Which objects can it read and write? Can keys be limited and expired?	Create a key limited to one table and try to read another	API access only on a higher tier, or third parties barred from using your keys
AI and MCP access	Can Claude, ChatGPT or Copilot use our data? With what scopes? Is every AI action logged and reversible?	Connect an AI client, ask it to change a record, then undo it and find the log entry	An AI that writes without a preview or an audit trail
Offline work	What works with no signal? What needs a connection? Which change wins on conflict?	Airplane mode: complete a job, reconnect, watch it post	View-only offline mode
Integrations	Which of our systems (ERP, accounting, help desk, CRM) are built and supported by you, and which are our job?	See a record go both ways in a test account	'We have an API' as the answer to every integration
Implementation plan	Who does the setup, how long, what do you need from us, what does it cost?	Ask for a dated plan with named roles on both sides	Timeline given before they have seen your process
Migration	Which records come across (customers, sites, assets, history, open jobs, contracts)? Who maps and cleans them?	Migrate a sample export into the sandbox	Only customers and open jobs; history left behind
Pricing model	Per user, per technician, per job or per company? What do AI, API, integrations and storage cost on top?	Price your next 3 years, including growth and an acquisition	Add-ons priced only after signature
Exit and data export	Can we export every table, file and photo in CSV or JSON, at any time, without a fee?	Export a full table during the trial and open it	Exports limited by edition, schedule or row count with no alternative

Fill one row per vendor per area. 'Yes' without a demo or a document counts as 'not shown'.

A few vendor specifics worth checking against your plan: Salesforce lets admins schedule weekly data exports only in Enterprise, Performance and Unlimited editions (monthly otherwise), and each export file is downloadable for 48 hours. ServiceTitan lets customers on The Works or Enterprise Plus build their own apps, and does not allow third parties to use your app key. Dynamics 365 Field Service's default offline conflict rule lets the technician's change win.

Worked example

A worked example: scoring three vendors

Say a facilities maintenance company with 150 technicians shortlists three vendors and weights the areas that matter most to it. Scores are 0 (not shown), 1 (partly shown) or 2 (shown in the demo or in writing). Made-up numbers to show the method, not a rating of real products.

Area	Weight	Vendor A	Vendor B	Vendor C
Security evidence	3	2	2	1
Roles and permissions by region	3	1	2	2
Audit log	2	2	1	2
Integrations (ServiceChannel, accounting)	3	1	1	2
Offline	2	2	2	2
Exit and data export	2	1	2	2
Weighted total (out of 30)		22	25	27

Weighted total = sum of weight x score. Vendor C scores 1 on security evidence, so the deal still waits on its report.

The scoring changes the conversation. Vendor B's sales deck promised regional permissions; in the demo, the regional manager could still open another region's jobs, so it scored 2 only after the vendor showed a fix in the sandbox. Vendor A had a strong security report but no ServiceChannel integration, which this company's largest clients require.

The 1 for Vendor C on security evidence is not a fail. It becomes a condition in the contract: the vendor's report or an agreed equivalent (for example an independent penetration test and written answers to the questionnaire) before go-live.

Before you buy

What to check before you buy

Good signs

Written answers to your security questionnaire before the demo.
The vendor logs in as a restricted user on screen without being asked twice.
An audit log that shows old and new values, and a way to restore deleted records.
API and AI access included, with keys limited by table and operation and an expiry.
A dated implementation plan with your process in it.
Exit terms: full export in an open format, at any time.

Red flags

Security documentation offered only after you sign.
Every configuration change needs the vendor's professional services.
Integrations you need are 'on the roadmap'.
The demo is never run on your data.
Pricing that changes when you add users, sites, AI usage or API calls, with the rates not on the order form.

In Fieldproxy

How Fieldproxy answers the checklist

Send us your questionnaire before the demo and hold us to the same standard as everyone else. These are the parts we can show on screen.

Roles, permissions and audit

Role-based permissions per table, with audit logs. Record history shows who changed which field, from what to what; deleted records go to a recycle bin and can be restored; workspace activity covers every data change, filterable by source (app, automation, API or AI). Admins can set alerts on bulk deletes, off-hours activity and sensitive field changes.

Your own database

Each workspace runs on its own Postgres database on a regional API base (e.g. US East). Ask which regions are available for your contract and get it in the order form.

API keys

REST API keys are created in Settings, Security, API keys: one per system, each with an expiry, the operations it may use and an optional table allowlist, and revocable. A revoked or expired key is refused on the next request. API access is included on every plan. See /developers.

