Your printers, your network, your data
PrintSentinel runs on your own PCs. Here is exactly what it stores, what it sends and how it protects both, so your IT and security teams can sign it off.
Found a security problem? Report a vulnerability
- On your network
- Always
- Printers, alerts and print history stay in a database on your server PC.
- HTTPS, pinned by the apps
- Always
- Every connection to your server is encrypted. Desktop clients and the Print Agent pin its certificate; browser users compare its fingerprint.
- Keys, not passwords
- Always
- Four kinds of access key, each enforced by the server and revocable at once.
- Signed updates
- Always
- A client PC installs an update only with the publisher’s Ed25519 signature.
- Document names
- Your choice
- Print tracking records them unless an operator switches that off.
Where your data lives
PrintSentinel is not a cloud service. Printer readings, alerts, statistics and print history are kept in a database on the PC that does the monitoring, with a backup every day. We never receive them.
| Data | Where it goes | Notes |
|---|---|---|
| Printer readings, alerts, statistics and print history | A database on the PC that does the monitoring | Backed up every day. We never receive them. |
| Licence check | printsentinel.app | Sends your account, the app version and a one-way hash that identifies the PC, nothing about your printers or people. |
| Update check | printsentinel.app | The app looks for updates. |
| Plans and prices | printsentinel.app | The monitoring PC reads the current prices when someone opens the page in the app. Nothing about your printers or people goes with it. |
| Email alerts | Your mail server | Straight from your server. |
| Teams alerts | Microsoft | Straight from your server. |
| Heartbeat, if you set one | The outside monitor you chose | A plain call every 5 minutes, only after a successful poll. Nothing about your printers goes with it. |
The app contacts printsentinel.app only to check your licence, to look for updates and to show the current prices.
Connections between PCs
Client PCs and browsers reach the server over HTTPS. Each server creates its own certificate.
A desktop client pins that certificate the first time it connects, after you have checked its fingerprint against the one the server shows, so nothing can sit in between later and a change of IP address doesn’t matter.
| Connection | Server certificate | How it works |
|---|---|---|
| Desktop client to server | Pinned | HTTPS. The client pins the certificate the first time it connects, after you have checked its fingerprint against the one the server shows. |
| Browser to server | Compared by the user | HTTPS. The browser shows a certificate warning the first time; the user compares the fingerprint with the server’s before continuing. |
| Print Agent to server | Pinned | Sends print events from each PC, using the print-reporting key. |
| Client update from server | Pinned | The installer is downloaded over the pinned connection and installed only with the publisher’s signature. See Updates. |
Never install the server’s certificate as a trusted root on your PCs. PrintSentinel doesn’t need it, and doing so would let that certificate vouch for other sites.
Who can do what
Access is by key, and every key is checked on the server, not in the app.
| Action | Operator | Helpdesk | Viewer | Print reporting |
|---|---|---|---|---|
| See dashboards and alerts | ||||
| Acknowledge, resolve and mute alerts | ||||
| Mark toner as sent | ||||
| Change printers, sites, settings and backups |
The operator key allows everything. The print-reporting key is used only by the Print Agent to send print events; it cannot sign in or read anything.
- Revoked at once
- Regenerating a key disconnects everyone using the old one immediately.
- Hidden from view
- Viewers and the helpdesk see notification addresses as hidden, and nobody can read a Teams webhook back once it is saved.
- Activity log
- Every change is written to an activity log with the caller’s name, the kind of key and the address.
Secrets at rest
SNMP community strings and v3 keys, the mail server password, Teams webhooks and the access keys are encrypted with Windows’ own data protection before they are stored.
In service mode they are re-encrypted with a key bound to that machine, so a copied database is no use on another PC.
| Running as | Protected by |
|---|---|
| Desktop app | Windows’ own data protection. |
| Windows service | Re-encrypted with a key bound to that machine, so a copied database is no use on another PC. |
Updates
You install a new version on the server; client PCs then update from it. Before installing, each client does three things, in this order.
Step 1:
Check the signature
The client checks the publisher’s Ed25519 signature, which covers the version, the file size and its SHA-256.
Step 2:
Download from your server
It downloads the installer over the pinned connection.
Step 3:
Check the file again
It checks the size and hash again, and only then installs.
- The signing key stays with us
- The signing key never leaves our build machine, so even someone in full control of your server could not hand your PCs an altered installer.
- Forward only
- Clients only ever move to a newer version, never back.
Print tracking and privacy
The Print Agent reads Windows’ own print log on each PC and sends it to your server, pinned to its certificate, using the print-reporting key.
- What it records
- Who printed, on which printer, from which PC, how many pages and when.
- Document names
- Recorded unless an operator switches that off in Settings, Print tracking. Switching it off erases stored names from the database; older backups keep them until they roll off.
- Your staff
- Tell your staff before you turn print tracking on, as your local law may require.
Reporting a vulnerability
If you believe you have found a security problem in PrintSentinel, please write to security@printsentinel.app.
- What to send
- The details and how to reproduce it.
- What we do
- We will reply within two working days and keep you informed until it is fixed.
- What we ask
- Please give us a reasonable time to release a fix before you publish anything.
Guides for setting this up
Step-by-step instructions for the controls described on this page.
- Several PCs and browsersConnect client PCs and browsers to one server, with operator, helpdesk and viewer keys.
- Network and firewallThe ports PrintSentinel uses between the server, the printers, client PCs and the internet.
- Service, backups and updatesDay-to-day running: the Windows service, daily backups, updating the server and client PCs, and watching PrintSentinel itself.
- Print trackingRoll out the PrintSentinel Print Agent with Group Policy to record who printed what, where and from which PC.
Need a security questionnaire filled in?
Send it over. We answer them for customers on every plan.