Security Overview
MeterBeam runs software inside customer networks, so we expect security questions and we would rather answer them up front. This page describes how the agent and the portal are built and protected.
The one-line summary for IT: the MeterBeam agent opens no inbound ports, makes read-only SNMP queries to printers only, and communicates outbound over HTTPS to a single destination. It cannot read documents, print jobs, or anything stored on a device.
Agent architecture
No inbound ports
The agent contains no network listener of any kind. Nothing can connect to it. No firewall rules or port forwards are required.
Outbound HTTPS only
It initiates encrypted connections to the MeterBeam portal over TLS 1.2 or higher, with pinned root certificates bundled in the agent.
Read-only SNMP
The agent issues SNMP GET queries only. It contains no SNMP SET capability, so it cannot change a device's configuration.
Scoped discovery
You specify which subnets to scan. As a safety measure the agent refuses to auto-scan any network larger than a /22.
What the agent can and cannot see
| Data | Collected |
|---|---|
| Page counters, toner and drum levels, device status and error codes | Yes |
| Device serial, model, IP and MAC address | Yes |
| Document, image, or file content | Never |
| Print, copy, scan, or fax job names or history | Never |
| Scanned or faxed images, or device hard-drive contents | Never |
| Which user sent a job (per-user print accounting) | Never |
| Device address books or stored credentials | Never |
| Files, traffic, or activity on any computer | Never |
These are architectural limits, not settings. The agent has no code path to retrieve that data, and no MeterBeam employee can enable such collection remotely.
Application security
- Password storage: bcrypt hashing throughout. Plain-text passwords are never stored or logged.
- Two-factor authentication: TOTP with replay protection and single-use recovery codes. TOTP secrets are stored encrypted.
- Session management: session tokens are stored as hashes, expire automatically, and can be listed and revoked individually. All sessions are invalidated on password reset.
- Breached-password screening: new passwords are checked against known breach corpora using k-anonymity, so neither the password nor its full hash ever leaves our server.
- Brute-force and abuse protection: rate limiting on authentication endpoints, plus per-agent ingestion rate and payload limits.
- Login privacy: authentication responses are constant-time with respect to whether an account exists, preventing account enumeration.
- CSRF protection: same-origin enforcement on all cookie-authenticated state-changing requests.
- SQL injection: all database access uses parameterized queries.
- Tenant isolation: every query is scoped by organization and site. Roles are enforced server-side, so read-only users cannot perform writes or retrieve enrollment secrets.
- Audit trail: sign-ins, administrative actions, and privilege changes are recorded, with alerts for new-location logins and privilege changes.
Infrastructure
- Hosted on infrastructure operated by Copier Dynamics, Inc. in the United States.
- The database is reachable only on an internal network segment and is not exposed to the public internet or the local LAN.
- Application containers run read-only, with all Linux capabilities dropped, no-new-privileges set, and CPU, memory, and process limits applied.
- HTTPS is enforced with HTTP Strict Transport Security. Certificates are issued by Let's Encrypt and renewed automatically.
- Encrypted backups run nightly to private storage under our control, and restores are verified.
- Dependencies are scanned for known vulnerabilities, and the platform is patched on a monthly cycle with out-of-band patching for critical issues.
- Every release carries a build stamp tied to its exact source revision, so the running version is always verifiable.
Internal security review
MeterBeam's production and public demo environments each underwent three full-source security review passes in July 2026, covering authentication, session handling, two-factor authentication, tenant scoping, injection, access control, and infrastructure configuration.
All findings were remediated and re-verified. Detailed findings are available to customers and prospects under NDA on request.
Compliance
HIPAA
MeterBeam is not a HIPAA business associate, because it does not create, receive, maintain, or transmit protected health information. Page counters and toner levels are not PHI, and the agent has no access to document content, scanned images, or device storage — the areas where copier-related PHI exposure normally occurs.
Healthcare customers who require one as a matter of policy may request a written statement of scope, or a limited business associate agreement, at info@meterbeam.com.
SOC 2 and other frameworks
MeterBeam does not currently hold a SOC 2 attestation. We have deliberately built to SOC 2-aligned practices — access control, encryption, audit logging, change management, vulnerability management, and backup and recovery — and will pursue formal attestation as customer demand warrants. We would rather tell you exactly where we stand than imply a certification we do not hold.
Data protection
Data handling, retention, and deletion rights are described in our Privacy Policy. Customers may request an export or deletion of their data at any time.
Reporting a vulnerability
If you believe you have found a security issue, email info@meterbeam.com with steps to reproduce. We aim to acknowledge reports within two business days and will keep you updated through remediation. We will not pursue legal action against researchers who report in good faith, avoid privacy violations and service disruption, and give us reasonable time to fix the issue before disclosure.
Security questionnaires
If your organization requires a completed security questionnaire or vendor assessment, contact info@meterbeam.com. We are happy to complete them.