Frequently Asked Questions

General#

What is OpenBoxes?#

OpenBoxes is an open-source supply chain management system designed for healthcare organizations. It handles inventory tracking, procurement, distribution, and reporting for medical supplies, pharmaceuticals, and other commodities. It is used by hospitals, NGOs, and government health programs in over 20 countries.

What is OpenBoxes Lift?#

OpenBoxes Lift is a fully managed cloud hosting platform for OpenBoxes. Instead of setting up and maintaining your own servers, database, and infrastructure, Lift handles everything: provisioning, backups, updates, security, and monitoring. You sign up, and your OpenBoxes instance is ready in minutes.

How is Lift different from self-hosting OpenBoxes?#

With self-hosting, you are responsible for servers, databases, SSL certificates, backups, updates, and security patches. With Lift, all of that is managed for you. You get automatic backups, guaranteed uptime SLAs, managed security updates, and support — without needing a dedicated IT team.

Who is OpenBoxes Lift for?#

Lift is designed for healthcare organizations, NGOs, government health programs, and any organization that manages medical supply chains and wants a reliable, low-maintenance deployment of OpenBoxes.

Can I try OpenBoxes before signing up?#

Yes. Request access at openboxes.cloud/demo — enter your email and we'll send you an access email in seconds, with a one-click button that signs you straight into the public demo (it also lists your login details for signing back in later). No account or payment details needed. The demo carries a purpose-built sample data set — a fictional health NGO with a central warehouse, four regional depots, fifteen clinics, 500+ products and about two years of supply-chain history — plus open work you can actually finish, like a requisition awaiting approval. It resets once a day (3:00am US Eastern), so if your credentials stop working, just request fresh ones from the same page.

Account & Billing#

Visit openboxes.cloud and click Start Free Trial. The plan is set by the link you follow (Start Free Trial is Shared; the Dedicated link on the pricing page starts Dedicated) — there is no plan-picker step in signup. You create your account, pick a subdomain, and your instance is provisioned automatically. Enterprise is arranged through Contact Sales.

Is there a free trial?#

Yes. Every Shared and Dedicated signup starts with a 30-day free trial. A payment method is required at signup, but you are not charged during the trial — billing starts only if you keep your instance past the 30 days. Cancel before then and you pay nothing.

Can I upgrade or downgrade my plan?#

New signups can choose Shared or Dedicated directly. To move an existing Shared subscription to Dedicated, message us in the portal chat and the team will arrange the migration. Downgrades from Dedicated to Shared also require a coordinated data migration. Enterprise agreements are arranged with our sales team, and changes to them are handled with our team directly.

Can I cancel anytime?#

Yes. There are no long-term contracts on Shared or Dedicated plans. You can cancel through the portal, and your subscription ends at the end of the current billing period. Data export is available before cancellation.

Do you offer discounts for NGOs or nonprofits?#

There is no separate nonprofit pricing today — but the founding-member offer already gives 50% off for 24 months to everyone who signs up before December 31, 2026, applied automatically. Many OpenBoxes users are humanitarian and health organizations. For institutional situations that don't fit the standard plans, contact our sales team at sales@openboxes.cloud.

What payment methods do you accept?#

We accept major credit cards (Visa, Mastercard, American Express) and US bank accounts (ACH direct debit). During signup you can enter your card directly, provide it via Apple Pay or Google Pay where your browser offers them, or connect a US bank account by logging into your bank — verified instantly, with no microdeposits. Bank accounts can only be added during signup; after that, the portal's Billing page takes cards only (entered directly, or via Apple Pay or Google Pay). Invoice or purchase-order billing (net 30) is part of every Enterprise agreement.

Are there any hidden fees?#

No. The published price includes hosting, backups, SSL, and standard support, and nothing is added to your bill unless you choose it. The optional add-ons are self-serve under Billing > Add-ons in the portal once your subscription is paid: on Shared, +5 users ($25/mo per pack, up to 2), more storage (+25 GB $25/mo or +100 GB $100/mo, one band at a time), a higher API rate (2× $30/mo or 5× $70/mo), and longer backup retention (90 days $15/mo or 1 year $30/mo); on Dedicated, +25 users ($100/mo per pack, up to 2), +100 GB storage ($60/mo per band, up to 3) and API 2× ($175/mo). Annual billing takes 20% off add-ons too; the founding-member discount applies to your plan only. Enterprise add-ons are listed on the pricing page.

