Server security, data control & backups explained

The following doc is intended to list working practices at PrintJob and as such, will be constantly reviewed and updated.

 

 security-protection-anti-virus-software-60504Where is PrintJob Data stored? Where is my data stored?

PrintJob (PJ) is partnered with cloud hosting company Linode. PrintJob ‘holds’ data on hundreds of companies around the world, on servers in the UK, Texas, Frankfurt & Singapore. All EU clients are on Frankfurt based servers.

 

All data stored is encrypted and cannot be access by anyone for whom it is not intended.

What information are we storing?

For people who login, the minimum data required is name and email. Commonly though, PrintJob will be storing employee lists, addresses, department IDs, logos, artwork, order data and files such as invoices and stock reports.

Passwords are encrypted. PrintJob does not store any credit card or other payment info.

Access to Data

Access to client data is limited to PrintJob staff. However since all production and testing work is normally carried out on isolated and separate servers, PrintJob staff will only access client data when providing support, and with clients implicit permission. Aside from Linode (who don’t have access), PrintJob doesnt currently use subcontractors. In the event that PJ did bring in outside staff, their access would also be limited to test servers, and again, any contact with client data is prohibited unless permission is granted.

PrintJob retains no right to access or share your data beyond what is necessary to provide the service. Also see Terms and Conditions & Privacy Policy

All data inputted into the software is the responsibility of the Administrators (Admins – you) and easily accessible to them. Admins can suspend, delete, create and modify user information. It is the Administrators’ job to look after this data according to their various legal requirements. No Admin has access to any passwords.

 Exporting data

Admins can export all users, addresses, departments, orders, stock info etc. At any time.

Development History

The current PrintJob System was launched in 2015 and is in constant development.

ISO

 The security and privacy policy of the PJ System is up to date with current thinking and in line with protocols outlined in the documentation published by ISO, the International Standards Organisation and specifically their Information Security documentation here.

GDPR

Most of our security policies were already in line with the announcement of the EUs 2018 stringent privacy and data rules. We made some changes to our handling of cookies, and moved our EU server to Frankfurt, but otherwise we were already fully compliant.

How these Standards affect PrintJob

Broadly speaking, the ISO documentation and GDPR describes minimum and best standards and rules on how personal and company data is handled and secured, minimum password requirements, how passwords are stored, how cookies are presented and used, and how all of this is protected from unwanted intrusion.

How PrintJob protects your Data

pexels-photo-1054397PrintJob works in partnership with Linode to provide secure and regular backup routines, load balancing, Apache updates, SSL encyption, Firewall, anti DOS, antivirus and malware scanning, rootkit monitoring and other measures across all the PJ servers. We receive regular email alerts from Monit, a process supervision tool and email alerts indicating newly blocked IP addresses (we automatically block IP addresses with multiple failed login attempts (ie: antirobot/crawler protection)).

Our servers are protected by the following defences
-fail2ban – against brute force attacks
-iptables – firewalls only allowing access via single access ports
-Ddos – protecting against denial of service (DOS) attacks
-Rkhunter/maldet – runs 24/7 and scans daily looking for rootkits & malware
-Monit – monitors CPU/RAM usage, disk space, SSH, Apache, Postfix, Mysql, Cron, Syslog, NSD, fixing anything automatically if it can or forcing a restart of components like apache as well as sending out alerts.

Backups

3 backups are constantly maintained (yesterday, a week ago and a month ago), kept on separate, dedicated backup servers and can be recovered within 2 hrs. We test these backups on a monthly basis. Quite often we recover data from backups that clients have deleted by accident.

SSL Encryption

All connections to all PrintJob Servers are encrypted via SSL. Front end systems are automatically protected by SSL encryption in the event that you use your own domain names, a process which happens automatically when you add a domain name.

Limited Role Based Access

Only a user with a password can access the system, and unless they are an Admin user, they will only see a limited amount of data and that which is in accordance with the role to which they are assigned.

No PrintJob client (Admin) can see another client, no company client can see another company, no department client can see another department.

Shared logins?

