Before you install.
While you grow.

Getting started

Yes. Request a seven-day offline evaluation and select VMware / ESXi, Hyper-V, Huawei Cloud x86 or Huawei FusionCompute x86. The current packages use PostgreSQL and signed-file activation without endpoint agents. All four formats passed isolated checks; earlier native VMware/Hyper-V evidence exists, while exact final-package native acceptance and native Huawei validation remain separate. Read the package testing status before rollout. Vendor approval, an expiring download and a signed installation-bound trial licence are separate steps.

Security & rollout

The customer appliance uses signed-file activation and can operate without internet validation. Transfer an installation request to the vendor, then import the signed licence. Endpoint agents are not included. Your company manages the VM, local network, backups, stable address and HTTPS certificate. Read the offline deployment guide.

Getting started

Support requests, approvals, conversations, technician ownership and equipment records. Start with your services and responsible teams; then configure the forms and policies that connect them.

Getting started

Start with company identity and service locations. Create departments, users and responsible teams, then services and catalogue entries. Define request forms, approval rules and assignment policies. Simulate representative requests before publishing and run a pilot with employee, approver and technician accounts.

Getting started

Yes. Configure the locations your company needs and include location and department in your workflow conditions. For example, a Factory hardware request can follow a different approval route from a Head Office application request. Check each location in the simulator before rollout.

Getting started

OTL offers hosted company workspaces and separate on-premises appliances. Hosted workspaces keep company databases/files separate. Offline customers run their own appliance. Ask sales@oneticketless.com for pricing based on the required technician allowance, licence term, hosting and support. This website does not publish a fixed price.

Forms & workflows

Administration provides service and catalogue configuration, inventory types, form fields and approval workflow controls. Define what information a requester must provide, then use supported conditions to select the approval route. Validate both the form and its workflow using a sample submission.

Forms & workflows

Configure the request-purpose options in administration and match them in your workflow rules. Additional equipment can require business-need approval; replacement can collect the current asset and fault; upgrade can collect a justification or declared cost. Preview each purpose separately: the example routes on this website are illustrations, not mandatory policies.

Forms & workflows

Create a required numeric request field for the declared amount, then use its identifier in a workflow threshold condition. Add the appropriate approval stage and simulate values below, equal to and above the threshold. This is a declared amount, not an automatically calculated purchase price.

Forms & workflows

Yes. Configure a named approval group with all-member, any-member or quorum approval. The engine records each decision. A rejection vetoes the request; requesters and beneficiaries cannot approve their own requests. Test the group with distinct user accounts.

Forms & workflows

Use dated delegation for planned cover. Approval escalation can add an approver after a configured elapsed time without lowering the vote requirement. Single-authority rerouting is recorded. Group membership is fixed for that request; use delegation or revise and resubmit where a membership change is needed.

Forms & workflows

The simulator uses the same rule selection and stage resolution as submission. Provide the same employee, location, service, purpose and custom field values, then inspect the selected rule and stages. Publish the intended configuration and verify a pilot ticket with those same values.

Forms & workflows

The selected workflow revision and resolved stages are captured for the request. Publishing new conditions does not silently rewrite an existing approval journey. Review or revise the request when a changed policy needs to apply; active-account and delegation checks still apply.

Forms & workflows

The engine supports bounded conditional approval workflows, not arbitrary programs. Current documented limits include 12 stages per rule and 25 named members per group. Cyclic workflows, unrestricted scripts, automated financial postings and dynamic team-based quorum membership are not supported. Bring unusual policies to a walkthrough so they can be assessed before purchase.

Assignment & operations

Define separate assignment rules for each service and team. Use round robin for the Infrastructure queue and manual assignment for the Application queue. Check rule priority and fallback behavior in the assignment simulator so a broad rule does not override a service-specific policy.

Assignment & operations

Configure technician availability, relevant skills and active-work limits alongside assignment rules. Preview who is eligible and why candidates were skipped. Test the case where nobody qualifies so work remains visible for a manager to handle instead of assuming it was assigned.

