Which device is with whom, in what state?

Custofaber IT brings device inventory, asset assignment and the help desk together in one record. The Lapis agent collects hardware, software and security settings from your computers on its own. All of it runs on your organisation's own server.

Request a demo See a device record

One device, one record. Lapis fills in the hardware and settings. Assignment and support history attach to the same record, and every change goes into a tamper-proof log.

PC-114

Accounting Department · Windows 11 Pro 23H2

Lapis · last report 09:42

Hardware

Model: Lenovo ThinkCentre M70q
Processor: Intel Core i5-12400T
Memory: 16 GB
Serial no: MJ0F3K9Q
Asset tag: 253.02.01-0114
IP: 10.0.4.114
MAC: 3C:52:82:1A:7E:04

Security settings

BitLocker: On
Firewall: 3 profiles on
Microsoft Defender: Signatures current
Automatic updates: On
Local administrators: 3 members
SMBv1: On
USB storage: Unknown

Assignment

Assigned to: A. Yılmaz
Handed over: 14 Mar 2026
Warranty ends: Feb 2028

Support history

#318Cannot connect to printer · resolved, 3 h

Change history from the audit log

16 Oct7-Zip 24.08 installed #a41f09c2
2 OctMemory 8 → 16 GB #5d03e7b1
14 MarAssigned to A. Yılmaz #c9e2a114

Chain verified

Representative screen. Sample data.

Four jobs, one record.

Inventory, assignment, help desk and users share the same data. Open a device and you see all of it together.

Devices and software

An inventory that keeps itself current from Lapis reports. No spreadsheet goes stale, because nobody keeps one by hand.

Problem devices first. An unsupported operating system or a device that has not reported for more than 7 days rises to the top of the list.
Where is a program installed? On which devices and in which version, in one search.
Changes are logged. Software installs, removals and hardware changes are written to the device history.
Assign department, user and criticality level; search by name, user or IP.

Fixed assets and assignment

Everything about each asset, from its asset tag to its warranty end date, and who has it. The assignment form prints with signature fields.

Asset Assignment Form

Asset tag: 253.02.01-0114
Asset: Lenovo ThinkCentre M70q
Serial no: MJ0F3K9Q
Received by: A. Yılmaz, Accounting Department

Handed over by

Received by

Assign, transfer and return. History is never deleted; you can always see who passed an asset to whom.
Staff see their own assets. Each person sees what is assigned to them on their "My account" page.
Asset tag (unique in the organisation), serial number, supplier, purchase and warranty end dates.
Assets still assigned to someone who has left show up as a warning in Guard Comply, if you use it.

Help desk

Staff open tickets and see only their own. The IT team assigns, resolves and tracks the clock.

Target resolution time by priority
Urgent	4 hours
High	8 hours
Normal	24 hours
Low	72 hours

Views for the IT team: open, assigned to me, unassigned, overdue.
Tickets link to devices, so a device record shows its support history.
Internal notes for the IT team, reopening when the requester replies, satisfaction rating.
Summaries of first response and resolution times and satisfaction. Notifications go out by email.

Users and Active Directory

Staff sign in with their organisation password and get their role from their AD group. Someone removed from the directory is deactivated in Custofaber too, and their open sessions are closed.

Built-in roles: administrator, IT technician, compliance officer, auditor and staff.
Nested departments: e.g. Support Services > IT Department.
Without AD, local users: strong password hashing, a 15-minute lock after 5 failed attempts.
Every sign-in, successful or not, goes into the audit log.

Lapis only reads.

A small agent installed on each computer and server. It changes nothing on the device and takes no remote commands; it reports what it finds to your own server over an encrypted connection only. It runs on Windows and Linux.

What it collects

Hardware: manufacturer, model, processor, memory
Serial number (SMBIOS)
Operating system and version
Network: interfaces, MAC, IP
Installed software
Disk encryption: BitLocker, LUKS
Firewall profiles
Malware protection status
Local administrators
UAC, SMBv1, USB storage, remote desktop, automatic updates
Pending restart, last boot
Windows security events (if you use Guard Vigil)

What it never collects

User files
Browser history
Passwords
Personal data

A setting it cannot read is "unknown". An empty value is never counted as "off"; it is shown separately.

No external dependencies

Written in Go using only the standard library, which keeps supply-chain risk to a minimum for an agent installed on every device.

Encrypted connections only

http addresses are refused and certificate checks cannot be turned off. Your own certificate authority can be configured.

A revoked agent stops

If the platform rejects its key, Lapis does not keep trying; it shuts down. The agent key is kept in a file only administrators can read.

The same data becomes evidence in Guard.

If you also use Custofaber Guard, the settings Lapis reports are linked in Guard Comply as automatic evidence for the Turkish Information and Communication Security Guide's controls. Windows security events flow to Vigil. There is no second agent to install.

Explore Custofaber Guard

Setting and Guide control (examples)
Reported by Lapis	Control
Disk encryption	3.3.2.4
Local firewall	3.1.6.11
Malware protection	3.1.5.1
Local administrator accounts	5.1.3.4
SMBv1	5.1.3.3

Windows events sent to Vigil (examples)
Event	ID
Failed sign-in	4625
Account lockout	4740
Event log cleared	1102

On your own server, in three steps.

We set it up together with you. It works on networks with no internet access; every file, fonts included, ships with the product.

Install on your server

One command: HTTPS, a database role with only the rights it needs, daily backup and restore.
./kurulum.sh --alan custofaber.kurum.local
Connect Active Directory

Staff are imported from the directory and roles are mapped to AD groups. Without AD, skip this step.
CUSTOFABER_LDAP_URL=ldaps://dc01.kurum.local
Roll out Lapis

Create a time-limited enrolment key and install the agent on your devices. The inventory starts filling with the first report.
lapis enroll --server https://custofaber.kurum.local --token …

It stays inside your organisation.

Data never leaves.
The platform, the database and Lapis reports stay on your organisation's server. No component connects to an outside service.
Every change is logged.
Every write goes into a tamper-proof audit log. Each entry carries the hash of the one before; if the chain breaks, you see exactly where.
Access by role.
Staff see only their own tickets and assets; the IT team, compliance officer and auditor see what their work requires.

Common questions.

Does Lapis collect personal data?

No. It collects hardware, software and security settings. User files, browser history and passwords are never collected.

Does it need an internet connection?

No. The platform and Lapis talk inside your network; no component connects to an outside service.

Is Active Directory required?

No. It also works with local users. With AD, staff sign in with their organisation password and roles come from AD groups.

Are Linux servers supported?

Yes. On Linux, Lapis collects hardware, packages and security settings too. Security logs from Linux servers reach Guard Vigil over syslog.

Do we also need Custofaber Guard?

No. Custofaber IT is installed on its own. If you add Guard later, it uses the same data and the same Lapis agent.

See it with your own devices.

Tell us your organisation and roughly how many devices you have, and we will plan a demo at a time that suits you.

oguz.kaya@custofaber.com

This form sends nothing to a server. Your answers become an email draft that opens in your own mail app, so you see it before you send it.