Who can start your printers, and what our cloud can see.
SpoolSwift starts real printers in working businesses. This page lists the controls that stop the wrong person, or a bug of ours, from starting one, and says plainly where each protection ends.
The cloud plans the work, and the bridge at your farm has the final say.
Every command is checked by the bridge on your farm PC, against the printer itself, before anything moves.
The bridge
- Talks to your printers on your own network
- Keeps printer access codes, encrypted on the PC
- Refuses a start on a plate nobody has cleared
- Starts by itself only on printers armed at the farm with a local PIN
- Checks camera frames for failures on the PC, not in our cloud
- Keeps tracking every printer when the internet drops
SpoolSwift
- The website and the phone views your team uses
- The queue, the library, orders and the audit log
- Signs every command it sends to a bridge
- Can disarm a printer for automatic start, and can never arm one
- Never opens a connection into your farm
Nothing at your farm is open to the internet. The bridge opens every connection, out on port 443.
What our cloud holds, and what it never sees.
Our cloud holds
- Printer status, as your bridge reports it
- Your jobs, files, queue and print history
- Orders from the shops you connect, as an order number, line items and SKUs, with no buyer address or phone number
- Members, roles and the audit log
- Shop connection tokens, encrypted with a key for your farm alone
- Camera snapshots, such as the one attached to a failure alert, for 24 hours, and frames an Owner chooses to share
Our cloud never sees
- Your printers' access codes
- Card numbers. Your plan is paid through Stripe.
- Your shops' payouts, or their staff and customer passwords
- Raw printer traffic. The bridge turns printer reports into plain status first.
- Frames from the camera check on your bridge, unless an Owner shares them
Sharing frames to improve failure detection is off unless an Owner turns it on. Turn it off again and your frames are left out of the next training set.
Printer access codes are sealed in your browser.
An access code lets anyone on your network control that printer. SpoolSwift is built so that our cloud never has one it can read.
You type the code
In the Add printer dialog. The field is never saved by the browser, never put in a link and cleared once it is sealed.
Your browser seals it
To a key your bridge made for this alone, bound to your farm, that bridge and that one printer.
Our cloud passes it on
It holds only the sealed copy, inside a command it signs, and deletes it as soon as your bridge answers, or after a few minutes at most.
Your bridge opens it
It tests the code on the printer, then keeps it encrypted on the farm PC.
Sealing protects against
- A copy of our database or a backup
- A leaked log or diagnostics file
- A curious member of our staff
- A break-in at the service that carries bridge traffic, which can neither open a seal nor sign the command that carries it
Where it stops
SpoolSwift serves the page that does the sealing. If our website itself were compromised, a changed page could read a code as you type it. Sealing does not protect against that.
The Add printer page loads no third-party scripts. The dialog shows your bridge's key fingerprint, and the bridge's own page shows the same one, so you can check they match.
For the strongest guarantee, add printers on the bridge's own page on your network instead. The code is then never typed into a page we serve.
Nothing starts unless a person, or a rule you armed at the farm, says so.
Plate guard on the bridge
Your bridge refuses to send a start to a printer whose plate nobody has marked clear. A print started from the printer's own screen marks the plate used too. There is no override, no setting and no staff bypass.
Signed commands
Every command is signed by our servers and bound to your farm, one printer and a short expiry. The bridge checks all of it before it acts. The service that relays commands cannot sign one.
Checked again at the printer
Before each start the bridge reads the printer again. It must be idle, with the right model and nozzle, every AMS slot matching and the file's checksum intact.
Three switches for automatic start
An Owner turns it on for the farm, it is on for that printer, and someone at the farm has armed that printer on the bridge with a local PIN. A stolen account alone cannot start an unattended printer at a farm that never armed it.
No heat, motion or G-code
SpoolSwift has no commands for heating, motion, fans, raw G-code, printer settings or firmware. The bridge does not carry them at all.