Assignment & operations

Configure the unaccepted-ticket escalation policy and its interval. Review the notification or reassignment behavior with your team and keep assignment history available. Include worker scheduling in installation checks: timed policies need the background processing service to run.

Assignment & operations

Use the ticket journey for its current stage and owner, and the conversation for decisions and follow-ups. Read receipts show recorded viewing activity; they are not approval or proof that the requested work was completed. Use the actual approval and completion actions for those outcomes.

Assets & returns

Yes. Allocate assets to employees, rooms or departments and record their location. Use IT custody for stock held by IT. This distinguishes a shared conference-room device from a laptop issued personally to an employee.

Assets & returns

Review their assigned equipment, confirm what has physically returned, and record the return to the appropriate IT custody location with its condition and reason. Keep unreturned equipment attributable to the former employee until recovered. Deleting an account is not evidence of a physical return.

Assets & returns

Link the existing asset to the replacement request, record the return reason and condition, then issue the replacement through the approved process. Keep faulty, dead or scrapped equipment out of available stock. The original asset’s movement history should remain available.

Assets & returns

Authorized asset deletion preserves audit history. Use disposal or scrap when equipment genuinely existed and is being retired; use deletion for records that should no longer be active. Check linked custody and fulfilment records before taking either action.

VPN & records

Raise the configured VPN-access request and complete its required approvals. Provision and record the account through that request so it is associated with the employee and ticket. VPN access should not create a laptop-issuance requirement. The register is a record of access, not a VPN gateway.

VPN & records

The current register is restricted to system administrators and requires a separate vault passphrase. Impersonated sessions cannot open it, and technicians cannot browse its credentials. Unlock lasts five minutes; five incorrect attempts pause unlocking for 15 minutes. Credential reveal is a deliberate, audited action.

VPN & records

The designated vault custodian can import existing accounts during the initial import window. Reconcile the list, then finish the import to close that route. New provisioning thereafter uses approved VPN requests. Filter by source to distinguish imported accounts from ticket-provisioned ones.

VPN & records

Do not assume it does. Follow your offboarding procedure to disable access on the actual VPN platform and record the outcome against the relevant request. The register does not itself guarantee gateway revocation; include that verification in your offboarding checks.

VPN & records

No. Record the requester, decisions, owner, provisioning outcome and relevant asset or account link. Keep credentials in the protected register, not in comments, attachments or public notes. Audit records provide accountability without exposing plaintext secrets in the conversation.

Security & rollout

Administration includes MFA policy and SMTP configuration. Pilot enrollment and sign-in with representative users before enforcing the policy, and verify outbound email with the company’s SMTP settings. Plan recovery and administrator access before a broad rollout.

Security & rollout

Core requests, approvals and asset records can be used without an endpoint agent. Device telemetry is a separate rollout component. Confirm supported operating systems, installer readiness and required diagnostics with the team before including agent deployment in your purchase scope.

Security & rollout

Test each location and request purpose as an employee, approver and technician. Include rejection, clarification, absent approvers, no eligible technician, asset return and VPN offboarding. Verify permissions, email, background processing, backups and restore procedures. Agree acceptance criteria for your own policies before rollout.

Security & rollout

One Ticket Less is a product of Cipherstacks (www.cipherstacks.xyz). Contact sales@oneticketless.com with your company size, service teams, hosting needs and example policies to arrange a guided walkthrough.

Offline installation

The current appliance uses Ubuntu Server 24.04 LTS, x86-64. Ubuntu is already installed inside the VM; you do not install it separately. The kernel package version can change through reviewed maintenance and is not the same thing as the Ubuntu release.

Offline installation

Use the VMware OVA for ESXi; the Hyper-V ZIP contains a VHDX. Huawei Cloud x86 uses the Cloud QCOW2 package; Huawei FusionCompute x86 uses its separate VHD package. Do not interchange packages or rename disk extensions. Read the included platform-specific instructions and testing status.

Offline installation

The current delivery is x86-64. It is not a native ARM64/Kunpeng appliance. Confirm architecture and host compatibility with the vendor before requesting a package.

