Finlay.works
Service management software, written plainly.

Proof and evidence

Current product proof, ready for review

BareBones Ticketing 1.1.0 is the current general release, with an executed validation package designated for it, written for QA and compliance readers and available to Professional and Lifetime customers in their account, with its SHA-256. Below is what a governed buyer can review today, and what is not claimed.

Validation package

Validation package, release by release

Each release carries an executed validation package, designated by the validation team; Professional and Lifetime include it as an account download.

  • Written for QA and compliance readers: the executed validation record for that exact release, with a technical appendix.
  • Delivered in the customer account for Professional and Lifetime, with the package SHA-256 shown beside the download. Validation designated during a paid term stays available after it ends.
  • Not a substitute for validating your own installation and intended use, and not a claim that the product alone makes you 21 CFR Part 11 compliant.
Editions that include it

Explore now

Evidence you can open yourself, nothing to request

Most of the proof a governed buyer wants is already public or in the product. Start here; no form, no wait.

Product surface map

Open the live demo and click through requester, service catalog, agent queue, project-linked work, external participant, and administrator surfaces yourself. Nothing to install, no form to fill in.

Open the live demo

Sample workflow walkthrough

The demo carries a worked scenario: intake, service lane, queue ownership, workflow and SLA movement including a paused clock, external participation, and a specialist confined to one department. Walk it as any role.

Walk it in the demo

Published manual

The BareBones Ticketing 1.1.0 manual is published openly: install, configure, use, operate, and reference. The first working service example was walked live end to end before the manual was first labeled for 1.0.0.

Open the manual

Deployment direction

The supported 1.0 packages are a Windows Service on Windows Server 2019, 2022, or 2025, and a single-node Linux Docker Compose bundle for RHEL 9, Rocky 9, Ubuntu Server 24.04, or Debian 12. Unsupported deployment promises are kept out of scope.

Read the requirements

Security-assessment summary

What was checked, what remains tracked, and how to read the current internal assessment, in the approved wording.

Review assessment summary

Release and package evidence

1.1.0 is published, the first feature release of the 1.1 line, after 1.0.1, the maintenance release of 1.0. Release notes and the package SHA-256 sit beside each download in the customer account; every download is entitlement-checked and verified against the published manifest. A 60-day trial key opens that account without a card.

Get a trial key

Ask for in writing

Evidence buyers can request

Two things need a written exchange. Replies are written and asynchronous; allow several business days.

Validation package

The executed validation record for each release, designated by the validation team and available to Professional and Lifetime customers in their account, with its SHA-256. Before purchase, ask for the packet's scope in writing if your review needs it first.

What it is and is not Ask about the packet's scope

What you receive

A written fit response can answer requested proof points, identify unavailable evidence plainly, connect terms and procurement routes, and recommend the smallest useful next step.

Request a written fit assessment

Security assessment summary

Internal assessment with traceable scope

BareBones Ticketing underwent a documented, OWASP-informed internal product-security assessment of a traceable non-production build. The assessment combined dependency review, source-assisted control review, bounded unauthenticated passive web testing, a narrow requester-only authenticated check comprising one passive ZAP request, service probing, and Greenbone vulnerability scanning. No new material application vulnerability was validated within the assessed scope. One Medium CI/CD supply-chain finding remains tracked for remediation.

How to read it
  • Internal review of a traceable non-production build.
  • Useful for buyer diligence, not a replacement for an independent audit or certification.
  • Open remediation stays tracked as product work.
What a buyer can ask for
  • A written BareBones Ticketing fit assessment.
  • A guided walkthrough of the current product surfaces.
  • Release notes and package checksum or provenance evidence when a customer-approved package is available.
  • A summary of payment, account, license, download, billing, and support routing.
  • Scoped implementation planning for service catalog, workflow, access, SLA, and handoff needs.
Evidence still earned over time
  • Customer testimonials, logos, and adoption metrics require real customer permission.
  • Independent security certification, high availability architecture, and customer scale evidence require future evidence.
  • Migration and download claims stay tied to approved product artifacts.

Next step

Ask for the proof that fits your decision

Send the service management problem, the evidence you need, and any procurement or review deadline. Finlay.works answers in writing and says plainly when a requested proof point is not available yet. Replies are written and asynchronous; allow several business days.

Ask in writing, with the proof you need