Security at OpenBoxes Lift

Enterprise-grade security to protect your business data

Security Features

Comprehensive security measures at every layer

Authentication

  • Multi-factor authentication (MFA)
  • Company sign-in (SSO) over SAML 2.0 or OpenID Connect, on Enterprise or as a Dedicated add-on
  • Password policies and complexity
  • Session management and timeouts

Access Control

  • Role-based access control (RBAC)
  • API keys bound to one tenant, with expiry and revocation
  • Audit logging of admin actions

Data Protection

  • Encryption in transit (TLS 1.2+)
  • Encryption at rest (AES-256)
  • Secure key management
  • Data isolation between tenants

Company sign-in (SSO)

Available now. Your people sign in to OpenBoxes Lift and to your OpenBoxes instance with their company account, over SAML 2.0 or OpenID Connect, with Microsoft Entra ID, Okta, Google Workspace or any standard provider. Your organization verifies its email domain with a DNS TXT record, and we set it up with you. Included on Enterprise; on Dedicated it is an add-on at $299/month, or $2,900/year on the annual plan. Not available on Shared.

Company sign-in on the pricing page →How it works →

The AI assistant in OpenBoxes

The assistant is off until your account owner turns it on. It asks OpenBoxes with the signed-in person's own sign-in, so it sees only what they can see, and it only looks at the locations they can open. It reads, and the only changes it can make are draft stock requests and stock changes, each only where the account owner has turned it on and only after the person using it clicks Confirm. The assistant cannot undo a stock change. Its answers appear in a sealed box that cannot reach the OpenBoxes session or load anything from the internet, and it can only use a fixed list of lookups, so text hidden in a product name or description cannot send it anywhere else.

How the AI assistant works →

Infrastructure Security

Built on Google Cloud Platform with defense in depth

Edge & Network
Google Cloud edge with baseline DDoS protection, TLS termination at the load balancer
Application
Kubernetes (GKE), Container Isolation
Data
Encrypted Storage, Private Network

Key Infrastructure Controls

  • Network Isolation: VPC with private subnets, no public IPs on workloads
  • Encryption: TLS 1.2+ in transit, AES-256 at rest
  • Access Control: IAM with least privilege, Workload Identity
  • Monitoring: Automated alerting on infrastructure and application metrics, reviewed during business hours
  • Backups: Automated daily backups with 30-day retention
  • Updates: Managed Kubernetes with automatic node patches

Report a Vulnerability

We take security seriously and appreciate responsible disclosure. If you discover a security vulnerability, please report it to:

We acknowledge reports within one business day during Eastern business hours (9am–6pm ET, Mon–Fri), and respond on a best-effort basis outside of those hours.

What to expect

  • Initial acknowledgement within one business day.
  • A meaningful triage response within five business days describing severity, expected fix window, and any coordination needed.
  • Critical issues (S1) are deployed or mitigated within 24 hours; high (S2) within 7 days; medium (S3) within 30 days.
  • Public acknowledgement on this page once a fix has shipped, with your consent.

Safe harbor for good-faith research

We will not pursue legal action against security researchers who follow our disclosure policy in good faith, who avoid harm to other users and to the integrity of the Service, and who give us reasonable time to respond before public disclosure. The full safe-harbor scope, severity SLAs, and out-of-scope categories are documented in our vulnerability disclosure runbook.

Machine-readable advertisement

Our RFC 9116 security.txt file is published at openboxes.cloud/.well-known/security.txt.

Data residency

OpenBoxes Lift production data is hosted on Google Cloud Platform infrastructure in the us-east1 region (United States). Cross-border transfer information is documented in our Privacy Policy and Data Processing Agreement.

What would it take to trust us with your data?

Ask the hard questions: hosting, isolation, backups, who can see what. You'll get honest answers, including about what we don't have yet.

AI assistant. Conversations are recorded to improve our service. Please don't share sensitive data. Privacy

Have security questions?

Our security team is here to help address any concerns about protecting your data.

Contact Security Team