This article answers the questions a school IT director asks before approving KyberCopy.
Outbound only
The relay agent on your network makes only outbound HTTPS connections to KyberCopy. It polls for work every ten seconds. KyberCopy never connects into your network. No port forwarding, no inbound firewall rule, no VPN. Printers keep their private addresses and are spoken to by the relay over IPP on your LAN.
Each relay is enrolled with a per-machine token. Pairing codes expire in 30 minutes and work once. An administrator can issue a New token at any time, which stops the old one immediately.
Tenant isolation
Every school is a separate tenant with its own subdomain. Data is stored in Postgres, and every tenant table carries the school's id with a Row-Level Security policy. The application sets the current school on each request, and the database enforces the boundary: a query that forgot its tenant filter returns zero rows, never another school's data.
Membership and role are re-read from the database on every request rather than trusted from the session. Revoking someone's access takes effect on their next request.
Sign-in
Google sign-in uses your Google Workspace, so disabling an account there removes access here. Automatic joining by domain is off by default and cannot be saved with an empty domain list or a public domain such as gmail.com. Password accounts exist only by invitation. Invitation links are one-time and last one week.
Files
Uploaded documents go directly from the browser to object storage using a short-lived signed URL; the bytes do not pass through the application server. Documents are converted to PDF when needed.
File retention
In Copy room settings, Requests tab, Delete files after sets how many days after printing the uploaded file is removed. The default is 30 days. The job record is always kept, so the copy room can still answer "did that print in March" and reports stay complete; only the file is deleted. The tab shows how much your school is currently storing.
Email intake
You forward a mailbox; your MX record is never changed. Senders must already be members. Messages that fail both SPF and DKIM are refused.
Roles
Teachers see only their own requests. Copy room staff see the queue. Printers, presets, people and settings are limited to administrators. Billing is limited to the account owner.