How OpenFn supports the UN's DPI Safeguards Framework

Governments around the world are increasingly building Digital Public Infrastructure (DPI), the shared digital systems that deliver services to citizens through tools such as digital IDs, digital payments, and civil registries. In September 2024, the United Nations (UN) released its Universal DPI Safeguards Framework, a set of 18 principles designed to guide governments in deploying DPI that is safe, inclusive, and accountable. The framework was built from existing implementations and structured around a straightforward goal: ensure that DPI advances the UN's Sustainable Development Goals without creating new risks for individuals or societies.

OpenFn is a verified Digital Public Good (DPG), meaning not only do we sustain the product as open source, but also commit to "Do No Harm" by design. This UNDP Framework gives us a practical way to keep putting that commitment into practice.

This article considers the 18 Safeguarding Principles and outlines how OpenFn's design and deployment model engages with each one in practice.

The 9 foundational principles

F1. Do no harm

"A human rights-based framework should be integrated throughout the DPI life cycle to anticipate, assess, and effectively mitigate any potential human rights harms and power differentials." p.23

OpenFn brings obfuscated, bespoke software integration code out into the open. Public services built and maintained using OpenFn are visible, tangible workflows that can be audited and observed. That means that the people and policies in positions of power, making decisions that impact people’s lives, can be held to account. Moreover, OpenFn can be configured to process data transiently without retaining personal information. Finally, by being fully open source, the entire integration layer is available for inspection and audit at any time, without dependence on any individual vendor. Anticipating and mitigating the harms themselves remains work for the deploying government and its partners; what OpenFn adds is the visibility to see and act on them.

F2. Do not discriminate

"All individuals, regardless of intersecting identities, should have unbiased access and equal opportunity." p.23

OpenFn moves data through the same configured logic for every transaction, regardless of who the data subject is. Where governments encode eligibility or routing rules into a Workflow, OpenFn applies them consistently and makes them inspectable, which reduces the discretionary, manual handling where inconsistent treatment can arise. OpenFn does not itself decide who is eligible for a service or on what basis; that remains a policy decision for the deploying government. What the integration layer contributes is that whatever rules the government sets are applied uniformly and can be audited for disparate impact.

F3. Do not exclude

"All individuals should have a choice of channels (digital/non-digital) to access and benefit from services enabled by DPI." p.23

As a software tool, OpenFn by its nature caters to digital channels. The choice of channels people use to reach a service, and the duty to keep that access from becoming conditional or mandatory, rests with the deploying institution, not the integration layer. Automating ‘back-office’ operations for civil servants frees up time for them to support citizens with non-digital services as required.

F4. Reinforce transparency and accountability

"DPI should be developed with democratic participation, have public oversight, promote fair market competition, and avoid vendor lock-in." p.23

Every workflow run in OpenFn generates a full, inspectable audit trail: what data moved, when, between which systems, and with what outcome. All of that is represented with an easy to interpret UI for easy and accessible interpretation. The platform is open source (Apache-2.0 license), so governments are never locked into an individual commercial vendor, though they may choose to work with one (such as Open Function Group) to maximise value out of their OpenFn deployment. Workflow logic belongs entirely to the deploying institution. Open Function Group’s co-implementation model means government technical teams build and own the integrations themselves, rather than receiving them as a black box. The OpenFn DPG facilitates this.

F5. Uphold the rule of law

"DPI should be introduced with a clear legal basis, with required legal and regulatory aspects embedded into its design." p.23

Workflows in government are, invariably, ways of implementing policy. OpenFn helps to build, maintain, monitor and modify those workflows to ‘codify’ the social policies of the nation. Flexible deployment options, whether cloud, hybrid, or fully local, allow governments to align deployment architecture with their specific legal and regulatory requirements. OpenFn itself does not determine data governance rules; it is designed to operate within whatever rules the deploying government establishes.

