The controls, and why each one is there

Each MSP has its own account at its own address, yourmsp.xenoprint.app. Every lookup in the portal is scoped to the account you signed in to. A request for another account's client is answered "not found" rather than "forbidden", so nobody can confirm another MSP's clients exist by guessing their names.

Sign-in sessions belong to your address and are not accepted at anyone else's.

Every user registers an authenticator app before the portal will do anything else, with one-time recovery codes for a lost phone. It is not a setting someone has to find and switch on: until a second factor is in place, the portal goes no further than the page that sets it up.

Every agent update is signed with a release key we keep offline - not on our servers and not in source control. Machines install only updates that carry that signature, so nobody, including someone who got into our servers, can swap the agent for one of their own.

During the beta, the portal accepts connections only from the networks of participating MSPs. Agents carry on working from any client site, because they use a separate interface that the restriction does not apply to and that cannot be used to administer anything.

Administrative changes - printers deployed or removed, machines moved, users and settings changed - are recorded against the client they affected, with who made them and when. You can review the log in the portal, and it outlives the client it describes: deleting a client does not delete the record of what was done to it.

Our staff do not see your clients' data by default. When you need help, we ask for access; you approve it in your portal, it expires on its own, and everything done under it appears in your audit log.

Print activity records the printer, the machine, the user and the page count. The document's name - at a clinic, possibly a patient's; at a police department, a case number - is recorded only if you turn that on for a particular client, and names already recorded can be purged.

The site you are reading creates accounts and does nothing else. It has no access to the portal's data and never sees your password: you set that from a link the portal emails you, together with your second factor. Its requests to the portal are signed, and the portal checks them.

Everything is served over HTTPS only. Every .app address is HTTPS-only in all major browsers by design, so there is no unencrypted version of any page to fall back to.