How we protect your records, in plain words.
This page says only what Openn Assets does today. We do not hold security certifications yet, and we will not suggest otherwise.
Protections
Each workspace is kept apart
Every record belongs to one workspace, and every query for customer data is limited to the workspace of the person asking. Permissions are checked on the server for each action, not only by hiding buttons.
Sign-in and two-step verification
Passwords are stored only as scrypt hashes. Admins can add an authenticator app, and a workspace owner can require it for everyone who manages records. Sign-in codes expire, stop working after five wrong tries, and attempts are rate-limited.
Sessions
Your session is a random token in a cookie that page scripts cannot read. We store only a hash of it, so a copy of our database would not let anyone sign in as you.
Encryption
All traffic uses HTTPS, and browsers are told never to fall back to plain HTTP. Licence keys and authenticator secrets are encrypted in the database with AES-256-GCM, and licence keys are shown only by their last four characters. Google Cloud encrypts the server’s disks.
An audit trail that cannot be edited
Every change to an asset, a person or a licence is recorded with who did it, when, and what it was before and after. The database refuses to change or delete these records, and each one carries a hash of the one before it, so a removed or altered entry breaks the chain and shows. Passwords and secrets never enter the trail.
Files
Receipts, invoices and photos are kept outside the website’s public folders, under random names, one folder per workspace. They are opened only after a permission check, and only PDF and common image files are accepted, checked by their content rather than their name.
No third-party scripts
No analytics, advertising or chat widgets run on our pages. Fonts are served from our own server, and a strict content security policy lets the browser load scripts only from us. Our pages cannot be framed by other sites.
Backups
The database and uploaded files are backed up regularly and the copies are kept apart from the live server.
Your data, whenever you want it
Export assets, people, licences and history to CSV at any time, on every plan including Free. Downgrading or leaving never locks you out of your own records.
We design for India’s Digital Personal Data Protection Act 2023 and the EU GDPR. Read the privacy policy, the data processing terms and the sub-processors.
Device control
A record in a database cannot lock a laptop.
A remote lock works only when the device was already placed under authorised management, the control exists on that system, the device is online to receive it, and the right policies are in place. So we never call a laptop “locked” or “blocked” because of a status in Openn Assets.
What each level of control means
- 00
Inventory only
Every planMark a device as not returned, open a case, notify the employee and their manager, and end the person’s access to Openn Assets.
Does not lock or switch off the computer.
- 01
App and identity access
In your own toolsRemove the person’s access to company apps through the identity tools you already use. Your exit checklist reminds you to do it.
Sign-ins already saved on the laptop and its offline files are not removed.
- 02
Screen lock on a managed laptop
Not includedAsk an enrolled laptop to lock its screen while it is online, and record whether it confirmed.
Anyone with a valid login can unlock it again.
- 03
Restricting a managed device
Not includedStop further use through supported device management, after a controlled approval.
Needs prior enrolment, tested recovery and careful handling to avoid locking out the wrong person.
- 04
Lost or stolen device
Not includedLost mode or erase through supported device management.
May be destructive and cannot always be undone.
Levels two to four are not in any plan. If we offer them, it will be as a separate add-on, only for company-owned devices, after testing on each system, with two-person approval, notice to the employee and a tested way to undo them. Wiping a device will never be the default response to a late return, and there is no hidden tracking of employees.
What is possible on each system
Mac
Remote lock is possible only when the Mac is enrolled in device management and online.
Not possible: a plain script cannot lock a Mac that is not managed.
iPhone and iPad
Lost mode on supervised, eligible devices with an internet connection.
Not possible: control of personal devices.
Windows PC
Turning off company, VPN and app access, and policies through a supported, tested management setup.
Not possible: a general, permanent remote lock of Windows sign-in.
Linux
Revoking managed accounts through an agent or tools already installed and connected.
Not possible: protection when the laptop is offline or started from another drive.
Offline device
A request is held and shown as “Pending delivery”, never as done.
Not possible: an instant lock. The device has to come online first.
Found a problem?
Write to support@theopenngroup.com with “Security report” in the subject and the steps to see it. We reply to every report and will not take action against good-faith research that avoids other people’s data.