F6. Promote autonomy and agency

"Ensure that everyone can take control of their data, promote their agency, exercise choice, and contribute to their society's well-being." p.23

What OpenFn contributes is the technical foundation data subject rights depend on: data minimization means only the fields required for a given exchange are moved; transient processing means personal data is not retained by default; and complete run logs make it possible for the responsible institution to trace and account for how an individual's data was handled. OpenFn workflows provide a tangible, observable representation of every citizen-facing service, as implemented by service providers. Making service delivery processes observable creates a foundation for accountability: oversight bodies, program managers, and civil society can challenge and improve how services reach people. OpenFn makes it easier for governments to operationalize the rights they grant citizens; the rights themselves remain a government responsibility.

F7. Foster community engagement

"All stages of the DPI life cycle should centre on the needs and interests of individuals and communities at risk." p.23

OpenFn supports community engagement by making service delivery observable: because each workflow is a visible, inspectable representation of how a service actually reaches people, program managers, oversight bodies, and community representatives have concrete evidence to review and challenge, rather than a black box. Many of the systems OpenFn integrates with, social protection registries, civil registration, health information systems, are themselves built to serve vulnerable populations; the integration layer strengthens their reach without substituting for direct engagement with the communities they serve.

F8. Ensure effective remedy and redress

"Complaint response and redress mechanisms should be accessible to all in a transparent and equitable manner." p.23

OpenFn's detailed run logs and error notifications mean that when a workflow fails or is routed down a particular decision path, it is immediately visible and traceable. This gives the institutions responsible for handling complaints the evidence they need to investigate a case, establish what happened, and correct it, and it lets them demonstrate to auditors exactly how any given transaction was processed. In this way, the technology strengthens the transparency and accountability on which effective redress depends, supporting the mechanisms that institutions make available to citizens.

F9. Focus on future sustainability

"Inculcating foresight is key to anticipating and limiting long-term and inter-generational harms." p.24

Anticipating long-term and inter-generational harms is fundamentally a governance and foresight responsibility that sits with governments and their partners. OpenFn's contribution is evidentiary: because every workflow run is logged and inspectable, implementing teams accumulate a continuous record that can surface emerging patterns, errors, or unintended consequences over time, giving oversight bodies the evidence base that foresight depends on. Being open source, the integration layer is also available for independent scrutiny rather than depending on a single vendor's assessment. And because OpenFn is a DPG, governments are protected from the vendor-dependency and extractive pricing risks that can compromise a system's viability over the long term; the codebase can be forked, maintained, or extended by the government itself if its relationship with the Implementing Entity changes.

The 9 operational principles

O1. Leverage market dynamics

"DPI should foster an increasingly inclusive environment for public and private innovation."p.24

The OpenFn product is used by governments, NGOs and private sector users around the world, with a blended commercial model to meet clients where they are. The platform is specifically designed to make it easy for ecosystem managers to add, remove or change public and private sector software systems across their tech estate, including AI providers.

O2. Evolve with evidence

"Independent, transparent, and continuous assessments should review evidence and rapidly cease or initiate activities that contain heightened risks or harms." p.24

Every workflow run is logged and inspectable. Implementing teams can analyze run histories to identify patterns, errors, and unintended consequences. OpenFn's open-source development process means security vulnerabilities are identifiable and patchable by the community, not only by OpenFn staff. As a core team, we host monthly security stand-ups to learn from and improve our security posture.

O3. Ensure data privacy by design

"DPI should embed legal, regulatory, and technical principles that enforce core privacy principles." p.24

OpenFn applies data minimization by design: workflows are configured to pass only the specific data fields required for each exchange. The platform does not permanently store personal data; information moves through in transit and is not retained in OpenFn's systems. Field-level transformations allow implementing teams to strip or mask sensitive attributes before data reaches a destination system. On-premise deployment ensures data residency requirements are met.

