How HP Insights protects your data: security and data flow

When you evaluate a cloud print platform, the questions that matter most are about data. What leaves your network? How is it protected, where is it stored, and how long is it kept? This page answers those questions for HP Insights and explains the controls you have over each one.

In summary

• Secure Print Direct jobs typically stay on the local network.
• Secure Print jobs are encrypted in transit and at rest.
• Authentication remains with your identity provider.
• Data residency and personal-data collection are configurable.
• Encryption keys can be managed by HP Insights or by your organization.

What leaves your network (and what doesn’t)

HP Insights handles two kinds of data, and treats them differently depending on the workflow. Job content is the document itself, the file a user prints. Job metadata is information about printing: who printed, when, how many pages, in color or mono, on which device. Metadata powers analytics and policy enforcement. Depending on your Data Privacy settings, personal fields within metadata can be collected, hashed, or not collected. Content only exists so a held job can print when it’s released.

Data type	Where it goes	How it’s protected
Job content (documents)	Direct IP jobs travel from the workstation straight to the printer and typically never leave your network. If Cloud-based delivery is enabled and the workstation cannot reach the printer directly, the job may be routed through HP Insights using temporary storage encrypted with Zero Knowledge Encryption (ZKE); the content is deleted once the job is released. See Off-Network Direct IP Printing through the Cloud for details. Secure Print jobs are held in encrypted storage until release. Depending on your deployment and document-storage configuration, that storage may be cloud-based, in your chosen region, or remain within your own infrastructure using Regional Document Storage.	Encrypted in transit (TLS) and at rest (AES-256). Deleted on release or expiry.
Job metadata	Sent to the platform for policy, cost tracking, and analytics.	Encrypted in transit. Personal fields can be configured for anonymization before storage.
User identity	Authentication happens against your identity provider. Secure Print receives identity assertions, not passwords.	SAML / OIDC federation. Per-field anonymization (collect, one-way hash, or don’t collect).
Device data	Device Scout sends printer make, model, status, and meter reads to populate fleet inventory and Insights.	Encrypted in transit. No document data is involved.

A detail your firewall team will care about: Scouts and connectors make outbound HTTPS connections to the platform. No inbound firewall rules are typically required, and users don’t need a VPN.

How print jobs are protected

In transit

Everything that moves between your environment and the platform (Print Scout submissions, release commands, console sessions, mobile submissions) travels over TLS-encrypted HTTPS. There’s no unencrypted pathway into the platform.

At rest

Secure release jobs held in the cloud are encrypted with AES-256 using envelope encryption: each job is protected by a data key, which is itself protected by a customer-scoped master key. You can pick from three key management models, depending on how much control you want:

Key model	How it works	Best for
Platform-managed	HP Insights manages encryption keys on your behalf. This is the default.	Organizations that want strong encryption without key management overhead.
Dedicated key	A master key dedicated to your tenant. Your data is never encrypted under a key shared with another customer.	Organizations with tenant-isolation requirements.
Bring your own key	Encryption uses a key you own and control in your own AWS KMS account. If the key is revoked, access to encrypted job content is no longer possible.	Regulated industries and zero-trust security programs that require customer-held keys.

Where your data lives

Data residency is configured, not assumed. With Data Privacy and Regional Document Storage, you choose the region or regions where held job documents are stored. An EU organization can keep EU users’ documents in an EU region while US documents stay in a US region. You can run several regions side by side, each with its own rules, and route users to the right one.

Each region also has its own rules for personal information. For each field (username, email, full name, phone number, department, location, and so on) you pick one of three treatments:

How long data is kept

Held print jobs are temporary. Released jobs are deleted immediately. If an immediate deletion operation fails, the job becomes inaccessible once its configured lifetime expires and is permanently removed by an automated storage lifecycle process within seven days, so uncollected documents don’t pile up in storage. Job records (metadata) are retained separately for analytics and are not deleted when content is purged. You set the job lifetime for your organization.

Analytics data is kept longer, since trend reporting needs history. See Fleet Analytics data retention and Print Analytics data retention for the current periods.

Identity and Zero Trust

HP Insights follows Zero Trust principles: no request is trusted because of where it comes from or what network it’s on. Every request — a user releasing a job, a Scout reporting in, an API integration pulling data — is authenticated and authorized independently, with access scoped to least privilege for that specific operation. There is no implicit trust based on network location.

Identity itself is not duplicated. HP Insights consumes your identity provider’s authentication decisions rather than maintaining a separate credential store. For how federation, single sign-on, and account provisioning work, see How identity and authentication work in HP Insights.

Security FAQ

Question	Answer
Do users need a VPN?	No.
Are inbound firewall rules required?	Typically no. Scouts and connectors make outbound-only connections to the platform.
Does HP Insights store passwords?	No. Authentication federates to your identity provider; HP Insights receives identity assertions, not passwords.
Can I use my own encryption keys?	Yes, with the Bring Your Own Key model.
Can I keep data in a specific region?	Yes, with Data Privacy and Regional Document Storage.
Can I avoid storing personal information?	Yes. Per-field controls let you choose to collect, one-way hash, or not collect personal fields.

What this means for your evaluation

For a security review, it comes down to this: documents either never leave your network (Direct IP), or they’re encrypted with keys you can own, stored in regions you choose, and deleted on a schedule you control. Personal data collection is a per-field policy decision, not a platform default you have to accept. And identity stays with your identity provider; HP Insights consumes it rather than duplicating it.