Security and data protection

• Printers: Address, vendor, model name, name, MAC address, serial number, properties, page counters, consumables data, and statistics.

• Computers: Address, host name, type (laptop, desktop, or server), system (Windows or macOS).

• Networks: Gateway IP and MAC addresses.

• Documents: Name, number of pages, color, 2-sided, and where and when it was submitted, printed, and deleted.

• Users:

  • Name (for passwords, see Authentication below)

  • Email

  • Role (user or system manager)

  • Department (Microsoft Entra ID only, and can be used to post process data for subsequent departmental billing)

  • Groups (only the group memberships relevant to Printix functionality are recorded)

Printix is hosted in the EU.

• Secure Microsoft Azure Data Center in the Netherlands [West Europe].

  • Configuration data and micro services:

    • https://api.printix.net

    • https://auth.printix.net

    • https://airprint.printix.net

    • wss://websocket.proxyendpoint.printix.net

• Secure Amazon Web Services Data Center in Ireland [AWS EU-West-1]. Content Delivery Network (CDN) is enabled.

  • Captions and graphics

    • https://assets.printix.net

  • Driver store

    • https://drivers.printix.net

  • Software packages

    • https://software.printix.net

  • Web servers for Printix Administrator and Printix App

    Example: acme.printix.net. Alias for:

    • https://app.printix.net

  • Web servers for signing in

    • https://sign-in.printix.net

• Documents are encrypted and stored until they expire and/or get deleted.

• Documents do not leave your network, unless you enable additional functionality or print through the cloud.

• Documents that go through your own Cloud storage are protected by time- and session-restricted credentials issued by Printix Cloud. The Printix Client does not store cloud storage credentials/keys.

• Advanced Encryption Standard (AES) with a key length of 256 bits is used to encrypt documents.

• All Printix communication inside and outside the network is secured with encryption and the use of HTTPS. TLS 1.2 is used.

• SNMP is used to collect information from printers. Both SNMPv1 and SNMPv3 are supported.

• Print data is sent unencrypted to the printer, but with secure IPPS, it can be sent encrypted to printers that support secure IPPS.

• Printing directly to the printer is just as secure as traditional network printing.

• With secure print (Print Later or Print Anywhere), you can wait until you arrive at the printer, then release the documents using your phone. That way, you prevent others from collecting your confidential and sensitive documents.

• With Printix Go, you can sign in at the printer with your card or ID code to release documents. Increase security with a 4-digit PIN code for two-factor authentication.

  • The message "PIN code disabled" appears after three consecutive, failed sign-in attempts. In this case, the user must open the Printix App, reset the PIN code, and enter a new and different value. Otherwise, the Printix App displays "The new PIN code must be different from the previous one".

• Documents scanned with Printix Capture are encrypted while they are transferred to and from the Printix Client over HTTPS and also while they are stored.

• Optical Character Recognition (OCR) and conversion to searchable PDF or Microsoft Word file happens in the Printix Cloud.

• If an own cloud storage is used, captured documents are sent through your cloud storage. After processing (OCR) in the Printix Cloud, the document is written to your cloud storage, and from there, it is read by the Printix Cloud destination service and delivered to the destination. Capture with mobile requires that you set up Azure Blob Storage for CORS (Cross-origin Resource Sharing).

• Captured documents are automatically deleted from cloud storage after 7 days (168 hours).

• The user interface of the Printix Client (PrintixClient.exe) runs under the signed in user's account.

• Printix Service (PrintixService.exe) runs under the local system account and handles the printing and the printer installation.

• Both applications write log files.

• The Printix Client silently updates itself to the latest approved version.

• Documents scanned with Printix Capture are encrypted while they are transferred to and from the Printix Client over HTTPS and also while they are stored.

• Printix uses roles to control what functions a user can perform.

• Users are notified by email when their role is changed.

• Users are required to register and sign in to use Printix.

• With Microsoft Entra authentication enabled, users' passwords are handled entirely by Microsoft Entra ID.

  • Printix reads the users' basic profile (displayed name and email address).

• With Google authentication enabled, users' passwords are handled entirely by Google.

  • Printix reads the users' basic profile (displayed name and email address).

• With OIDC authentication enabled, users' passwords are handled entirely by OIDC.

  • Printix reads the users' basic profile (displayed name and email address).

• With Okta authentication enabled, users' passwords are handled entirely by Okta.

  • Printix reads the users' basic profile (displayed name and email address).

• With OneLogin authentication enabled, users' passwords are handled entirely by OneLogin.

  • Printix reads the users' basic profile (displayed name and email address).

• With Active Directory authentication enabled, users' passwords are not stored by Printix, but can be transferred securely with LDAPS to the local Active Directory server for authentication.

• For users who authenticate directly with Printix, passwords are protected through salted password hashing. Users can reset their passwords for themselves if they have an email address. Passwords must be minimum 6 characters in length and contain uppercase letters, lowercase letters, and digits.

• When signing in at the printer is involved (with card or ID code), the registered card numbers and PIN codes are protected through salted hashing. ID codes are written as plain text.