O4. Assure data security by design

"DPI should incorporate and continually upgrade security measures, such as encryption or pseudonymization." p.24

OpenFn supports OAuth 2.0, API key authentication, and other current security standards for connecting to destination systems. All data in transit is encrypted. The platform's credential management system ensures that access keys are stored securely and never exposed in workflow logs. On-premise deployment eliminates exposure of data to third-party cloud infrastructure. The platform is subjected to annual security audits to identify and patch vulnerabilities.

O5. Ensure data protection during use

"Personal data should be processed or retained lawfully and transparently only by authorized personnel within a legal framework including transaction history, data subject rights and protections against overreaching requests." p.25

OpenFn processes data transiently: information passes through the workflow engine in temporary memory and is not written to a persistent database by default. All access to workflow configurations and run logs is role-controlled. Every operation is logged, creating a complete record of who configured what, when, and what data was processed. We have flexible deployment options to adhere to data sovereignty requirements.

O6. Respond to gender, ability, or age

"DPI implementation should not exacerbate existing challenges or introduce new barriers and inequalities." p.25

Automating data exchange between government systems reduces the bureaucratic friction that falls disproportionately on caregivers, low-income families, and rural populations, those who bear the highest cost of manual, in-person processes. When eligibility verification that previously required multiple office visits is automated, it is often the most vulnerable populations who benefit most. OpenFn's ability to integrate with SMS and USSD systems extends these benefits to populations without smartphone access.

O7. Practice inclusive governance

"Long-term effectiveness of DPI is contingent upon the establishment of a robust legal, regulatory, and institutional framework." p.25

Open Function Group’s co-implementation model builds technical capacity within government teams, distributing governance of the integration layer rather than concentrating it in an external vendor. Governments that own their workflow logic can modify governance rules, specifying which data flows, between which systems, and under what conditions, without requiring the involvement of extractive commercial entitites. We are reviewing our governance model for the DPG itself, working to embed our core principles—transparency, local ownership, and public accountability—into the structures that guide how OpenFn is maintained and developed. The broader legal and institutional framework that governs a DPI, and the multi-stakeholder participation around it, is set by the deploying institution and its partners; OpenFn as a DPG ensures the integration layer within it owned and steerable by government teams.

O8. Sustain financial viability

"Diversified, phased, and sustainable financing models should be established." p.25

The OpenFn DPG is subsidised by revenues from Open Function Group implementation projects, as well as those from implementation partners. Increasingly, we are also creating recurring revenue relationships with customers to support feature development of the core DPG, aside from once off implementation projects. We remain reliant on critical growth capital from philanthropists subsidising product development and deployments in low income settings.

"DPI should share and reuse open protocols, specifications, digital public goods, and the associated knowledge." p.25

OpenFn is a verified DPG, available under an open-source license. Our Adaptor library, with pre-built adaptors to health information systems, civil registration platforms, social protection systems, payment platforms, and more, is publicly available and reusable across countries. Implementations built in one country contribute knowledge and tooling that benefit others facing similar integration challenges. OpenFn is built on open standards (REST, OAuth 2.0) and facilitates the adoption of key data standards in different sectors, such as FHIR, DCI, and Beckn Protocol. It is also designed to be compatible with GovStack building block specifications.

A note on the limits of a middleware tool

As a DPG Steward, our role is to design technology that embeds safeguard principles. But implementation, governance, and sustainability remain the responsibility of governments, system integrators, and other technical partners.

The same is true for OpenFn. We can design workflow automation that minimizes data collection, logs every transaction, supports on-premise deployment, and transfers technical ownership to local teams. Whether those capabilities are activated, and how they are governed, is ultimately a government decision. Our role is to make the right choices easy and the wrong ones harder.

We believe workflow automation is an underappreciated layer in the DPI safeguards conversation. When data must move between systems to deliver services, how it moves matters enormously for privacy, accountability, and inclusion. We're glad the Framework is creating a shared language for these questions, and we look forward to continuing to play our part in that conversation.

Want to see how OpenFn supports responsible, accountable data integration in your context?

Read the Universal DPI Safeguards Framework or to discuss your implementation.

Disclosure: This article was developed with the assistance of AI to improve organization and content development.