HIPAA and security
Every Faxera account, from the $14.99 Solo plan up, gets the same BAA and the same security controls. Here is exactly what we do, what you do, and what we don't have yet.
No sales call and no upgrade. You accept it online when you create your account, and download a signed copy anytime.
Buying direct
Faxera signs with you. Our hosting provider signs with us. Every party that touches a fax is covered.
Buying through your IT provider
Your provider signs with you using our template. We sign with them. The chain stays unbroken.
| Safeguard | What Faxera does |
|---|---|
| Encryption at rest | Each fax file is encrypted with its own AES-256 key, on an encrypted volume. Keys are held in a separate key store. |
| Encryption in transit | TLS 1.2 or higher for the portal, API and email. Encrypted signaling to fax machine adapters where the device supports it. |
| Delivery by secure link | Incoming faxes reach email as a link that requires sign-in. Attachments are off unless an admin turns them on, and that choice is logged. |
| Access control | Roles for admins and users, mailboxes by department, multi-factor sign-in, automatic sign-out after 30 idle minutes. |
| Audit log | Every view, download, send, sign-in and setting change, with who, when and from where. Kept in tamper-resistant storage. |
| Retention and disposal | You set how long faxes are kept, from 30 days to 7 years. When time is up, the fax and its key are destroyed. |
| Backups | Encrypted nightly, with a restore tested every month. |
| No fax content leaves the platform | Billing and sign-in providers never see fax content. Our logs never store fax images or full numbers. |
HIPAA is shared. Faxera secures the platform. Your office still decides:
• Who gets access, and removing people who leave
• Whether faxes go to email as attachments
• How long to keep faxes
• Sending to the right number. We can't recall a fax once delivered.
We'd rather tell you than have you find out in a vendor review.
• SOC 2 report: not yet. No date set.
• HITRUST certification: not yet. No date set.
• Third-party penetration test: not yet. No date set.
If your organization requires these today, we list who does offer them.
BAA accepted at signup. 14 days free, no credit card.
Start your free trial