Secure printing
Secure printing, with less to patch and nothing left on the tray.
Secure printing usually means adding things: card readers, a hardened print server, another agent on every laptop. Commontray takes things away instead. No print server, no printer drivers on anyone’s laptop, no ports to open, and documents that are gone as soon as they’ve printed.
- Print server
- Drivers on laptops
- Inbound firewall ports
- Documents kept after printing
- Card readers and badges
- Guests on the printer network
A document’s short life
From upload to deleted, usually within minutes.
Commontray keeps a document only as long as it takes to print it, and never on a server you don’t control.
- UploadedChecked: size, a real PDF or image, not password protected, page count.
- QuotedThe person sees every page and the price.
- WaitingOnly with release, until they’re at the printer.
- PrintedSent straight to the printer and followed to the end.
- DeletedThe document is removed as soon as the job ends.
Print server security, solved by not having one.
Printer drivers run with high privileges, and print servers hand them out. That’s why the Windows print spooler has been a favorite way in for attackers, most famously with PrintNightmare in 2021, and why patching print servers is a job that never ends.
Commontray doesn’t use either:
- No drivers on laptops. People print from a web page. Nothing is installed on their device, so there’s nothing for an attacker to abuse there.
- No print server. Commontray sends jobs to printers itself, over IPP, the standard printers speak natively. It doesn’t go through the Windows print spooler, even when it runs on Windows.
- No inbound ports. Nothing connects in to Commontray from the internet. The optional secure web address works through an outbound tunnel.
More in our guide on how to replace your print server.
Printer network isolation, with one cable.
A printer on the shared network can be reached by every laptop on it: to print around your rules, or to probe its old firmware. With the Commontray Box, printers plug into its printer port instead.
- Printers on the port have no address on the shared network. Only the Box can reach them.
- Nothing from the shared network gets through to the port, and printers can’t reach the internet unless an admin allows it.
- If a network is plugged into the port by mistake, the Box turns the port off rather than hand out addresses to it.
Without the Box, release codes still stop people printing other people’s documents: see secure print release.
- AirPrint from laptops
- Windows printer search
- Raw jobs to port 9100
- Printer to the internet
The details
What protects people, documents and the admin page.
Only your own jobs
People see and release only their own documents. Secure release proves they are at the printer, not just on the network.
Sign-in limits
5 wrong passwords per account and 20 per address in 5 minutes. Only wrong passwords count, so nobody can lock the admins out.
Browser protections
HttpOnly, SameSite cookies, a check on every change, a strict content security policy, and no framing by other sites.
Office files, sandboxed
Converted with macros and external links switched off, a fresh profile each time, a fixed file name and a time limit.
Every admin change logged
Who changed what, by name, in the log. From the internet, only personal admin accounts can sign in.
Signed updates
Commontray only installs builds signed with the Commontray release key, newer than the one running, matching their published checksum.
Release codes you can renew
One click gives a printer a new code. Old stickers stop working at once.
Fair limits per person
One person can’t fill the disk: limits on previews, waiting and emailed documents, and nothing new is stored when space runs low.
Safe exports
The CSV escapes values that could turn into spreadsheet formulas when someone opens it.
Questions
Security questions
Where are documents kept, and for how long?
On the computer running Commontray at your site, or the Commontray Box, in a folder only Commontray’s own service account can read. A document is deleted as soon as its job ends. Documents waiting for release are deleted after the hold time (12 hours unless you change it), emailed ones after 24 hours.
Does Commontray keep people’s passwords?
No. Sign-in is checked by your membership platform, and Commontray keeps only who the person is, in a session whose cookie is stored as a hash. The optional shared admin password is stored only as a salted hash.
Do we need to open ports on our firewall?
No. Nothing connects in. Commontray makes outbound connections only: HTTPS to your account and for updates, and an outbound tunnel if you turn on the secure web address.
Is the traffic encrypted?
The secure web address is always HTTPS. On your local network the print page uses HTTP unless you give Commontray your own certificate, which takes one setting. Jobs go to printers over IPP, or over encrypted IPPS for printers added with an IPPS address.
Is any AI involved in printing or billing?
No. Printing, release and charging follow fixed rules you can read about on these pages.
Fewer moving parts. Fewer ways in.
Retire the print server and the drivers, and keep confidential pages off the tray. Free for your first printer.