Printing security
The platform authorizes a logical job. Its assigned bridge validates the locally permitted printer connection and sends bounded, rendered output. The customer controls the host and local network; Ennea controls the configured platform deployment. Commissioning needs both sides.
Network matrix
| Initiator | Destination | Connection | Purpose |
|---|---|---|---|
| Print Bridge | Configured Ennea API hostname | Outbound HTTPS, normally TCP 443 | Pairing, configuration, jobs and receipts. |
| Print Bridge | Locally approved printer IP | Configured TCP port, commonly 9100 | Raw ZPL/TSPL output and connection checks. |
| Administrator | Local setup tool | Local execution | Pairing and IT-managed connection policy. |
| Deployment management | Approved release source | Customer-controlled distribution | Installation and updates. List the actual release endpoints separately. |
The print service needs no inbound internet connection or public printer endpoint. DNS, time, certificate validation and enterprise proxy dependencies should be documented for the installed environment. Do not assume arbitrary TLS-intercepting proxies work; validate the release with the customer's trust setup without disabling certificate checks.
Raw TCP printing is not encrypted or printer-authenticated by this adapter. Restrict the printer VLAN and host/network rules so only approved hosts reach approved printer endpoints. TLS on the cloud connection does not encrypt this separate LAN hop. IPPS or vendor secure transports require their own implemented and tested adapter.
Identity and permissions
Pairing codes expire and are single-use. The runtime credential belongs to one bridge in one tenant/site/environment. Platform authorization and the live bridge state are checked on synchronization; revocation blocks further authorized work.
Use separate authorities for reading and managing Printers, reading and managing Print Bridges, and printing labels. Configuration and job actions are checked server-side. A bridge credential is not a general user login and does not grant machine control.
Automatic source reads require current permission for those records. Payload access and reprints recheck source authority and privacy eligibility. The bridge also reports attempts it still holds: the server can withdraw an individual attempt after a restriction, expiry or configuration change. The bridge stops future copies and aborts pending I/O when it receives that denial. Bytes already sent cannot be recalled.
Local policy
IT approves IP addresses or bounded CIDRs and explicit ports on the host. The platform cannot expand that policy. Printer configuration revisions prevent old jobs from silently using a changed endpoint. Only literal network addresses are accepted by the TCP adapter, avoiding hostname changes that bypass a destination decision.
Preserve the policy and journal under the installed service's protected data directory. Restrict administrative access and apply the organization's disk encryption, backup and endpoint-protection policy. A user with host administrator authority can change the software or its local policy; this is an explicit trust boundary.
Data boundary
The bridge receives the rendered label, copies, job/attempt identifiers and approved printer configuration. It does not need the complete order or customer record. Label contents can still contain personal or confidential information, depending on the template and bindings.
The local journal stores identifiers, a job fingerprint, outcomes, completed-copy counts and timestamps; it does not store rendered label contents. Acknowledged terminal records are pruned after 7 days during successful synchronization. Pending receipts remain until acknowledged to protect against duplicate output after an outage. Operational logs contain event names and times, without label contents or credentials.
Cloud jobs retain their rendered output and source snapshot for 90 days by default, then become eligible for the platform's managed expiry process. Legal holds and deletion approvals can delay removal; the timestamp is not an unconditional physical-deletion guarantee. Backups and exported evidence have separate access and deletion responsibilities.
Printing itself is deterministic software and does not require an AI model. If Konnie or an AI-powered workflow prepares the source data or triggers the action, evaluate that separate provider/data flow under the platform's approved AI configuration. Pairing a printer does not authorize another AI provider.
Recovery and support
Keep a durable receipt before reporting success. A repeated cloud acknowledgement must not repeat physical output. A recovered in-progress transmission becomes an uncertain outcome for operator reconciliation.
Support should use redacted diagnostics and explicitly authorized access. Do not place pairing codes, credentials or unredacted label output in tickets. Revoke lost hosts, reconcile outstanding jobs and replace the installation deliberately. See IT approval.