Security
RocketPrint was designed around one constraint: nobody should have to expose a printer, open a port, or run a VPN so that a cloud application can print. Everything below describes how the system works today.
Network posture
This is the single most important property of the system, and it is structural rather than configurable.
The agent opens a TLS WebSocket connection to RocketPrint and holds it open with keepalives. Jobs travel down that existing connection. Nothing initiates a connection toward your network from the internet.
Printer names and status, station identity, job outcomes, and the content of jobs you print through us. Nothing else on the machine is read or transmitted.
Print content flows the other direction — from your backend, through RocketPrint, to the station. The station does not upload documents to us.
Authentication
Applications and agents authenticate differently, because they are different kinds of principal with different blast radii.
Keys are prefixed rp_live_, scoped to one organization, and passed in an X-API-Key header over TLS.
An agent signs in with a user account and receives a token it presents when it opens its connection. Authentication happens at the connection upgrade, before any job is routed.
A station only ever receives jobs addressed to printers it registered, on behalf of the organization it signed in to.
Isolation and abuse controls
Multi-tenancy is enforced in the data layer rather than in the UI, and it is covered by tests rather than by convention.
Organizations own users, API keys, stations, printers, and jobs. Every query is scoped by organization, and a request for a resource belonging to another organization returns not-found rather than leaking its existence.
Public API requests are rate limited per key — 300 requests per minute with a burst allowance of 30. Exceeding it returns 429 with a Retry-After header rather than dropping the request silently.
Content types are checked against an allow-list, payloads are size-capped, and URI-based content fetching is disabled by default — a station will not fetch an arbitrary URL on your network unless an operator explicitly enables it.
TLS on every connection: your backend to the API, the console to the API, and the agent to the dispatch hub. There is no unencrypted path.
These are commitments, not current capabilities. They are listed separately so nothing on this page has to be read twice to work out whether it exists.
Code-signing and notarization identities are being obtained. Until then the agent installers are unsigned and your operating system will warn on first launch. See the download page for exactly what you will see.
A queryable record of key issuance and revocation, station enrollment, and configuration changes.
SAML/OIDC sign-in and finer roles than owner, admin, and operator.
A published DPA, a subprocessor list, and a stated availability target. If you need these to evaluate us, get in touch and we will tell you honestly where they stand.
Questions
No. The agent makes an outbound TLS connection to RocketPrint and keeps it open. There is no inbound connection, no port forward, no VPN, and no static IP requirement. If your firewall allows outbound HTTPS, the agent works.
It enumerates the printers the operating system exposes and reports their names and status. It prints the jobs your organization sends it. It does not browse the filesystem, capture screens, or provide remote access to the machine.
No. Every printer, station, job, and key belongs to an organization, and every query is scoped to the organization on the credential. Cross-organization access is covered by automated tests that assert a request for another org's resource returns not-found rather than data.
Revoke it in the console and it stops working immediately. Keys are stored only as SHA-256 hashes, so a leak of our database does not yield usable keys, and we cannot show you a key again after creation — only you ever hold the plaintext.
Not yet. Signing identities are being obtained. Until they are in place, installers are unsigned and your operating system will warn you on first launch. We would rather say so here than have you discover it during a rollout.
Reporting a vulnerability
Email security@rocketprint.io with steps to reproduce. We will confirm receipt, keep you updated while we fix it, and credit you if you want the credit.