This overview explains how FaxToFax protects faxes and accounts: passwordless sign-in with optional or required two-step verification, automatic sign-out, team roles, encryption in transit and at rest, an append-only audit log and retention controls you set. It also says plainly what is not encrypted: a fax travelling over the public telephone network to a traditional fax machine. Security is shared, so we also list the settings and habits that are your responsibility.
1. Our approach
Our safeguards are designed around the administrative, physical and technical safeguards of the HIPAA Security Rule, and a Business Associate Agreement is available on Business and Enterprise plans. We do not currently hold third-party security certifications or audit reports, such as a SOC 2 report. There is no official "HIPAA certification" for software, and we do not claim one. Using FaxToFax does not by itself make an organization HIPAA compliant; it is one part of your own compliance program.
2. Signing in
- No passwords: you sign in with a one-time code sent to your email address, so there is no FaxToFax password to be guessed, reused or leaked.
- Two-step verification: you can add a time-based code from an authenticator app (TOTP). Account owners can require two-step verification for everyone on their team.
- Automatic sign-out: sessions end after a period of inactivity that the account owner chooses: 15, 30 or 60 minutes.
- Secure session cookie: the cookie that keeps you signed in cannot be read by scripts on the page and is sent only over encrypted connections. See our Cookie Notice.
3. Access control
| Role | What it can do |
|---|---|
| Owner | Everything, including billing, signing the Business Associate Agreement, security settings, exporting data and closing the account |
| Admin | Manage the team and settings, and view the audit log |
| Member | Send faxes, and view the faxes they have been given access to |
| Viewer | Read-only access to the inboxes they have been given access to |
4. Encryption
- In transit: connections to FaxToFax use TLS 1.2 or higher, and HTTP Strict Transport Security tells browsers to connect only over encrypted connections.
- At rest: fax documents are stored encrypted with AES-256 in Cloudflare R2 storage.
What is not encrypted
When you send a fax to, or receive a fax from, a traditional fax machine or another fax service, the fax travels between our fax provider and the other party over the public telephone network using standard fax protocols. That part of the journey is not encrypted. This is true of fax in general, not only of FaxToFax. Intercepting a fax on the telephone network generally requires access to carrier infrastructure, but the risk is not zero, and a fax that arrives at a shared machine may be seen by people near it. Consider this when deciding what to send, check numbers carefully, and use a cover page with a confidentiality notice.
5. Limiting copies
- Our telecommunications carrier is instructed not to store outbound fax documents.
- Inbound fax documents are deleted from the carrier after we copy them to our encrypted storage.
- New-fax alerts, in the app or browser, never contain document contents.
6. Integrity and audit
- Fingerprints: we store a SHA-256 fingerprint for each fax, which can be used to check that a document has not changed since it was stored.
- Audit log: an append-only log records views, downloads, sends and settings changes, with the person and the time. Users cannot edit or delete entries. Owners and admins can export the log to CSV.
7. Retention, export and deletion
- The account owner chooses how long faxes are kept: 30 days, 90 days, 365 days, 7 years, or until deleted manually. Faxes older than the chosen period are purged automatically.
- Owners can export all of the account's data at any time.
- Closing an account deletes fax documents and personal data, keeping only the invoices and audit records the law requires us to keep.
8. Infrastructure and providers
FaxToFax runs on Cloudflare, which provides hosting, the database, encrypted storage and email. Our telecommunications carrier transmits faxes and provides fax numbers, and Stripe processes payments. See Annex 3 of our Data Processing Addendum. We will have business associate agreements in place with providers that handle protected health information before they process any.
9. Payments
Card payments are handled by Stripe, a PCI DSS Level 1 payment processor. Card details are entered into fields served by Stripe, and FaxToFax never stores full card numbers.
10. Our people
Access to production systems is limited to authorized personnel and requires two-step verification. We access customer content only when needed to provide the Service, to help you when you ask us to, to investigate abuse or a security incident, or to comply with the law.
11. Incidents and breach notification
- Under our Business Associate Agreement, we report breaches of unsecured protected health information within 10 business days of discovery, and in no case later than the 60 days HIPAA allows.
- Under our Data Processing Addendum, we notify customers of personal data breaches within 72 hours of becoming aware of them.
- If you suspect a security problem with your account, email security@faxtofax.com straight away.
12. Your part
- Secure the email account you use to sign in, because sign-in codes are sent there. Use a strong password and two-step verification on your email.
- Turn on two-step verification in FaxToFax, and require it for your team if you are an owner.
- Choose the shortest automatic sign-out period that works for you.
- Give each person the lowest role they need, and remove people promptly when they leave.
- Set a retention period that meets your legal obligations.
- Check fax numbers before sending, and use a cover page with a confidentiality notice.
- Sign the Business Associate Agreement before handling protected health information.
- Keep your devices updated and locked, and do not send patient or client information to us by email.
13. Reporting vulnerabilities and security reviews
If you find a security vulnerability, please report it under our Vulnerability Disclosure policy. If your organization needs a security questionnaire completed as part of a vendor review, contact security@faxtofax.com.