Visibility on a quiet channel
Most investigations can reconstruct what left by email or upload. Far fewer can say what walked out of the building in a folder.
Open source
The door nobody watches.
PaperTrail is a small Windows print auditing utility. It records what was printed, by whom and from where, so that the one channel most monitoring ignores stops being invisible.
Open sourceWindows print environmentsDeliberately small
| Document | User | Host | Time |
|---|---|---|---|
| Board pack Q3 | a.karim | FIN-04 | 14:02 |
| Supplier contract | s.malik | LEG-02 | 14:19 |
| Payroll summary | n.hussain | HR-01 | 16:41 |
| Network diagram | r.shah | ENG-07 | 18:12 |
StandardClassified
Illustrative interface
AzbersInnovations
AzbersInnovations
Why we kept it
A narrow tool, kept honest by being readable.
PaperTrail is not a flagship and was never meant to be. It stays in the portfolio because print remains a genuine exfiltration path, because small utilities age well, and because publishing the source is the only reasonable way to ask someone to run an auditing tool on their estate.
Useful during an investigation
When something has gone wrong, a print record is often the difference between a theory and a timeline.
Open by principle
Anything that watches user activity should be inspectable by the people it watches. The source stays public for that reason.
Not every problem needs a platform. Some of them need one honest utility that does the single thing nobody else was doing.
What it records
Four fields, and the reason each one matters.
It is deliberately small. Everything it captures is something an investigation later turns out to need.
What was printed
The document name and the job, so a later question about a specific file has an answer rather than a shrug.
Who printed it
The user account behind the job, which is usually the first thing anyone asks and the hardest thing to reconstruct afterwards.
Where from
The workstation and the queue, which is what turns a single record into a pattern across an estate.
When
The timestamp, which is what makes the record a timeline rather than a list, and what makes after hours activity visible at all.
Questions we get asked
Before you get in touch
The questions that come up most often, answered the way we would answer them on a call.
Is it really free?
Yes, and the source is public. Anything that watches user activity should be inspectable by the people it watches, which is the main reason it is open rather than a commercial decision.
Why does print still matter?
Because most investigations can reconstruct what left by email or upload, and far fewer can say what walked out of the building in a folder. It is the one channel that almost nothing watches.
Does it read the documents?
No. It records the job, the user, the host and the time. The content of what was printed is not captured, which keeps it useful for investigation without turning it into surveillance.
Will you keep maintaining it?
It stays in the portfolio. It is deliberately small, which is precisely why it ages well and why it has not needed to change much.
Need print visibility across an estate?
Whether that means PaperTrail on its own or a broader look at data leaving the organisation, the conversation is worth having either way.