Security at PrinterVision
Your printers sit on your production floor. This is how we keep the service that manages them, and your data in it, safe.
Hosted in the EU
PrinterVision and its sign-in service run on Microsoft Azure in the West Europe region, in the Netherlands. The applications, the databases and their backups stay in that region. There is no printer vendor's cloud or gateway in between: printers and collectors talk to PrinterVision directly.
Customers kept apart in the database
Every row of customer data carries its customer, and the database itself enforces row-level security on every customer table: a connection sees only the rows of the one customer it works for, and a connection that names no customer sees nothing. The application connects with a login of its own that can read and write rows but cannot change tables, switch these rules off or bypass them, and that login has no password: it is the application's Azure identity. Work that spans customers (the operators' console, invoicing, sign-in events from the sign-in service) runs only in explicitly named scopes, each logged. A test in every build fails when a customer table lacks these rules.
Sign-in runs as a separate application with its own database and its own encryption keys, so passwords and second steps are never in PrinterVision's database.
Azure Database for PostgreSQL encrypts the data and its backups at rest. Backups are kept for 35 days, in the same region, so a database can be restored to any moment in that period.
Encrypted in transit
- The website and the application are only served over HTTPS (TLS).
- Zebra printers connect over WebLink with mutual TLS (TLS 1.2 or 1.3): PrinterVision presents its certificate, and each printer must present a client certificate before it is accepted.
- The collector, for Honeywell, SATO and other makes, only makes outbound HTTPS connections to PrinterVision: no inbound port is opened on your network. A collector is enrolled with a one-time code.
Signing in
People sign in with a PrinterVision account or with their company's Microsoft account (Microsoft Entra ID).
- A PrinterVision account needs a password of at least 12 characters and a second step every time: a code by e-mail, an authenticator app or a passkey. A passkey alone is also a full sign-in. Passwords are stored only as a salted, slow hash (BCrypt).
- Too many wrong passwords or codes lock the account for a while. Every sign-in, failure and lock is recorded on the account.
- With Microsoft, your own policies apply: multi-factor authentication, conditional access and disabling an account when someone leaves work as they do for your other Microsoft applications. We never see the Microsoft password.
- Your administrators choose how people of your company may sign in: PrinterVision accounts or Microsoft, Microsoft only (from your own linked directory), or PrinterVision accounts only, and whether a strong second step (passkey, authenticator app or Microsoft with multi-factor) is required.
- A session in PrinterVision ends after an hour without activity, and after 12 hours in any case. Signing out, or being removed by an administrator, ends it within a minute.
Control over who does what
- Roles with their own permissions, which can be limited to sites, so each team only sees and changes its own printers.
- New printers wait for approval before they are managed.
- Every change, and every sign-in with the address it came from, is written to the operation log of your environment.
Support access is visible to you
CaptureTech support only opens a customer's environment to help that customer, or when running the service needs it, for example during an incident, and always has to give a reason. A support person signs in with their own CaptureTech Microsoft account and works under their own name, marked "CaptureTech support", never as one of your users. Opening your environment is written to your operation log, so you can always see who was there and what they changed.
What we are still working on
We prefer to be open about it: the installer of the collector is not code-signed yet, so Windows may warn when you run it. Download it only from your own PrinterVision environment.
Reporting a vulnerability
If you believe you have found a security problem in PrinterVision or printer.vision, please mail security@capturetech.com. Our contact details for security reports are also in /.well-known/security.txt.
- Describe what you found and how to reproduce it; English or Dutch is fine.
- Give us reasonable time to fix it before you disclose it publicly.
- Do not access, change or delete other people's data, and do not disrupt the service (no denial of service, no spam, no social engineering).
- Never test against printers or networks that are not yours.
We confirm receipt within 3 business days and give a first assessment within 10 business days. We keep you informed, and do not take legal action against anyone who reports in good faith and follows these rules.
Security questions IT asks us.
Where is PrinterVision hosted?
On Microsoft Azure in the West Europe region, in the Netherlands. The applications, the databases and their backups stay in the EU.
Is our data separated from other customers' data?
Yes. The database itself only shows a connection the rows of the one customer it works for, on every customer table; the application's login cannot switch that off. Work across customers, such as invoicing, runs only in named, logged scopes.
Can we sign in with our Microsoft accounts?
Yes, or with PrinterVision accounts, or both. Your administrators can require Microsoft from your own directory, so your multi-factor and conditional access policies apply.
Do we need to open ports on our network?
No. Zebra printers connect out to PrinterVision over WebLink, and the collector for the other makes only makes outbound HTTPS connections.
Can CaptureTech see our printers?
Only CaptureTech support, when they work in your environment to help you. They do so under their own name, and it is written in your operation log.