Frequently Asked Questions

General

What is OpenBoxes?

OpenBoxes is an open-source supply chain management system designed for healthcare organizations. It handles inventory tracking, procurement, distribution, and reporting for medical supplies, pharmaceuticals, and other commodities. It is used by hospitals, NGOs, and government health programs in over 20 countries.

What is OpenBoxes Lift?

OpenBoxes Lift is a fully managed cloud hosting platform for OpenBoxes. Instead of setting up and maintaining your own servers, database, and infrastructure, Lift handles everything: provisioning, backups, updates, security, and monitoring. You sign up, and your OpenBoxes instance is ready in minutes.

How is Lift different from self-hosting OpenBoxes?

With self-hosting, you are responsible for servers, databases, SSL certificates, backups, updates, and security patches. With Lift, all of that is managed for you. You get automatic backups, guaranteed uptime SLAs, managed security updates, and support --- without needing a dedicated IT team.

Who is OpenBoxes Lift for?

Lift is designed for healthcare organizations, NGOs, government health programs, and any organization that manages medical supply chains and wants a reliable, low-maintenance deployment of OpenBoxes.

Can I try OpenBoxes before signing up?

Yes. Request access at openboxes.cloud/demo — enter your email and we'll send you an access email in seconds, with a one-click button that signs you straight into the public demo (it also lists your login details for signing back in later). No account or payment details needed. The demo carries a purpose-built sample data set — a fictional health NGO with a central warehouse, four regional depots, fifteen clinics, 500+ products and about two years of supply-chain history — plus open work you can actually finish, like a requisition awaiting approval. It resets once a day (3:00am US Eastern), so if your credentials stop working, just request fresh ones from the same page.

Account & Billing

Visit openboxes.cloud and click Start Free Trial. You will choose a plan, create your account, pick a subdomain, and your instance will be provisioned automatically.

Can I upgrade or downgrade my plan?

New signups can choose Shared or Dedicated directly. To move an existing Shared subscription to Dedicated, message us in the portal chat and the team will arrange the migration. Downgrades from Dedicated to Shared also require a coordinated data migration. Enterprise plans are custom and changes are handled with our team directly.

Can I cancel anytime?

Yes. There are no long-term contracts on Shared or Dedicated plans. You can cancel through the portal, and your subscription ends at the end of the current billing period. Data export is available before cancellation.

Do you offer discounts for NGOs or nonprofits?

There is no separate nonprofit pricing today — but the founding-member offer already gives 50% off for 24 months to everyone who signs up before December 31, 2026, applied automatically. Many OpenBoxes users are humanitarian and health organizations. For institutional situations that don't fit the standard plans, contact our sales team at sales@openboxes.cloud.

What payment methods do you accept?

We accept major credit cards (Visa, Mastercard, American Express) and US bank accounts (ACH direct debit). During signup you can enter your card directly, provide it via Apple Pay / Google Pay where your browser offers them, or connect a US bank account by logging into your bank — verified instantly, with no microdeposits. Bank accounts can only be added during signup; after that, the portal's Billing page takes cards only (entered directly, or via Apple Pay / Google Pay). Alternative billing arrangements, such as invoicing, can be discussed as part of an Enterprise agreement.

Are there any hidden fees?

No. The published price includes hosting, backups, SSL, and standard support. There are no paid add-ons — if you need more users or storage than your plan includes, the answer is moving to a higher plan.

Technical

What browsers are supported?

OpenBoxes works best on modern browsers: Chrome, Firefox, Safari, and Edge (latest two versions of each). Internet Explorer is not supported.

Can I access OpenBoxes on mobile devices?

OpenBoxes is a web application that works in mobile browsers, though it is optimized for desktop and tablet screens. Core functions like viewing inventory and approving shipments work on mobile, but data-heavy tasks like bulk imports are better on a larger screen.

How is my data backed up?

Instance data is backed up with retention that varies by plan --- 30 days on Shared, 60 days on Dedicated, and 90 days on Enterprise. Backups are encrypted at rest. If you need a restore, contact support and we'll coordinate it with you.

Can I export my data?

Yes. OpenBoxes provides data export in CSV and Excel formats for most entities (products, inventory, shipments, purchase orders). You can also use the REST API to extract data programmatically. If you cancel your subscription, you have 30 days to export your data before the instance is decommissioned.

Is my data isolated from other customers?

Yes. Every tenant on OpenBoxes Lift gets an isolated database schema. Your data is never co-mingled with another organization's data, regardless of tier.

Can I use my own domain name?

Not currently. All instances are hosted under the openboxes.cloud domain (e.g., yourorg.openboxes.cloud). Custom domain support is planned post-launch and is not available on any plan today.

How are updates handled?

Lift manages OpenBoxes version updates. We test updates before rolling them out, and all tiers are updated by Lift. For Dedicated and Enterprise customers we do our best to coordinate timing around your operations.

Security & Compliance

Is my data encrypted?

Yes. Data is encrypted in transit (TLS 1.2+) and at rest (AES-256). Database backups are also encrypted.

Where is my data hosted?

OpenBoxes Lift runs on Google Cloud Platform (GCP) in the us-east1 region. Region selection is not available today; organizations with data-residency requirements can raise them as part of an Enterprise agreement.

Do you support single sign-on (SSO)?

Signing in with Google, Microsoft, or GitHub is available for individual accounts on every plan. Organization-managed SSO (connecting your own identity provider, including SAML) is not available on any plan today; organizations that require it can discuss it as part of an Enterprise agreement.

Account Setup

When your OpenBoxes instance is provisioned, we rotate the default OpenBoxes admin user's password to a strong random value and show you that password exactly once on the signup-complete page. We call it a break-glass credential because it's only for situations where you need to log directly into OpenBoxes and our portal Single Sign-On is unavailable.

You should:

Copy the password to your password manager when shown — we do not store it on our side after that moment, and we cannot recover it for you.
Use the portal's SSO link (app.openboxes.cloud → "Launch") for normal daily access — the break-glass credential is not your day-to-day login.

If you missed it or lost it: sign in via the portal SSO, then use OpenBoxes' built-in Forgot Password flow to reset the admin user's password. The break-glass credential isn't recoverable from our side — that's intentional, so a compromise of our portal doesn't expose direct-OB access on your account.

Why doesn't OpenBoxes Lift accept email addresses with `+` aliases?

Some users like to add +tag aliases (e.g., you+lift@example.com) when signing up for services so they can filter mail by sender. OpenBoxes' built-in login form has a quirk where the + character in a username gets URL-decoded to a space, which breaks direct OpenBoxes login for accounts using these aliases. Single Sign-On via the portal would work, but the direct-OB login path would not — so we block + at signup to avoid the inconsistent experience.

Please use a primary email address (e.g., you@example.com) at signup. If filtering matters, most providers let you create per-service aliases that don't rely on + (Gmail's dots, custom domains, etc.). We track the underlying OpenBoxes issue upstream and will lift the restriction once it's fixed.