Security
We built RocketPrint around one rule: nobody should have to expose a printer, open a port, or run a VPN just so a cloud app can print. Everything below is how it works today.
How the connection works
This is the most important thing about how RocketPrint works, and it is not a setting you can turn off.
RocketPrint Station opens an encrypted connection to us and keeps it open. Jobs travel down that connection. Nothing on the internet ever starts a connection toward your network.
Printer names and status, which computer it is, how each job turned out, and the content of the jobs you print through us. Nothing else on the computer is read or sent.
What you print travels the other way — from your code, through us, to the computer. The Station app never uploads documents to us.
Authentication
Your code and your computers are authorized in completely different ways, because a leaked API key and a compromised pack-bench computer cause different amounts of damage.
Keys start with rp_live_, belong to one account, and are sent in an X-API-Key header over an encrypted connection.
No password is ever typed into Station. A computer is authorized through your browser: Station shows a confirmation code, you approve it on the provider page after signing in there, and you check the two codes match.
rp_live_ keys stay in your own infrastructureA computer only ever receives jobs for printers it reported, on the account it was approved for.
Keeping accounts separate
This is enforced in the database, not in the interface, and we have tests that prove it.
An account owns its people, API keys, computers, printers, and jobs. Every lookup is limited to one account, and asking for something in another account returns "not found" — we do not even confirm it exists.
Each API key is limited to 300 requests a minute, plus a short burst of 30 on top. Go over and you get a 429 with a Retry-After header — we never silently drop the request.
We check what you send against a list of accepted formats and cap its size. Fetching content from a URL is switched off by default, so a computer in your building will not request an arbitrary address unless someone deliberately turns that on.
Every connection is encrypted: your code to the API, your browser to the API, and each computer to us. There is no unencrypted path.
Print content
What you print is the most sensitive data you send us — a shipping label carries someone's name and address. Here is exactly how we handle it, including where we are not yet where we want to be.
We save the content with the job so we can still send it — including to a computer that is offline right now and reconnects later. Without that, queueing could not work.
We never include the content in an API response. Looking up a job gives you its status, timestamps, and failure reason — never the label itself. Your account cannot display it either.
Jobs belong to one account, like everything else. A request using another account's key returns "not found" instead of data.
We keep what you printed for 7 days after the job finishes, then delete it. Once a job is completed, failed, or canceled, the content is removed automatically a week later. The job record stays: status, timestamps, failure reason, and usage all remain. Only the content goes.
Seven days is long enough for support to look at what actually printed within a normal working week, and short enough that we are not holding customer addresses forever for no reason. If your policy needs it shorter, tell us — we can change it.
None of this exists yet. It is what we are building, listed separately so nothing above has to be read twice to work out whether it is real.
The download catalog only offers signed installers. Windows signing approval and Linux distribution remain release gates. See the download page for current platform availability.
A searchable record of keys created and revoked, computers connected, and settings changed.
Sign in with your company's identity provider, and more roles than owner, admin, and operator.
A published data processing agreement, a list of the services we rely on, and a stated uptime target. If you need these to evaluate us, get in touch and we will tell you honestly where they stand.
Questions
No. RocketPrint Station opens an encrypted connection to us and keeps it open. Nothing connects in: no port forwarding, no VPN, no fixed IP address. If your firewall allows normal outgoing HTTPS, the app works.
No. Authorizing a computer happens in your browser, on your identity provider's page. Station shows a short confirmation code, you check it matches the one on the approval page, and the computer then holds a credential bound to a key it generated itself. The private key never leaves that machine, so even a copy of the credential is not enough to impersonate it — and a compromised pack-bench computer never yields a password or an API key, because neither is stored there.
It lists the printers that computer can see and reports their names and status, and it prints the jobs you send it. It does not read your files, capture the screen, or give anyone remote access to the computer.
No. Every printer, computer, job, and key belongs to one account, and every lookup is limited to the account the credential belongs to. We have automated tests that check a request for another account's data returns 'not found' instead of the data.
Seven days after the job finishes. We have to store it so a job for an offline computer can still print when that computer comes back. Once the job is done that reason is gone, so we delete the content automatically. The job record stays, so your history and usage are unaffected. We never return the content through the API or show it in your account.
Revoke it and it stops working immediately. We only store a scrambled version of each key, so even a leak of our database would not give anyone a working key. It also means we cannot show you a key again after you create it — you are the only one who ever has it.
Not yet. We are still getting the signing certificates. Until then your computer will warn you the first time you open the app. We would rather tell you here than have it surprise you during a rollout.
Reporting a vulnerability
Email security@rocketprint.io with steps to reproduce it. We will confirm we got it, keep you posted while we fix it, and credit you if you want the credit.