The short version. Every fax is stored in the United States on Amazon Web Services under a signed BAA, encrypted with its own key, visible only to the people you allow, and recorded in an audit log. Fax content never goes to our billing provider, our sign-in provider, or our website host.
Where your data lives
Faxera runs on dedicated infrastructure in Amazon Web Services, US East (Northern Virginia). AWS has signed a Business Associate Agreement with us, and every AWS service that touches fax content is one AWS lists as HIPAA eligible.
| What | Where | Notes |
|---|---|---|
| Faxes, accounts, audit log | Dedicated Faxera server on AWS, US East | Encrypted storage volume |
| Backups | Amazon S3, US East | Encrypted, versioned, write-protected (object lock) |
| Fax-to-email delivery | Amazon Simple Email Service | Secure links by default for HIPAA accounts |
| faxera.com website | Cloudflare | Marketing pages only. Holds no fax data |
Encryption
- At rest: the storage volume is encrypted, and each fax file is encrypted again with its own AES-256-GCM key. Those keys are wrapped by a master key held in AWS Secrets Manager, never on disk next to the files.
- In transit: TLS 1.2 or higher on every web, API and email connection. Fax machine adapters use encrypted SIP (TLS) where their firmware supports it.
- The phone network: the fax call itself travels over the public telephone network, as every fax does. Carriers handle the call as a conduit and do not store it.
Who can see a fax
- Roles. Users see only the mailboxes they are assigned to. Company admins manage their own company. Partners manage only their own clients.
- Tenant isolation. Every record carries its company, every query filters on it, and the database enforces row-level security as a second lock.
- Sign-in. Google sign-in or email and password. Passwords are hashed with argon2id. Multi-factor authentication with an authenticator app is required for admins and can be required for every user.
- Sessions end after 30 minutes idle. Repeated failed sign-ins lock the account.
- Faxera staff access to the servers is limited to a private, encrypted admin network. There is no public SSH.
Delivery that keeps records protected
- Secure links. HIPAA accounts deliver new faxes by email as a secure link that requires sign-in. Sending the fax itself as an email attachment is an explicit choice by a company admin, and the choice is recorded in the audit log.
- Email to fax accepts mail only from sender addresses you approve, and only when the message passes SPF or DKIM checks.
- Retries. Busy lines and failed handshakes are retried on a fixed schedule, then reported to the sender in plain words.
Audit log
Every view, download, send, admin change and sign-in is recorded: who, what, when and from where. The log is append-only and copied nightly to write-protected storage. Admins on Practice and Enterprise plans can export it.
Retention and deletion
Each company sets how long faxes are kept, from 30 days to 7 years. The default is 1 year. When a fax expires, the file is deleted and its encryption key is destroyed, so any copy left in a backup can no longer be read.
Backups and recovery
The database and fax store are backed up every night, encrypted, to Amazon S3 under object lock. Restores are tested every month.
Operations
- Security updates install automatically. The fax engine and application are updated monthly.
- The carrier connection accepts calls only from known carrier addresses. The adapter connection is rate limited and blocks scanning automatically.
- Application logs never contain fax content. Dialed numbers in logs show only the last four digits.
- Faxera keeps a written risk assessment, security policies and an incident response plan.
Service providers
| Provider | What they do | Fax content? |
|---|---|---|
| Amazon Web Services | Hosting, storage, backups, email delivery | Yes, under a signed BAA |
| Telephone carriers | Carry fax calls on the phone network | In transit only, as a conduit |
| Stripe | Billing and payments | No. Names, emails and page counts only |
| Sign-in, if you choose it | No | |
| Cloudflare | DNS and the faxera.com website | No |
Your Business Associate Agreement
Faxera signs a BAA with every customer on every plan, at signup. Partners sign a BAA with Faxera and provide one to their own clients, using a template we supply. If there is a breach of unsecured protected health information, we notify you as the BAA requires.
What we don't have yet
We would rather tell you than have you find out. Faxera does not yet have a SOC 2 report, HITRUST certification or a third-party penetration test. No dates are set. If your vendor review requires one of these today, tell us. We'll be straight about whether we can meet your timeline.
Questions
Email [email protected]. For a pre-filled vendor questionnaire, see the security questionnaire.