Security
Every document treated as sensitive.
Faxes carry medical, legal, and financial documents. FaxDev applies the same controls to every account, whatever it sends.
What we do
Encryption in transit and at rest
The web app and API are HTTPS only. Stored documents are encrypted at rest, as are database volumes and backups.
Audited document reads
Every view or download of a fax document, by a customer, an API key, an AI agent, or our own staff, is written to an audit log. Staff access to a customer account requires a stated reason and is audited.
Retention per account
Each account chooses how long documents are kept: 90 days by default, from 30 days up to seven years. A legal hold suspends deletion. After that the document content is deleted; the billing record remains.
Tenant isolation
Every query is scoped to the caller's account, and automated tests check on every change that one customer cannot read another's faxes, numbers, contacts, keys, or invoices.
Scoped, revocable API keys
Keys carry only the scopes you grant, can be revoked at any time, and are stored as peppered hashes, never in plain text.
No document URLs in the open
Document links require your credential and redirect to a download URL that expires in five minutes. Webhooks never carry document bytes.
Signed webhooks
Every delivery is HMAC-SHA256 signed with a per-endpoint secret you can rotate. See the developer guide.
No secrets or documents in logs
Logs exclude document content, credentials, and signed URLs.
What we do not claim
Stated plainly, so you can decide before you send anything.
FaxDev does not claim HIPAA, HITRUST, or SOC 2 certification. If you handle protected health information, the HIPAA add-on includes a business associate agreement (BAA) and enforces safeguards that support HIPAA compliance: two-step sign-in, link-only notifications, a six-year audit trail, and longer retention. Turn it on, and accept the BAA, before sending protected health information.
Fax transmission itself is not encrypted: once a fax leaves our network, it travels over public networks to the receiving fax machine like any other fax. Our protections cover the documents we store and the systems that handle them.
This website
This marketing site sets no cookies, runs no analytics or advertising trackers, and loads no third-party scripts or fonts. Pricing is fetched from our own API.
To report a security issue, contact us. Please do not include customer documents in the report.