Orders only add jobs
A paid order or quote adds a job to the queue. Viewers, our staff, your shops and the quote portal can never send a printer a command.
Roles, sign-in and sessions.
Four roles
Owner, Manager, Operator and Viewer. Managers can invite Operators and Viewers only, and only an Owner can add an Owner or a Manager. Viewers watch the floor and never start a printer or answer a plate.
Two-step sign-in
Any member can turn on two-step sign-in for their account.
A fresh sign-in for the big switches
Pairing a bridge, connecting a shop, turning on automatic start, changing billing, exporting the audit log or deleting the farm asks you to sign in again unless you just did.
Removing a member
Their access ends within 60 seconds on every device, including a live floor left open on a screen.
Your sessions
See where you are signed in and end any session from your account page.
Invitations
Each link works once, only for the email and role it was sent to, and expires after 7 days. Owners get a summary of every invite and role change.
Every change is written down, and the record cannot be edited.
Owners and Managers can read the log and export it as CSV. Each farm's log only ever grows, and every entry carries the hash of the one before it, so a changed or missing entry breaks the chain. The chain is checked every night.
- Sign-ins and two-step changes
- Members, roles and plans
- Bridge pairing and printers
- Every printer command and its outcome
- Plate answers and automatic start switches
- Shop connections and price changes
- Every look by our staff
When our staff look at your farm, you see that they did.
Support sometimes needs to see a farm to fix a problem. Each look is a grant with a written reason. It is read-only, ends after 2 hours by default, and is written to your audit log and emailed to your Owners.
During a grant, staff can
- Read your farm's pages
- Nothing else. Every grant ends on its own.
Staff sign in on a separate site with a hardware security key.
Staff can never
- Send a printer a command
- See a printer access code
- Read your shop tokens
- Change what you are billed
- Arm a bridge for automatic start
Farms kept apart, secrets kept out of logs, and software you can check.
Every farm fenced off
Every request is tied to one farm, and the data layer adds that farm to every read and write. A test suite tries to cross between farms on every change we make. Ask for another farm's job or printer and the answer is not found.
A bridge speaks for one farm
Our servers take the farm from the bridge's own identity, never from what a message says, and drop any report about a printer that is not on that bridge.
Secrets encrypted, logs scrubbed
Shop tokens are encrypted at rest with a key for each farm. Tokens, cookies, access codes and sealed codes are stripped from every log, and a test fails the build if one slips through.
Incoming messages verified
Messages from Stripe and from the shops you connect are checked against their signature before anything runs, and each one is handled once.
A signed installer
The bridge comes as one signed .msi that installs a Windows service on your farm PC.
Signed updates
Bridge updates are signed with a release key kept offline, roll out in stages and can be rolled back.
Found a security issue? Tell us first.
Anything that could start a printer or cross between farms is treated as critical. An outside firm tests farm separation, the bridge and the quote portal.
- Email[email protected]
- security.txtspoolswift.com/.well-known/security.txt
- Please includeWhat you found, how to reach it, and whether a printer or another farm's data was involved.
Security questions farms ask
Can SpoolSwift staff start my printers?
No. No staff tool can send a printer command. Staff access is read-only, needs a written reason and shows in your audit log.
What happens if SpoolSwift goes down?
Running prints carry on, and the bridge keeps tracking every printer and plate. Nothing new starts until it reconnects. Pause and stop still work at the printer, and the bridge's own page shows live status on your network. When it reconnects, any print that ended gets its Collected or Not collected question.
Do I have to use automatic start?
No. It is off until an Owner turns it on, and each printer also has to be armed at the farm with a local PIN. Starting a print by hand never needs arming.
Where is my printer's access code kept?
On your bridge PC, encrypted. Our cloud only ever carries it sealed to your bridge, for a few minutes at most.
What if the bridge PC is lost or stolen?
Remove the bridge on the website, and its sealing key goes with it. Change the access code at each printer's screen, then add the printers to a new bridge.
Start free with one printer.
No card needed.