Send your organization's questionnaire to [email protected] and we'll complete it. The answers below describe the Faxera service as of the date above.
Company and service
| Question | Answer |
|---|---|
| Vendor | Faxera, a product of Strategic Results Group, Inc., 4521 PGA Boulevard, Suite 301, Palm Beach Gardens, FL 33418 |
| Service | Online fax: send and receive by web portal, email, API and fax machine lines |
| Security contact | [email protected] |
| Will you sign a BAA? | Yes, on every plan, at signup |
| Do you use subcontractors that handle PHI? | Yes. Amazon Web Services (hosting, storage, backups, email), under a signed BAA. Telephone carriers carry fax calls in transit as a conduit |
| Is PHI ever sent offshore? | No. Data is stored and processed in the United States |
Data storage and encryption
| Question | Answer |
|---|---|
| Where is data hosted? | Amazon Web Services, US East (Northern Virginia) |
| Is data encrypted at rest? | Yes. Encrypted storage volume, plus AES-256-GCM per-file encryption with a unique key per fax |
| How are encryption keys managed? | Per-file keys are wrapped by a master key held in AWS Secrets Manager |
| Is data encrypted in transit? | Yes. TLS 1.2 or higher for web, API and email. SIP over TLS to fax adapters where firmware supports it |
| Is the fax transmission itself encrypted? | The fax call crosses the public telephone network, which is not encrypted for any fax provider |
| Is customer data separated? | Yes. Every record is tied to its company, enforced in application code and by database row-level security |
Access control
| Question | Answer |
|---|---|
| Sign-in methods | Google sign-in, or email and password |
| Multi-factor authentication | Authenticator app. Required for admins. Each company can require it for all users |
| Password storage | Hashed with argon2id |
| Session timeout | 30 minutes idle |
| Account lockout | Yes, after repeated failed sign-ins |
| Role-based access | Yes: partner admin, company admin, and user, with access limited to assigned mailboxes |
| SAML single sign-on | Not yet |
| How do Faxera staff reach production systems? | Only over a private encrypted admin network. No public SSH. Admin accounts require MFA |
Logging and monitoring
| Question | Answer |
|---|---|
| Do you keep an audit log? | Yes. Every view, download, send, admin change and sign-in, with who, when and from where |
| Can customers access the log? | Yes, in the portal. Export on Practice and Enterprise plans |
| Is the log tamper-resistant? | It is append-only and copied nightly to write-protected storage (S3 object lock) |
| Do logs contain PHI? | Application logs contain no fax content. Dialed numbers show only the last four digits |
| Do you monitor service health? | Yes. Carrier status, adapter status, fax success rates, disk and backups, with automatic alerts |
Retention, backup and recovery
| Question | Answer |
|---|---|
| Data retention | Set by each company from 30 days to 7 years. Default 1 year |
| Secure disposal | Expired faxes are deleted and their encryption keys destroyed |
| Backups | Nightly, encrypted, to Amazon S3 with versioning and object lock |
| Restore testing | Monthly |
| Recovery point | Up to 24 hours (nightly backups) |
| Data return on termination | Customers can export their faxes before the account closes. See the terms of service |
Vulnerability and change management
| Question | Answer |
|---|---|
| Patching | Operating system security updates install automatically. Fax engine and application updated monthly |
| Network protection | Carrier connections accepted only from known carrier addresses. Adapter connections rate limited with automatic blocking of scanners |
| Third-party penetration test | Not yet. No date set |
| Code changes | Version controlled, built and tested automatically before deployment |
Compliance and incident response
| Question | Answer |
|---|---|
| SOC 2 report | Not yet. No date set |
| HITRUST | Not yet. No date set |
| HIPAA risk assessment | Yes, written, kept with the security policies |
| Written security policies | Yes |
| Incident response plan | Yes, written |
| Breach notification | As set out in the BAA |