Technical#

What browsers are supported?#

OpenBoxes works best on modern browsers: Chrome, Firefox, Safari, and Edge (latest two versions of each). Internet Explorer is not supported.

Can I access OpenBoxes on mobile devices?#

Mobile is not a supported surface. OpenBoxes is designed for desktop and tablet browsers; phones are served a separate, limited mobile interface that covers only a fraction of the application, and we do not support it. Use a desktop or tablet for your day-to-day work.

How is my data backed up?#

Every instance is backed up automatically — nightly on Shared and Dedicated, kept 30 days; Enterprise agreements include backups every 6 hours, kept 90 days, with copies in a second region. On Shared you can extend retention to 90 days ($15/mo) or 1 year ($30/mo) with a backup-retention add-on — that changes how far back your backups go, not how recent the newest one is. Shared instances are backed up by Lift around 02:15 UTC and those backups are listed on the Backups page. Dedicated databases are backed up at 04:00 UTC by the database operator — those scheduled backups are not listed on the Backups page (on-demand ones are), so ask support if you need to restore from one. You can also take an on-demand backup at any time from the Backups page in the customer portal. Backups are encrypted at rest.

Restores are self-serve for the account owner: on the Backups page, open the ⋯ menu on a backup and choose Restore from this backup…. A restore is destructive — it replaces your instance's current data with the backup — so take a fresh on-demand backup first if you might need to go back.

Can I export my data?#

Yes. OpenBoxes provides data export in CSV and Excel formats for most entities (products, inventory, shipments, purchase orders). You can also use the REST API to extract data programmatically. If you cancel your subscription, you have 30 days to export your data before the instance is decommissioned.

Is my data isolated from other customers?#

Yes. Every tenant on OpenBoxes Lift gets an isolated database schema. Your data is never co-mingled with another organization's data, regardless of tier.

Can I use my own domain name?#

Not currently. All instances are hosted under the openboxes.cloud domain (e.g., yourorg.openboxes.cloud). Custom domain support is planned post-launch and is not available on any plan today.

How are updates handled?#

Lift manages OpenBoxes version updates. We test updates before rolling them out, and all tiers are updated by Lift. For Dedicated and Enterprise customers we do our best to coordinate timing around your operations.

Security & Compliance#

Is my data encrypted?#

Yes. Data is encrypted in transit (TLS 1.2+) and at rest (AES-256). Database backups are also encrypted.

Where is my data hosted?#

OpenBoxes Lift runs on Google Cloud Platform (GCP) in the us-east1 region. Region selection is not available today; organizations with data-residency requirements can raise them as part of an Enterprise agreement.

Do you support single sign-on (SSO)?#

In Lift, "SSO" refers to the portal-to-instance bridge: clicking Launch in the customer portal signs you straight into your OpenBoxes instance. Separately, third-party sign-in with Google, Microsoft, or GitHub is available for individual accounts on every plan. Organization-managed SSO (connecting your own identity provider, including SAML) is not available on any plan today; organizations that require it can discuss it as part of an Enterprise agreement.

Account Setup#

When your OpenBoxes instance is provisioned, we rotate the default OpenBoxes admin user's password to a strong random value and show you that password exactly once on the signup-complete page. We call it a break-glass credential because it's only for situations where you need to log directly into OpenBoxes and our portal Single Sign-On is unavailable.

You should:

Copy the password to your password manager when shown — we do not store it on our side after that moment, and we cannot recover it for you.
Use the portal's SSO link (app.openboxes.cloud → "Launch") for normal daily access — the break-glass credential is not your day-to-day login.

If you missed it or lost it: sign in via the portal SSO, then use OpenBoxes' built-in Forgot Password flow to reset the admin user's password. The break-glass credential isn't recoverable from our side — that's intentional, so a compromise of our portal doesn't expose direct-OB access on your account.

Why doesn't OpenBoxes Lift accept email addresses with `+` aliases?#

Some users like to add +tag aliases (e.g., you+lift@example.com) when signing up for services so they can filter mail by sender. OpenBoxes' built-in login form has a quirk where the + character in a username gets URL-decoded to a space, which breaks direct OpenBoxes login for accounts using these aliases. Single Sign-On via the portal would work, but the direct-OB login path would not — so we block + at signup to avoid the inconsistent experience.

Please use a primary email address (e.g., you@example.com) at signup. If filtering matters, most providers let you create per-service aliases that don't rely on + (Gmail's dots, custom domains, etc.). We track the underlying OpenBoxes issue upstream and will lift the restriction once it's fixed.