PrintJob does not use usernames and does not encourage anyone to share logins. Using emails as the primary identifier discourages the practice of sharing logins and is more secure. This is because you cannot access or change any data on the system including your own, without first verifying your email address. PJ does not encourage people to share any information at all.

pexels-photo-1181325Anyone with malicious intent could break into the PJ System, but to do so, they would first have to break into your email. If such a person did break into the customer facing system, the data they would be able to access would be limited. If an Admins email was hijacked, it would be more serious (User could steal or delete data (meaning a potential recovery from backup))

To prevent this, we would recommend further security requests, such as screen locks etc but otherwise this is outside the scope of this doc.

Single Sign On

PJ does offer SSO as a feature, which would enable you to link the PJ System with another system allowing people to use login credentials from other systems, to gain access to the PJ System. However, anyone gaining access in this way is prevented from seeing other users data. It is very secure.

Passwords

All passwords are encrypted and not visible to anyone at PrintJob. No PJ staff can discover any client passwords. This is by design.  If any client actually wanted PrintJob to tell them their password, we could not do it as they are all encrypted.

Passwords are minimum 8 characters with no further rules.

Forgot Password?

If someone forgets their password, they must go through the password reset process, which involves triggering an email which is sent to the user. The link in the email allows user to reset password. No-one can ever ‘look up’ their own or someone elses password or change it for them.

How do we delete users or data?

Admins can suspend users and companys, preventing them from logging in and accessing any data. Admins can delete users, but not delete companys (which can delete large amounts of info), but can request that PrintJob staff delete them.

Security Testing

PrintJob Systems have not formally been reviewed or tested by ISO or any EU body, but PJ would welcome any questions, interrogations and stress testing reviews conducted by any independent organisation, including defence contractors or government agencies. Such tests are becoming increasingly routine and don’t cost a lot to commission. They provide peace of mind, as well as advice to all parties, in keeping data and systems secure.

Since 2015 PrintJob has never been found to have any serious omissions or flaws in its security policy. PJ has always reacted to advice given as a consequence of these tests. The weakest link in any security system is personnel – people sharing or writing their passwords down. That’s something PJ cant prevent.

Future Development on Security

There is always pressure to increase security.

PJ is currently debating whether to increase the password requirement so that they include one uppercase letter, one special character and alphanumeric characters. However, we’re very keen not to impact usability and we are aware of the fact that we aren’t a bank.

We could also allow Google or Microsoft logins.

Are you a target? Threats?

One small point. If you or any of your clients have any reason to suspect that your data will be targeted by hackers or agencies, please inform PJ – we may take the precaution to move your systems to dedicated and ‘independent’ servers.

Does PrintJob vet its staff?

Yes. Everyone who works at PrintJob is properly checked, to ensure that do not themselves pose a threat to data security.

How does anyone get Support?

PrintJob Clients (Admins) can communicate directly with PrintJob Support via an in-app communication tool. Help articles are also found on https://printjob.com/support/

Who can see my Support Queries?

Only PrintJob staff.

What happens when the Systems go down?

Our Terms and Conditions page explains this. Downtime does happen, but when it occurs in UK office hours, it has never lasted longer than 3 or 4 hours but is more often less than 20 mins. Worst case scenario (in the event that the data is unrecoverable) PJ can restore from backups within an hour or so.

pexels-photo-325229 (1)

Cloud Server Specs

4 core CPUs, 8GB of RAM, 1000GB of RAID storage and 5000GB of monthly bandwidth on all servers. Further upgrades are possible.

On Brexit

We’re waiting to hear what impact Brexit will have on UK businesses and the EU. Aside from our programmers, we don’t maintain any presence in the UK. We’re based in France and Germany. We do have potential plans to move our company to the Republic of Ireland if Brexit causes any issues.

 
 
 

See also

Linode
ISO
GDPR
PrintJobs Response to GDPR
PrintJobs Terms and Conditions
PrintJobs Privacy Policy

Fonts. Where do I find them? What fonts can I use?

You can see the list of fonts available in your system in System Settings > Fonts

To upload new fonts, you need to a) have a suitable license to use the font and b) make sure its properties allow it to be ’embeddable’. You can upload any windows font, or TTF, OTF, or Postscript Fonts. The postscript fonts will require 2 files to be uploaded, usually a PFM and an AFM.

