Security and compliance at FaxToFax
How we protect your documents, where each compliance program stands today, and the documents your security review will need.
Compliance programs
- HIPAAUS healthcareCompliant
- PHIPAOntario healthcareCompliant
- PIPEDACanadian privacyCompliant
- ABA 1.6(c)US legalCompliant
- Model Code 3.3Canadian legalCompliant
HIPAA & HITECH
CompliantWe follow the HIPAA Privacy, Security and Breach Notification Rules, and sign a Business Associate Agreement on Business plans.
Healthcare · 21 of 21 requirements metBusiness Associate Agreement
CompliantCovered entities and business associates e-sign our BAA in Security & compliance on Business and Enterprise plans.
Healthcare · 4 of 4 requirements metABA Model Rule 1.6(c)
CompliantEncryption, access controls, audit trails and retention controls help firms make the reasonable efforts Rule 1.6(c) requires.
Legal · 6 of 6 requirements metGLBA Safeguards Rule
CompliantWe follow the Safeguards Rule practices financial institutions require of their service providers.
Financial · 8 of 8 requirements metPHIPA (Ontario health privacy)
CompliantWe meet Ontario PHIPA requirements for electronic service providers and agents that handle personal health information for custodians.
Healthcare · Canada · 12 of 12 requirements metPIPEDA (Canada)
CompliantWe follow PIPEDA’s fair information principles, including breach recording and reporting to the Privacy Commissioner of Canada.
Privacy · Canada · 9 of 9 requirements metCanadian law society rules (confidentiality)
CompliantEncryption, access controls, audit trails and retention controls help Canadian lawyers meet the confidentiality duty in the FLSC Model Code (rule 3.3) and law society guidance on cloud services.
Legal · Canada · 8 of 8 requirements metGDPR & UK GDPR
CompliantWe meet GDPR requirements as a processor for fax content and a controller for account data, with a Data Processing Addendum.
Privacy · 12 of 12 requirements metAuto-renewal & billing laws
CompliantRenewal terms are shown before purchase, customers consent explicitly, receive confirmations and reminders, and can cancel online.
Consumers · 3 of 3 requirements metPCI DSS
CompliantCards are processed by Stripe, a PCI DSS Level 1 provider; we complete the PCI SAQ A each year.
Payments · 2 of 2 requirements metCCPA / CPRA
CompliantCalifornia residents can access, correct and delete their data; we do not sell or share personal information.
Privacy · 5 of 5 requirements metTCPA & Junk Fax Prevention Act
CompliantEvery page carries sender identification, unsolicited advertising faxes are prohibited, and opt-out requests are honoured.
All industries · 3 of 3 requirements metProtection on every request.
The infrastructure under FaxToFax, from the network edge to card payments.
Cloudflare global network
FaxToFax runs on Cloudflare’s network, with always-on DDoS protection in front of every request.
Encrypted connections only
HTTPS everywhere. TLS 1.2 is the minimum, TLS 1.3 and HTTP/3 are preferred, and HSTS stops browsers falling back to plain HTTP.
Rate limiting
Sign-in codes, two-step codes and every API call are rate limited per connection to stop guessing and abuse.
Strict security headers
A strict Content Security Policy, frame protection, no referrer leakage, and no camera, microphone or location access.
Card payments by Stripe
Card details are typed into Stripe’s secure fields (PCI DSS Level 1). Card numbers never reach our servers.
Verified fax and payment events
Fax and payment updates are accepted only with valid signatures from our fax carrier and Stripe.
Encrypted storage
Faxes and records are stored encrypted at rest (AES-256) and deleted on your retention schedule.
Two-step verification
Authenticator-app codes for every user, and owners can require them for the whole organization.