Security and data protection

The basic principle

• The Print Agent only ever opens outbound HTTPS connections; the server never reaches the agent. No inbound firewall rules are needed.
• The local print data endpoint (port 9100) is bound firmly to 127.0.0.1 — other machines on the network cannot address it.
• Every device is bound to its sign-in through a device ID of its own; stolen tokens cannot be used on another device.

TLS certificate checking

The connection to the server is always TLS-encrypted (https:// is mandatory). Out of the box, however, certificate checking is disabled (IgnoreServerCertificateErrors = true, in the service as well as in the status bar app), because many on-premises installations work with self-signed certificates. The service logs a clear warning at start-up for as long as the check is off.

Recommendation: as soon as the Docuflair server uses a certificate from a trusted CA, enable the check —

• in the service: set PrintAgent:IgnoreServerCertificateErrors to false (through appsettings.Production.json or an environment variable, see the configuration reference),
• in the status bar app: clear the corresponding checkbox in the settings dialog.

With self-signed certificates, the cleaner alternative is to import the certificate into the operating system’s certificate store and enable the check as well. Certificate pinning is not currently supported.

Credentials and tokens

• Your password is not stored. With the Microsoft sign-in it never leaves the browser; with the password sign-in it is transmitted encrypted once and checked on the server only as a hash.
• The access tokens live in the operating system’s credential store: DPAPI (Windows), the keychain (macOS), the Secret Service / GNOME Keyring (Linux).
• If no credential store is available (Linux without a desktop or D-Bus, for instance), the agent falls back automatically to an unencrypted file that only the user concerned can read (mode 0600).
• Signing out deletes the local tokens.

Device blocking

If a device is lost or stolen, an administrator blocks it under Connectors → Mobile devices (see the rollout). The server refuses every call from the device from that moment on, and the agent makes no attempt to sign in again. The token lifetime (Mobile Access Token Lifetime Minutes) governs how quickly a block takes effect at the latest.

Proxy credentials

Credentials for an explicit HTTP proxy are stored in plain text — in tray-settings.json (set to mode 0600 automatically on Linux and macOS) or in the service’s appsettings.json and environment variables. Recommendations:

• Use a dedicated proxy account with minimal rights that may only reach the Docuflair server — not a personal AD account.
• On Linux and macOS, do not write a proxy password for the service into a world-readable appsettings.json; set it through a systemd drop-in with mode 0600 instead (Environment=DOCUFLAIR_PRINTAGENT__PROXYPASSWORD=… or EnvironmentFile=).

Local data retention

Data	Stored in	Retention
Print data until upload	The Payloads folder in the service’s data directory	Until Remove completed in the status bar app (which also deletes the copies)
The job queue	queue.db (SQLite)	Survives restarts; jobs count as finished only after an upload has been confirmed
Log files	See troubleshooting	Rolled daily, kept for 14 days

On the server side, an administrator sees the sign-in name, platform, agent version and last activity for each device; deleting the device entry ends all access (which makes device management the route for GDPR access and deletion requests).

Rights on the endpoint

• The service runs as LocalSystem on Windows, as a hardened systemd service on Linux (ProtectSystem=strict, NoNewPrivileges, write access only to the spool and log directories) and as a LaunchDaemon on macOS.
• The status bar app runs with normal user rights; the local connection between the app and the service is confined to the machine in question.