Security and data residency

This page summarises how Cirros protects print data, for IT teams and anyone reviewing the service. For specific assurance documents, your Cirros account contact can help.

Secure release

Print jobs are held in your secure cloud queue and released only when you authenticate at an enrolled printer with your card, PIN / Passcode or mobile app. Nothing prints until you are there to collect it, so documents do not sit unattended on the output tray.

UK data residency

All data is stored and processed within the United Kingdom at all times, on Microsoft Azure (UK South as primary, UK West for disaster recovery). Data does not leave UK borders.

Zero trust and encrypted transport

• Zero trust. No implicit trust at any point. Every user, device and printer is authenticated and authorised on every session, and there is no direct line of sight between the client and the printer.
• Outbound only. All traffic is outbound HTTPS on port 443, using TLS 1.2 or higher. There are no inbound connections, no VPN and no gateway appliances to open up.

Identity and access

Cirros federates with your existing identity provider using SAML 2.0 or OIDC, including Microsoft Entra ID, Okta, Google Workspace, PING Identity and GovPass, with multi-factor authentication enforced. User provisioning through SCIM is supported, so accounts are created and removed in step with your directory.

Driverless printing

Cirros supports Windows Protected Print (WPP) and IPP driverless printing, which removes vendor-specific print drivers and the print spooler vulnerabilities (such as PrintNightmare) associated with traditional print servers.

Certifications

Cirros is built, hosted and supported in the United Kingdom. For the current certificates or a detailed assurance pack, contact your Cirros account contact.