Please note any system fonts you find in the system are there for demonstration use only. They will NOT be embedded into any pdfs.

Explanation of the Stock Options page

Below are the various elements to Stock Management System.

Quantity on Hand =  This is the all important Quantity (QTY). This is also known as QTY on hand or True QTY, or “Amount on shelf”. Admin can adjust this figure at any time. 

Quantity Allocated = This is the QTY currently on order that has not been completed / cancelled or deleted.

Replenishment Quantity = This is the Qty of replenishment stock that is currently on order. Only Client Senior Managers can order replenishment stock. When these orders are completed the ‘Quantity on Hand’ will reflect the correct Qty

Available Quantity includes uncompleted replenishment orders = When ticked Quantity Available will add any replenishment stock on order.

Allow Back Orders = Ticking this will allow clients to order stock products when there is in sufficient stock available. Otherwise the client will not be allowed to order stock that is greater than the Quantity Available shown to them.

Stock History = Every type of stock movement is recorded allowing you to see exactly who did what and when.

Importing DataSets via the API

If you are using Data Sets in your editable templates, you can now allow Data Sets manipulation through our API.
You can retrieve, update, create and delete any Data Set or any of its elements, called Data Points.

What are datasets?

DataSets are used in Editable Product templates. They are used to group sets of values (DataPoints) for selection by users during the ordering process. Each DataSet belongs to a specific company and can have one or more DataPoints which users can select from a dropdown when they fill in the template fields. Each DataPoint contains up to 9 separate columns that can store strings that would appear in the final product.

Retrieving data from API is relatively easy. All you have to do is to navigate to the desired endpoint and you get a list of all objects currently present in the system.

Request:

curl "https://api-domain.printjob.com/v2/dataSets" -u "sk_test_key":

Response:

{
  "object": "list",
  "count": 2,
  "data": [
    {
      "object": "data_set",
      "attributes": {
        "company": "company_YEkjyNa0q6GXMlR83Bm9",
        "name": "Office Addresses"
    },
    "id": "data_set_8lwpXy6JRgdDLYmBaKO9",
    "test_environment": true
    },
    {...}
  ],
  "links": []
}

Once you get your list you may want to update one or more of the objects. This is where new functionality comes in. PrintJob API is built around RESTful approach, so to affect a change in the contents of the object you will need to switch to a ‘PUT’ verb in your HTTP request.

Let us assume that first object from the truncated list above is the one that interests us. We want to change its name to ‘Company Addresses’. Let us try that.

Request:

curl -X PUT -d "attributes[company]=company_YEkjyNa0q6GXMlR83Bm9&attributes[name]=Company Addresses" "https://api-domain.printjob.com/v2/dataSets/data_set_8lwpXy6JRgdDLYmBaKO9" -u "sk_test_key":

Response:

{
  "object": "data_set",
  "attributes": {
    "company": "company_YEkjyNa0q6GXMlR83Bm9",
    "name": "Company Addresses"
  },
  "id": "data_set_8lwpXy6JRgdDLYmBaKO9",
  "test_environment": true
}

Let’s walk through the example above.

-X PUT flag sets our request verb to PUT, which tells API that we want to modify an existing record
-d “…” contains a list of all attributes of the model with the values we chose to change.
NOTE: Remember that you need to send an entire object, with all of its attributes you don’t want to change prefilled with current values as any missing attributes will be set to empty.
URL part contains an URL to dataSets endpoint and an ID of an object we want to modify (data_set_8lwpXy6JRgdDLYmBaKO9 in this case)
-u is the authentication part where username is (the part before the colon) is your API key, and password (the part after the colon) is empty.

Request returns an updated object which you can immediately use, modify again or even delete. As you can see it’s ID remained the same while values of desired attributes have changed.

