Security, tiers and the practical questions

For the record itself, yes: needs, requirements, design items, hazards and test cases in one traced project, verification results and evidence against each requirement, immutable baselines and a full change history, with every export in an open format. It is in alpha, holds no certification, ships no tool qualification kit and has no electronic signatures, so a regulated programme should pilot it on a real subsystem and qualify it for its own process. The safety-critical page sets out what it covers and what it does not.

Self-hosting is free, with every feature, under the source-available Elastic License 2.0, where enterprise tools are typically licensed per user. ReqIF 1.x import and export are built in, though an exchange with DOORS or Polarion has not been tested yet. AI agents run on your own subscription or API keys and, by default, only propose changes a person approves. Traceability, gap reports, baselines and the activity log cover what an audit asks to see; electronic signatures, a separate approver role and tool qualification, which mature enterprise tools offer, are not there yet.

Features: typed requirements, user needs, design items, hazards and test cases; rule-checked trace links, a traceability matrix and gap reports; test runs with evidence; baselines and baseline comparison; a review workflow; PDF, Word, Excel, CSV, JSON and ReqIF downloads; and AI agents that work through proposals. Deployment: the hosted service at openv.app, free during the alpha, or self-hosted with Docker Compose. Limitations today: no electronic signatures, multi-factor authentication or SAML of its own, no Excel import, a single API instance, and ReqIF tested only between OpenV instances.

Members you grant access to, by name or by team, at the role you choose: owner, editor, reviewer or viewer. Workspace admins see every project in their workspace. Nobody else, unless you mint a share link, and a link stops working the moment you revoke it.

Every request is checked against the caller’s workspace and project role before anything is read or written; there is no path to another workspace’s rows. Files are stored under the uploading workspace and served only through that same check.

In transit, always: the hosted service is HTTPS only, and the API refuses plain HTTP behind the proxy. At rest, the hosted database and file volume are encrypted by the hosting provider. Session tokens, runner keys, invitation tokens and share-link tokens are stored as SHA-256 hashes, never in the clear.

An agent reads your project through typed tools scoped to the project it runs in and, unless you choose otherwise, writes back as proposals a person approves. It runs on your own AI subscription or your workspace’s own API keys, so your requirements go to the AI provider you chose and to no one else. OpenV does not resell or train on your data.

Yes. Self-hosting is free forever under the Elastic License 2.0, with every feature, and the Agent Connector runs agents on a machine you control. A JSON export from the hosted service restores into a self-hosted OpenV.

The full product for one person in a personal workspace: requirements, traceability, V&V, documents, interviews and agents on your own AI subscription. Sign-in by password or Google. Exports on every format. Free.

Everything in Single User, plus agents on your own API keys, an always-on hosted runner for cron and event automations, and a larger cloud runner. Still one person, still your own keys.

Shared company workspaces with members and teams, per-project access grants, a workspace AI budget with usage reporting, and the monthly stable release channel with an upgrade window you choose. Workspace admins are notified of every membership change.

Business, on your terms: a dedicated instance on your servers or ours with our support, SSO/OIDC and directory setup, custom integrations with your PLM, ALM, ticketing or CI, a support SLA and priority fixes.

Every feature of every tier, on your hardware, no limits from us. Security is yours to run: your TLS, your backups, your identity provider, your network.

The hosted service, free for as long as it exists. For an open-source project the deal is public by design: the latest baseline of every project in the workspace is published on the open-source page, while live work stays private until the next baseline.

A workspace admin subscribes from the Billing tab in workspace settings: Business Lite is a flat price, Business is per member, both monthly or yearly, in GBP, USD or EUR. Payment goes through Stripe on a page of theirs, so no card detail ever reaches OpenV; VAT is worked out at checkout and a business VAT number is accepted. Invoices, the payment card and cancellation are managed in the same place. A first subscription starts with a 14-day trial. If a subscription lapses, everything in the workspace stays readable and exportable.

Download a PDF or Word document with exactly the sections and fields you choose, or mint a public share link that opens the live project, read only, with no account. The link unfurls with a preview when pasted into Slack, Discord, LinkedIn or Teams.

Mint a reviewer link, or grant the reviewer role by name. A reviewer reads everything and adds notes, comments and mentions, and cannot change a word of the specification.

An immutable snapshot of every artifact and link, and of the list of attachments, at a moment: what was agreed at a review, a release or a contract. Any document can be produced from a baseline instead of the live project, and two baselines can be compared for the list of what changed.

Always, on every plan: PDF, Word, JSON, CSV, Excel and ReqIF, from the live project or any baseline. A JSON export restores into another OpenV, hosted or self-hosted.

ReqIF, the OMG interchange format both read and write, is an import and an export format in OpenV.

Yes, as an installable web app: the requirements module stacks into panes, approvals and comments work with a thumb, and notifications arrive as pushes.

You keep what you have until it is announced otherwise, and export never depends on a plan.