How your document stays sealed
The short version: your phone encrypts each file before it leaves, and only the copy center's counter device can open it, at the moment it prints. Here is the long version.
The trip, hop by hop
Your phone
Encrypted here
Each document gets its own random 256-bit key and is encrypted with AES-256-GCM. That key is then locked to the copy center's public key (X25519 and HKDF-SHA256). The order and document IDs are bound into the encryption, so pieces can't be swapped between orders.
SafePrint servers
Sealed
We only ever receive the sealed file and the locked key. Uploads that look like an unencrypted PDF or photo are refused. Nobody, not even you, can download an upload from the app; the servers are in the EU (Google Cloud, Belgium).
Counter device
Opened in memory
When you type your code (or let staff print it), the shop's device gets a link valid for 10 minutes to a copy of the sealed file that carries no account ID. It unlocks the key with its private key, which never leaves that device, and decrypts in memory only.
Copier
Printed, then gone
The device sends the pages straight to the copier and discards them. The sealed copies on our servers are deleted as soon as the order prints.
The last hop, from the counter device to the copier on the shop's Wi-Fi, uses the copier's own printing protocol (IPP), which is usually not encrypted, as with any office printing.
Other protections
Codes can't be guessed
After 10 wrong codes in 10 minutes, a copy center can't try any more for a while.
Every shop is checked
New copy centers stay hidden until we approve them, and go back to review if they change their name, address or location.
Nothing to identify you
No name, email or phone number. The shop never learns which account an order belongs to.
Automatic deletion
Files are deleted when they print, right away if you cancel, after 72 hours if never printed, and a storage rule removes anything older than 4 days.
What SafePrint can't protect against
- Paper. Once it's printed, anyone holding the page can copy it.
- A shop determined to capture what is sent to its own copier, for example on its Wi-Fi.
- A phone that is already compromised, on your side or the shop's.
Found a security problem?
Please tell us before telling anyone else, and give us a reasonable time to fix it. Write to security@safeprint.app. We'll reply within a few days and credit you if you want.