Offline installation

Request the correct package, verify its authenticated SHA-256 checksum, import a new VM, map its network and boot it. Open the VM portal address from a workstation, trust the approved HTTPS certificate, retrieve the private owner setup key at the VM console, create the company owner, download the installation request, obtain a signed licence and import it. Then configure and test company policies. Download the illustrated installation handbook.

Offline installation

Run OTL Linux commands inside the OTL appliance VM. ESXi/Hyper-V management is a different system. Windows PowerShell VM-creation commands run on the Hyper-V host; browser setup runs on a client workstation. The PDF labels these locations.

Offline installation

The documented customer route is the supplied virtual appliance. An existing server needs a compatible virtualisation environment, or a separately supplied and qualified OTL container bundle. The VM disk is not a bare-metal installer ISO. Do not treat the appliance instructions as a generic source-code installation recipe.

Offline installation

The reference appliance build uses 4 vCPUs, 8 GB RAM and a 64 GB logical system disk. Actual sizing must follow employee count, concurrency, attachments, retention and restore requirements. Agree sizing before deployment; thin provisioning still consumes storage as data grows.

Offline installation

Open the HTTPS address displayed by the OTL VM console, not the ESXi/Hyper-V management IP. Use a reserved DHCP address or approved static address. You can configure an internal DNS name and the matching certificate/origin. Customers control their own DNS and certificate arrangements.

Offline installation

No public domain is required for initial IP-based HTTPS setup. Signed-file activation can be completed by transferring the request and returned licence through an approved separate device/media process. Services you choose, such as external SMTP or public certificate issuance, may have their own connectivity requirements.

Offline installation

Initial HTTPS uses an appliance-generated private CA. Have your IT team verify its fingerprint and distribute its public root certificate, or configure an approved customer certificate. Check the exact URL and clock as well. Never distribute the private CA key or make a permanent certificate-warning bypass part of acceptance.

Offline installation

At the authenticated OTL VM console run sudo otl-show-setup-key. Keep the output/private setup-key file confidential and transfer it only to the authorised setup workstation. It is separate from your signed licence and from the public HTTPS CA certificate. Never post it in chat or screenshots.

Offline installation

The current recovery fix can refresh an unchanged generated IP/internal-HTTPS binding on startup when exactly one replacement VM IPv4 address exists. Custom domains/proxy configurations are preserved and need a coordinated change. Use a stable address in production and follow the handbook if startup reports an ambiguous network.

Offline installation

Allow HTTPS TCP 443 from approved users. The proxy also maps HTTP TCP 80 for redirect/certificate workflows. Restrict any SSH management access to approved administrators. Do not expose PostgreSQL 5432 or application port 3000 publicly. Internal mail/directory/time services need their own approved paths.

Offline installation

No. Current formats passed isolated controller/boot/network recovery checks. Earlier native VMware and Hyper-V checks exist, but the exact final refreshed packages still need native-host acceptance. Native Huawei Cloud/FusionCompute validation remains pending. An isolated boot is not universal platform certification.

Licensing & renewal

Ask sales for an explicitly issued 30-day offline licence and the required technician allowance. Complete VM/company setup, download the installation request under Administration > Licensing and send it to the vendor. Import the returned signed JSON and confirm its exact dates, company and quota. The seven-day website evaluation is not automatically a 30-day licence.

Licensing & renewal

Downloading or importing the VM is not activation. Operational use needs a valid applicable signed licence imported into that installation. For a trial, confirm the issued start/end dates; do not assume unused download time extends the signed term.

Licensing & renewal

The appliance exports an installation request. The vendor signs a licence bound to that installation, customer, validity and allowance. You transfer the signed file back and import it. Verification uses public keys in the appliance; vendor private signing keys are not given to customers and no internet validation is required.

Licensing & renewal

Eligible active ticket-working accounts consume technician seats according to the signed licence, including applicable Infra/Application technician and ticket-working manager/permission roles. A person is counted once. Employee-only, HOD-only and admin-only accounts are not all technicians; vendor-support identities do not consume customer seats. Confirm the current count in Licensing.

