Where your register lives
You pick this at setup, and it decides everything else on this page.
This Mac and my devices
Everything stays on your hardware. Your phone syncs to your Mac across your own network. There is no account, and nothing reaches us at all.
Starkive Cloud
Your register syncs through a database we run, so a Mac and an iPhone can hold the same one. The rest of this page is about this option.
What we can read
Part of a cloud register sits on our server in a form we could read. Part of it does not. Here is the line.
| We can read this | We cannot read this |
|---|---|
| Asset tags, serial numbers, makes and models | The regulated-data register: whether a device is in scope for cardholder data, health data, controlled unclassified information or EU personal data |
| Who holds a device, and which site it is at | Disposal evidence: the witness, the wipe certificate, who authorised it |
| Status, purchase and warranty dates, prices | Lease payment terms |
| Hostnames, IP and MAC addresses you record about your own kit | Whether a recovery key is escrowed |
| Condition notes | |
| Photographs and file attachments |
The right column is encrypted on your device with a key we never receive. We cannot read it, we cannot hand it to anyone who asks for it, and we cannot get it back for you if you lose every device and your recovery phrase.
The left column is readable on our side on purpose. It is what makes search and sync quick. If that is not acceptable for your fleet, the answer is a local workspace, not a smaller cloud plan.
The audit trail
Every change to an asset is recorded. The values in those records are encrypted like the right column above. Who made the change, when, and to which asset is not, because the server has to order and filter on it.
- Nothing can change or delete a row. Not the apps, and not the keys our own servers run with. The database refuses it, rather than our code choosing not to.
- Every row carries a fingerprint of the row before it. Alter one in the middle, or take one out, and every row after it stops adding up.
The limit, since you would find it eventually: this does not yet prove that the newest rows were not removed. Catching that needs a copy of the last fingerprint kept on one of your own devices, which is what we are building next. Until then the trail is append-only because access control says so, and tamper-evident because the fingerprints say so. It is not yet tamper-proof.
Locking the app
Both apps can ask for Face ID, Touch ID or your password before they open the register.
Off unless you turn it on, in Settings. There is a grace period so you are not authenticating every few minutes, and a Lock now button for when you hand the machine to somebody.
Be clear what it is: it stops a person picking up an unlocked device and reading your asset list. It is not encryption, and it does not protect the file from somebody who takes the disk.
Turn on FileVault
Your register on a Mac is a database file. The sensitive fields in it are encrypted. The rest are not.
Anyone with the drive out of your Mac can read your asset list, and the app lock above does nothing about that. FileVault is what does, and Manifest assumes it is on. If you are keeping a register for anyone other than yourself, treat it as a requirement rather than a suggestion. On iPhone the equivalent is already on.
Pairing a phone to a Mac
The first time your iPhone connects to your Mac, both screens show a code. Compare them before you accept.
After that the phone will only talk to that Mac, and refuses anything pretending to be it. The link is TLS with a pinned certificate. So the attention worth spending is all on that one moment, on your own network, and none of it afterwards.
Whether the Mac answers on your network at all
It does not, until you say so. This is one switch, it starts off, and it survives a restart in whichever position you left it.
A fresh install opens no port and advertises nothing. Turn on Serve this network in Settings and the Mac starts listening on TCP 7277 and advertising a Bonjour service so a paired iPhone can find it. Turn it back off and the port closes; it does not merely hide the button.
This is also the answer we gave Apple when an automated scan asked why the app declares the entitlement that accepts inbound connections. The scan could not find the functionality precisely because the listener is built only after somebody opts in.
What is on an NFC tag
One HTTPS link carrying the register's own key for that machine, and nothing else.
No asset number, no serial, no make or model, no holder, nothing naming your organisation. A chip can be read by anyone who walks past it, with no pairing, no authentication and no trace, so the chip carries a pointer and the register holds the facts.
And it is the one thing here that cannot be re-keyed. Everything written to a tag sits permanently outside the client-side encryption. It cannot be rotated when an admin leaves, revoked, or scoped to a role. That is the whole reason nothing sensitive is put on one. Printed asset numbers are issued per organisation, so the same number names a different machine at every company using that prefix, which is a second reason to keep it off the chip.
A tag written by Manifest is a link to starkive.app/a/…. If somebody without the app taps it, they reach a page that explains what they are holding and can tell them nothing about the machine, because we do not have it.
If you connect your own tools
Manifest has a REST API for pointing your own systems at your register.
- You choose what each key can read. Every field is a switch, so a scanner that only needs serial numbers does not also receive holder names, prices and network addresses. Every field is listed on the API page.
- A key is shown once. We keep only a fingerprint of it, so we cannot show it to you again, only replace it.
- Keys stop working after a year. You renew one from the app, and that is deliberate: the key nobody has thought about for four years is the one that gets left behind.
- A key is limited to 120 requests a minute.
- Keys reach the readable half only. The encrypted half is not available through the API at all, whatever a key is configured to ask for.
Who else touches your data
| Who | What for | Where |
|---|---|---|
| Supabase | The database and file storage behind a cloud workspace | United States |
| Apple | App Store purchases and subscriptions. We never see your card | Per Apple |
| Cloudflare | This website. No customer data goes near it | Global |
A local workspace involves none of them except Apple, and only for the purchase.
What we do not collect
No IP addresses, anywhere, including in our own logs. No analytics inside the apps. No tracking, no advertising identifiers, and nothing sold or shared. The full detail is in the privacy policy.
Found a problem?
Email support@depaloconsultingllc.com with SECURITY in the subject. Tell us what you found and how to reproduce it. We will confirm we have it, and we will not argue with you about whether it counts.