Enterprise Key Management
By default, HP Insights protects print data using Zero-Knowledge Encryption (ZKE) with HP-managed keys, unless Cloud Release is on. Enterprise Key Management (EKM) adds a second layer of encryption using a customer-managed key in your AWS KMS account. Because the key remains under your control, you can revoke or disable it at any time, preventing HP Insights from accessing data protected by that key.
Why organizations use EKM
EKM is designed for organizations that require customer control over encryption keys, including environments with strict data governance, security, or compliance requirements. EKM lets customers use a customer-managed key in their own AWS KMS account to protect cloud-stored print data.
To turn on EKM, you create a key in your AWS account and enter its ARN in Account Settings > Settings > Advanced Encryption. For the steps, see Configure Enterprise Key Management.
How EKM works
EKM uses envelope encryption with AES-256-GCM. A customer-managed key in AWS KMS protects data encryption keys (DEKs), which are used to encrypt print job data. Plaintext DEKs are held only in memory and are never written to disk. To reduce latency and KMS API usage, DEKs may be cached in memory for a limited time.
When a print job is stored, HP Insights requests a data key from AWS KMS. AWS KMS returns a plaintext DEK and an encrypted DEK (eDEK). The plaintext DEK is used to encrypt the job data, while the eDEK is stored with the encrypted data. When the job is released, the stored eDEK is sent to AWS KMS to retrieve the plaintext DEK needed to decrypt the job.
This all happens in HP Insights. The job storage service encrypts the job content with the customer-managed key before it writes the job to cloud storage, and encrypts the job's metadata, such as the document name, in the same way. Cloud storage then applies its own AES-256 server-side encryption on top, as it does for every job, so EKM adds a layer rather than replacing one. Print Scout doesn't do the EKM encryption on the workstation. It uploads the job over TLS, and it shows an error if HP Insights can't encrypt the job with your key.
Key caching
Key caching is constrained by a maximum cache lifetime of 5 minutes and a maximum reuse limit of 100,000 encryption operations, whichever is reached first. Keys are cached in memory only and are not written to disk.
Key caching is enabled by default. For environments with strict security requirements, caching can be disabled. When disabled, every encryption and decryption operation makes a direct call to AWS KMS. This increases KMS API costs and may add latency, but eliminates any window where a cached key could be used after revocation.
When keys are unavailable: fail-open and fail-close
EKM can be configured to behave in one of two ways when your AWS KMS key is inaccessible.
| Mode | Behaviour when key is unavailable | Default? |
|---|---|---|
| Fail-open | Printing continues. If the customer-managed key is not available, new jobs are encrypted using a system-assigned key instead of your customer-managed key; job data is not left unencrypted, but the customer-managed EKM layer is not applied while the key is unavailable. No error is shown to users, and no alert is sent. System availability is preserved, but the EKM encryption guarantee is suspended for the duration of the outage. | Yes |
| Fail-close | Printing is blocked. Jobs cannot be submitted or released if the key is unreachable. Users see the error: Failed to submit <document name> for printing. Jobs encrypted with an inaccessible key are shown as ******** in the job list until the key is restored. | No |
The fail mode is a tenant-level setting managed by HP. It defaults to fail-open; contact HP to switch your tenant to fail-close. Use fail-close if your security policy requires that jobs are never processed without EKM encryption under any circumstances.
Scope and limitations
| Item | Detail |
|---|---|
| What EKM protects | Cloud-stored print jobs: both document content and document name are protected, regardless of ZKE settings. |
| What EKM does not protect | Applies only to cloud-stored jobs. Job data that is never stored in HP Insights is not protected by EKM. |
| Key provider | AWS KMS (current supported provider). |
| Relationship to ZKE | EKM is an additional layer on top of Zero-Knowledge Encryption (ZKE), not a replacement. If ZKE is already applied, EKM adds another encryption layer. If ZKE is not applied, such as in configurations where Cloud Release is enabled, EKM still encrypts the cloud-stored job data using the customer-managed key. |
| Print Analytics | Enabling EKM may prevent Print Analytics from displaying print job names. |
| Mac Scout support | Mac Scout 2.32 matches Windows Print Scout 8.4 EKM behavior. Both fail-open and fail-close modes are supported on macOS. |
| Key loss | Loss of access to your KMS key prevents decryption of all protected cloud data. HP cannot recover it. |
Auditing key usage
AWS CloudTrail records AWS KMS API calls made against the customer-managed key, including key generation, decrypt requests, and access denials. Because HP Insights may cache DEKs in memory, not every print operation results in a separate KMS API call.
The CloudTrail log is in your AWS account, under your control. It provides an immutable record of when HP Insights accessed your key and whether the request succeeded, providing proof that HP's encryption behavior matches what is claimed.
Frequently asked questions
What happens if my AWS account is unreachable?
The behaviour depends on the fail mode configured for your tenant by HP. In fail-open mode (the default), if the customer-managed key is not available, new jobs are encrypted using a system-assigned key instead of your customer-managed key; the customer-managed EKM layer is not applied while the key is unavailable, and system availability is preserved. In fail-close mode, job submission and release is blocked while the key is unavailable, and jobs encrypted with the unavailable key are masked in the job list until connectivity is restored. In both modes, Direct IP printing is unaffected.
Does EKM replace Zero-Knowledge Encryption?
No. EKM is an additional layer on top of ZKE, not a replacement. If ZKE is already applied to a job, EKM adds a second encryption layer over it. If ZKE is not applied, EKM still encrypts the job using your customer-managed key.
Can I disable EKM after enabling it?
Disabling EKM doesn't decrypt existing jobs; it only affects new jobs going forward. Jobs encrypted while EKM was active remain encrypted under your AWS KMS key until the key is used to decrypt them. Contact HP Support before disabling EKM in a production environment.
Does EKM affect printing performance?
DEK caching (up to a five-minute lifetime) means most print operations don't require a KMS API call. Latency impact is minimal under normal conditions. If your AWS KMS endpoint is in a distant region or behind a slow network path, additional latency may be noticeable.
How often does HP Insights access AWS KMS?
KMS calls occur when cached DEKs expire or need to be refreshed, not on every print job. High-volume environments will see more frequent KMS calls simply due to higher print volume.