Licensing & renewal

Yes. Purchase the additional allowance, then ask for a newer signed licence for the same installation with the increased limit. Import it under Administration > Licensing while offline. No internet or reinstall is required. A downgrade may require releasing excess seats first.

Licensing & renewal

When the applicable validity/grace policy no longer allows operation, operational writes and automation are blocked. Records remain available for permitted reading/export and licence renewal; expiry does not itself delete customer data. Import a valid renewal for the same installation and check its terms.

Licensing & renewal

No. Keep the existing VM and installation identity. Obtain a newer signed renewal for that installation and import it in Licensing. Reinstalling or resetting the identity can make a licence issued for the old installation unusable.

Licensing & renewal

A fresh offline appliance requires a valid applicable licence for normal writes and scheduled automation. The owner can access activation-related functions and permitted records, but being an administrator is not a licence bypass.

Licensing & renewal

Clock rollback checks and signed licence terms are enforced, but a fully offline application cannot promise absolute protection against a hostile administrator restoring an entire VM and its historical clock/state. Keep accurate approved time, honour the licence and do not treat snapshots as a renewal method.

Backup & maintenance

Back up PostgreSQL together with matching customer files/encryption keys, deployment secrets/configuration and HTTPS CA/certificate state. Keep encrypted off-VM copies and test a populated restore on a separate recovery VM. A database dump or hypervisor snapshot alone is not proof of recoverability.

Backup & maintenance

The current offline appliance requires PostgreSQL and does not silently fall back to SQLite. A legacy DB_PATH name can remain as a filesystem anchor for keys/files; that filename is not evidence SQLite is the active database.

Backup & maintenance

apt update refreshes repository metadata; it does not install upgrades. Fully disconnected servers need an approved internal mirror/offline package process. Review and approve OS package changes, back up first and reboot for an updated kernel when required. OTL container/application/database-major updates follow separate vendor maintenance instructions. Do not blindly change distribution or use unreviewed container images.

Backup & maintenance

A licence grants the agreed term and allowances; it is not an application update. Maintenance packages use separate update-signing trust and an approved workflow with preflight, backup, independent approval, a maintenance window and postchecks. Follow the release instructions and recovery plan.

Backup & maintenance

Yes. The November 2026 release notes record remaining Ubuntu guest-kernel findings and platform-validation gaps. Available supported updates and mitigations were applied/tested where possible; mitigations are not proof a vulnerability is patched. Review the delivered kernel/testing status and ongoing maintenance before production acceptance. No vulnerability-free guarantee is made.

Backup & maintenance

No ISO certification is claimed on this website. Product controls can support an organisation's processes and evidence, but certification requires the applicable organisational scope and independent assessment. Audit-readiness screens are not a certificate.

Accounts & access

OTL provides directory/account integration controls. Configure and test the connection, mappings and permissions with your directory administrator before bulk rollout. An offline appliance may reach approved internal directory services without public internet. Directory policies, certificates and account lifecycle still need customer configuration.

Accounts & access

Use the configured account-onboarding/password policy and internal SMTP. Users should replace temporary credentials as required. Reset links must use a portal hostname recipients can resolve and reach. DNS A/CNAME records route the hostname; they do not send email. Test the full reset flow before rollout.

Accounts & access

These are separate accounts. The customer controls its delivered VM console credentials and company-owner password. Vendor-console credentials and signing passphrases stay with the vendor. Never reuse demo credentials or share private setup/signing keys.

Accounts & access

Company administrators configure the customer MFA policy and can require enrolment where appropriate. Do not copy demonstration bypass settings into production. Vendor operations have their own protected authentication requirements. MFA recovery should follow a documented identity-verification procedure.

Accounts & access

This website help assistant searches the published OTL FAQ locally in your browser. It is not a live agent or generative-AI service. Chat messages are not sent to a chat backend or stored by this assistant. For a quotation or an unanswered question, choose the sales email link; that opens your email app and you decide whether to send it.

Accounts & access

No. The public help assistant cannot access customer workspaces, private licences, mailbox accounts, passwords or vendor actions. Do not enter credentials or private keys. Use your company administrator or the approved sales/support channel for account-specific help.