If you would like to add a new DataSet then you need to use POST verb and send the data in a very same way as in case of the PUT request.  Check out the example below:

Request:

curl -X POST -d "attributes[company]=company_YEkjyNa0q6GXMlR83Bm9&attributes[name]=Home Addresses" "https://api-domain.printjob.com/v2/dataSets" -u "sk_test_key":

Response:

{
  "object": "data_set",
  "attributes": {
    "company": "company_YEkjyNa0q6GXMlR83Bm9",
    "name": "Company Addresses"
  },
  "id": "data_set_q21ZlAJGR27Dzd6Pxpnr",
  "test_environment": true
}

Please notice the differences from the previous example.
In the request, we do not supply the object ID as it does not yet exist. We send our data directly to DataSet endpoint and let it do its magic. The ID of a newly created DataSet will be included in the response.

In the case of the DataSet, there are two attributes – company and name. Company is a reference to a company present in your system and takes the form of that company’s ID. Name is just a string that will describe the DataSet. Both are required, and if you omitted any of them your request would fail and return an error describing the problem. Please refer to the documentation to see all the required attributes of objects you are working with.

If you then wanted to remove one of your DataSets you could use DELETE verb in your request. Example follows:

Request:

curl -X DELETE "https://api-domain.printjob.com/v2/dataSets/data_set_q21ZlAJGR27Dzd6Pxpnr" -u "sk_test_key":

Response:

{
  "code": 200,
  "message": "Success"
}

As you can see this one is pretty straightforward. All you need is an ID of the DataSet you want to remove and a DELETE verb. Use it with care as removed items can not be restored.

NOTE: Removing DataSet with associated DataPoints will remove those DataPoints as well without any additional checks or questions. Always ensure that you are deleting correct objects and don’t try to guess the IDs of objects to delete!

DataPoints

Each DataSet contains one or (usually) more DataPoints that allow users to choose values they want to appear on their products. To retrieve and manipulate DataPoints we use the same techniques as described for the DataSets above.

Just like with DataSets belonging to a Company, DataPoints belong to a specific DataSet. To create a new DataPoint for our DataSet we would follow a similar path as we did with DataSets.

Request:

curl -X POST -d "attributes[name]=Main Office&attributes[sort_order]=1&attributes[value_1]=10 Some Street&attributes[value_3]=Anytown&attributes[value_4]=AN12YT&attributes[data_set]=data_set_8lwpXy6JRgdDLYmBaKO9" "https://api-domain.printjob.com/v2/dataPoints" -u "sk_test_test":

Response:

{
  "object": "data_point",
  "attributes": {
    "data_set": "data_set_8lwpXy6JRgdDLYmBaKO9",
    "name": "Main Office",
    "sort_order": "1",
    "value_1": "10 Some Street",
    "value_2": "",
    "value_3": "Anytown",
    "value_4": "AN12YT",
    "value_5": "",
    "value_6": "",
    "value_7": "",
    "value_8": "",
    "value_9": ""
  },
  "id": "data_point_wJq6G5l4xR0XzovWNeL1",
  "test_environment": true
}

As you can see, we sent only the attributes we wanted to hold a value. Other attributes were set to empty. DataSet is a required field and needs to hold an ID of an existing DataSet.

Modifying and deleting DataPonts is very similar to DataSets and if in doubt you can consult our documentation for specific examples.

Hiding crop marks, bleed etc using a Trim Box

The PJ system is set to respond to ‘Trim Boxes’

Or, more accurately, clients will only see previews of the trim box area and if no trim box then the crop box. If neither have been set then the Media box.

image-393

To set the trim box go into Acrobat Pro and choose Tools>Print Production>Set Page Boxes

 

 

Heres a video which shows the process

 

Resizing Text

If Jose Maria Gonzalez de la Casa de Santo Domingo de las Cruzes is editing his business card there’s a good chance that his name is going to stretch off the canvas, and make the design look terrible. And possibly require some action.
resize2

You can specify that a text field on an editable product has a maximum length of say, 50mm and then ‘Resize’ any text that exceeds the given dimensions automatically.

Resizing text
If you tell it to, via the admin>edit product>edit template>edit object pop up, the PJ System will condense the text horizontally, in order to fit the given width. If it has to condense it more than 75%, it will then reduce the font size until the text fits into the area.
resize1
In the example above, you can see that the text is being horizontally squeezed in the second line down. The letters are the same height as the untouched text above, but they are thinner, and the space between the letters is proportionally reduced. It’s not until the fourth line down that the actual font size changes. You can check this by examining this PDF.