AI and MCP access with a confirm and undo

Claude, ChatGPT and other MCP clients connect through the MCP server (/mcp) with OAuth or scoped keys. Every write is proposed first with a preview and applied only after a person confirms; every change returns an undo. More than 5 rows needs bulk permission and more than 1,000 is refused. Every AI tool call is logged with the key, person, tool and outcome. See /developers/docs/limits-safety.

Offline technician app

Android and iOS, with jobs on the device and work saved offline queued in an outbox that posts in order when signal returns. See /answers/field-service-app-offline-no-signal.

Integrations, implementation and migration

Two-way QuickBooks Online, Desktop and Enterprise, Xero and Sage; NetSuite, SAP, Dynamics 365, Salesforce, ServiceNow, Zendesk and Freshservice integrations. Setup is done by the Fieldproxy team and is live within a day; migration is free and assisted.

Pricing and exit

One price per company with unlimited users; see /pricing. Any screen exports to CSV or Excel, read-only SQL runs over your own database, and automations can copy records to an external database, so your data is never locked in.

How switching works

How switching to Fieldproxy works

We move your data over and set the system up to the way you already work. Fieldproxy replaces the old tool; it does not run alongside it.

Send us your questionnaire
Security, IT and procurement questions first. We answer in writing, item by item, before the demo.
We build the demo on your process
Your job types, forms, statuses and test users with the permissions you described, on a sample of your data.
Test it like an auditor
Log in as restricted users, move and delete a job and find it in the log, connect an AI client and undo its change, export a table.
Go live
Data migrated for you, technicians on the Android or iOS app, integrations tested both ways before the old system is switched off.

Developers, API and MCP Limits and safety on API and AI access How long implementation takes Pricing

FAQ

Questions people ask

Is there a security or compliance white paper for vendor review?: Ask every vendor for one, plus the independent report behind it (for example a SOC 2 Type 2 report) and its period. If a vendor does not have a report, ask what it offers instead, such as a recent penetration test and written questionnaire answers, and decide whether that meets your policy.
What is the difference between SOC 2 Type 1 and Type 2?: A Type 1 report describes controls at a point in time; a Type 2 report also tests whether they operated effectively over a period of time. For an ongoing SaaS vendor, Type 2 is the one to ask for.
Do we need SCIM as well as SSO?: SSO lets users sign in with your identity provider; SCIM (RFC 7644) creates, updates and removes their accounts automatically. Without SCIM, someone has to remove leavers by hand.
Can security levels limit who can control the AI agents?: They should. Ask whether AI connections have their own scopes, whether admins can see and revoke every connected app, and whether AI writes need a person to confirm.
Can we get a sandbox on our own data before buying?: Ask for it. A week on a sample of your own customers, sites and job types shows more than any scripted demo.
How do we avoid lock-in?: Get export scope, format and timing in the contract, export a full table during the trial, and prefer vendors whose API and exports are included on every plan.

Sources

Competitor details on this page come from the vendors' own pages and documentation, checked as of November 2026. Plans and prices change, so check the vendor's current page before you decide.

AICPA: 2017 Trust Services Criteria (revised points of focus, 2022): https://www.aicpa-cima.com/resources/download/2017-trust-services-criteria-with-revised-points-of-focus-2022
AICPA: SOC 2 reporting guide: https://www.aicpa-cima.com/cpe-learning/publication/soc-2-reporting-on-an-examination-of-controls-at-a-service-organization-relevant-to-security-availability-processing-integrity-confidentiality-or-privacy
IETF RFC 7644: SCIM protocol: https://datatracker.ietf.org/doc/html/rfc7644
Model Context Protocol: authorization specification: https://modelcontextprotocol.io/specification/draft/basic/authorization
ICO: right to data portability: https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/individual-rights/individual-rights/right-to-data-portability/
GDPR Article 20: https://gdpr-info.eu/art-20-gdpr/
Salesforce Help: Data Export FAQ: https://help.salesforce.com/s/articleView?id=000383962&language=en_US&type=1
ServiceTitan Help: approved integration paths: https://help.servicetitan.com/docs/understand-approved-integration-paths-in-servicetitan
Microsoft Learn: offline data sync in Dynamics 365 Field Service: https://learn.microsoft.com/en-us/dynamics365/field-service/mobile/offline-data-sync

See it built on your workflow

Tell us how your jobs run today. We build a demo on your stages, forms and pricing before the call.

Get Demo Get Demo