Security and privacy

These are the questions you should ask about any application you are going to install on a production machine. The answers are written here without marketing language.

Where do my customers' files go?

File checking runs on your machine. When you check a PDF, the file is not uploaded to the cloud to be processed; reading, measuring and producing the report all happen on the same computer. The resulting report is created there too.

What that means in practice: your customer's unprinted artwork does not have to be copied to another company's server in order to be checked.

What leaves the machine?

A paired Edge Hub talks to the NowToPrint panel. What goes over that connection:

• the device identity and an "I am alive" signal,
• the application version and the machine name,
• the list of configured equipment and its status,
• update health,
• job status belonging to platform orders.

On an installation that has not been paired, none of the above is sent. The only thing that leaves the machine in that state is a periodic connectivity check — an empty request to the health address on nowtoprint.com to see whether the internet is reachable. It carries no file, job, customer or print shop information; it only looks at whether an answer comes back. No connection carrying job data is established until you approve the pairing.

Usage telemetry and crash reporting — how many files you checked, how long it took, why the application crashed if it did — are a separate, explicit opt-in. The consent state defaults to "not asked"; nothing is sent until you approve it. We then report "not measured" for that installation rather than producing an estimate.

The local API

Edge Hub has a local interface that your own software (your MIS, for example) can call. That interface:

• is off by default and does not run until you switch it on;
• requires an API key once enabled;
• requires an encrypted connection (TLS) if it is exposed to the local network — unencrypted use is not accepted.

What is shared when I send information for support?

When you send the Diagnostics → Support bundle → Download support bundle output for a problem, the bundle is cleaned as it is built. These come out as [REDACTED]: keys and credentials, the organization identifier, email and IP addresses, customer and organization names, operator user ids, local file paths and customer file names. The log section is limited to the last 200 lines.

Your PDF itself is not part of the support bundle — file content, thumbnails, document metadata and detailed preflight messages are stripped out; only an "is the engine running" level summary remains. If you want us to look at a file, you have to send it separately and deliberately.

The bundle is a plain file: you can open it and look inside before sending it. Please do.

How do I disconnect a device?

In the panel, under My print shop → Settings → Equipment, you can revoke a device's access or delete the record. Revoking invalidates the device credential; that device cannot connect again with the same identity. To reconnect, you pair it from scratch.

The pairing code is single-use, has an expiry, and is only valid for the print shop account that approves it. Another account cannot approve your code.

What has to be said honestly today

• Code signing for the installer package is still in progress. Because of that, Windows may show an "unknown publisher" warning on the first install. The correct way to get past it is in the setup guide; we also share the checksum so you can verify the package.
• We do not have an independent security audit report. We can share the output of our own gates, but there is no third-party audit document we can present today.
• This is a controlled pilot. There are items we must close before release: the signed install and update chain, an installation test on a clean machine, and field evidence on real devices. Until those are closed, we do not call it "ready for production".

Contract, data protection and processing

A contract pack is signed separately for pilot participation; it includes the data-protection notice, the data processing agreement and — if you enable telemetry — the explicit consent text. We prepare a one-page inventory per pilot showing which data is processed where. Ask for these documents before the installation, not after signature.

Engineering detail

For the technical breakdown of authorization boundaries, credential lifecycle and open release blockers: security controls (sign-in required).