Alert
We going to issue an alert in the form of some red text on the left hand side, when this function comes into play. That will allow the user (and approver, manager and admin) to see that somehting has been changed on the template and it might need checking.

 

Email SPF Records can be confusing.

The most important thing to know is that there can only be one SPF record per domain so if you have more than one you need to join them.

Here is what you should do if you are merging 2 SPF records (ie adding PrintJob to Microsoft outlooks SFP)

Change the Host: as outlined in red and add another include:spf also marked in red.

Host: @

TXT Value:  v=spf1 include:spf.protection.outlook.com include:spf-s1.printjob.com ~all

 

Information about what SPF data needs to be added can be found when you click Authenticate Email. These instructions vary depending on where you are based in the world but overall they look something like this. screenshot-admin-demo.printjob.com-2019.09.16-13_02_02

SPF records take time to propagate so be a little patient.

If Host: is giving you trouble you can replace your domain with @ and it should work.

 

 

Adding SPF, DKIM and DMARC records

SPF, DKIM and DMARC are important for verifying the sender address used in emails. When the three methods are used together, the likelihood that the email will be seen by the recipient increases, because these are internationally agreed standards used by most anti spam filters.

This is what you need to achieve before your email will be used as the sender. 4 green ticks.

screenshot-admin-demo.printjob.com-2019.09.16-12_55_12

 

 

 

The method for adding all three is almost identical – here is an example of adding a DMARC record to a domain name held in a Godaddy Account. The first image shows some instructions provided in the PrintJob System:

 

Setting up DMARC

Login to Godaddy – navigate to manage domains and click on Manage DNS (here you can add you SPF, DKIM and DMARC records all at once)

screenshot-dcc.godaddy.com-2019.09.16-10_22_02

Then add a new record

screenshot-dcc.godaddy.com-2019.09.16-09_54_47

Then select TXT record

screenshot-dcc.godaddy.com-2019.09.16-09_55_49

Enter values provided by PrintJob

screenshot-dcc.godaddy.com-2019.09.16-09_57_26 (1)

Click save and you are done.

Normally, it will start working after only a short wait, but in some cases you may have to wait up to 24hrs for the change to propagate.

Adding Products

Admins create Products either in the Storefront Products, which are generic products available to all your clients, or in the Products Section in a particular Clients Settings area.

prod11

Storefront Products – you can think of these as generic products, which are available to all users/clients. To add/edit/view storefront products goto System Settings>Storefront Products. To hide storefront products for a client, go to that Clients Settings page ‘Content Settings’ and untick the relevant box.

Client Products – available ONLY to users of that client account. To add/edit/view Client products goto Client Settings> Products.

To add a product just click on the button:
new_product_button

Quick notes:

  • The minimum required info to create a product is a product name. Everything else can be added later on. Once created, you can add pricing etc by using the tabs at the top of the edit product page.
  • You can drag and drop products and categories to organise them
  • To place a product inside a category, edit the products and choose the category from the drop down
  • You can hide products while you are building them
  • Once you create a product, you can’t change it to another product type.
  • You don’t need to give a default supplier, you can assign orders to a supplier later on.
  • If you add a PDF to the product, the system will create a Product Image (JPEG) from the first page of the PDF, for your product, only if there isn’t a JPEG there already. Alternatively you can add a JPEG at any time.
  • Make sure you check what the product looks like by logging in as a client

Budgets. How do they work?

Budgets can also be called spend limits. Admin can allocate a budget for a client, or a department or a group of users within a client.

budget234

Here’s an example: “Save the Gorillas Uganda Appeal”. Budget is set at $40,000, with a user limit of $5,000, and is applied to all users in the account “Save The Gorillas” for the period between Jan 2014 and April 2014. Each user can make orders against this budget up to a limit of $5,000, If they exceed their budget they must either continue with their order under another budget or place their order on hold.

It can work in lots of different ways.

For version 2 we will extend the functionality to show what budgets are applied to each user on the user table. And also, we’ll add some options to control what happens when a users budget is met etc.