Security & Privacy.
The controls we actually run.
Encrypted in transit and at rest, optional two-factor authentication, strict session rules, an exportable audit log, US data storage, and a plain statement of who can access what from where.
7 day free trial.
Last updated · Every control listed here restates a commitment in our Privacy Policy or Terms of Service.
Controls
| Area | Control | Detail |
|---|---|---|
| Encryption in transit | TLS 1.2 or higher | Between your browser and our servers, and between our servers and our providers. Notification emails use transport encryption where the receiving mail server supports it. |
| Encryption at rest | AES-256 | Stored fax documents and account data are encrypted at rest. Document access uses time-limited links. |
| Sign-in | Two-factor authentication (authenticator app), optional on every account | A code from your authenticator app is required on new devices once enabled. Google sign-in is supported. Under the HIPAA BAA, once it launches, two-factor authentication becomes required for every user on the account. |
| Sessions | 12-hour session limit, 30-minute idle timeout | The sign-in session cookie and its companions last up to 12 hours and expire after 30 minutes of inactivity. |
| Audit log | Every security-relevant action, exportable | Sign-ins; fax sent, viewed, downloaded or deleted; settings and team changes; API key use — with the acting user, time, IP address and browser. Account owners and admins can view and export it. Retained for a minimum of six years; personal identifiers are overwritten when an account is deleted. |
| Team access | Roles per member | Admins manage members, numbers, porting, API keys, retention and the audit log; other roles send and receive, or send only. Billing, signing the BAA and deleting the account are reserved to the owner. Invitation links expire after 14 days. |
| No fax content in email | Notification emails carry a link to the fax, never the document, a preview or an attachment. Inbound email-to-fax attachments are processed and then discarded, not stored. | |
| Data location | United States | Customer documents are stored only in the United States (Google Cloud, us-central1 region). |
| Staff access | From Israel, logged, least-privilege | Mobile Flow Ltd is an Israeli company. Engineering, operations and support staff are located in Israel and access production systems from there only to operate, support and secure the service, under logged, least-privilege controls. |
| Retention | You set it | Documents: 7, 30, 60 or 90 days, or unlimited. Fax history: 12 months by default, or 24, 36 or 72 months. Individual faxes can be deleted at any time; account deletion completes within 30 days, with recovery copies purged within 7 days. |
| Analytics | Public pages and sign-in only, plus masked session recordings in-app | Google Analytics and Vercel Analytics never load inside the application. Microsoft Clarity recordings inside the app mask fax pages, previews and document viewers. No analytics script will load for accounts covered by a BAA once that program is live. |
| Payments | Paddle as merchant of record | Card details are entered on Paddle's checkout and are not stored by usfax.com. |
What we do not claim
Fax security pages tend to over-promise. These are the limits, stated plainly.
- We do not claim end-to-end encryption. The portion of every fax carried over the public telephone network to or from the other party's fax machine is not encrypted — that is true of every fax service.
- We do not publish an uptime figure or an SLA.
- usfax.com has not completed a SOC 2 audit and does not claim one.
- No HIPAA Business Associate Agreement is in force for any account today. A BAA is coming free to every paid plan and will be signed by you in Settings → HIPAA BAA; until then your account is not covered by a BAA and must not be used for protected health information. No vendor can make you compliant with HIPAA; usfax.com is built to support a HIPAA program, not to replace one.
HIPAA-ready, on every paid plan
A HIPAA Business Associate Agreement (BAA) is coming free to every paid plan. You will sign it yourself in Settings → HIPAA BAA. Until you have signed it, your account is not covered by a BAA and is not configured for protected health information (PHI). Signing it will turn on stricter defaults for that account: two-factor authentication required for every user, no fax content in email, a full audit log of every send, receive, view and download, and short-lived document links.
Privacy in one paragraph
We collect what is needed to run the service: account details, the faxes you send and receive, fax metadata, product telemetry under pseudonymous keys, and the audit log. We do not sell, rent or share your personal information or fax content with third parties for marketing. Retention is under your control in Settings → Storage, and the account owner can delete the account at any time. Questions: support@usfax.com.
Frequently asked questions
Data is encrypted in transit (TLS 1.2 or higher) and at rest (AES-256). The last leg of a fax — the telephone call to or from the other party's fax machine — is not encrypted, as with every fax service, so we do not describe faxing as end-to-end encrypted.
Yes. Two-factor authentication with an authenticator app is available on every account and is optional today. When the HIPAA BAA launches, signing it makes two-factor authentication required for every user on that account.
Customer documents are stored only in the United States, in Google Cloud's us-central1 region. Mobile Flow Ltd's engineering, operations and support staff are in Israel and access production systems from there only to operate, support and secure the service, under logged, least-privilege controls.
Yes. Sign-ins, faxes sent, viewed, downloaded or deleted, settings and team changes, and API key use are recorded with the acting user, time, IP address and browser. Owners and admins can view and export the log; it is retained for at least six years.
No SOC 2 audit has been completed, and we do not market usfax.com as certified under HIPAA — HIPAA does not certify vendors, and no vendor can make you compliant. What we publish is the list of controls on this page and the Privacy Policy behind it. A HIPAA BAA is coming free to every paid plan; until you have signed it, do not send protected health information through the service.
Start Faxing Today — Free Trial
Ditch the fax machine. No credit card required, 7-day free trial.
Where these controls are set out
Facts about carriers, regulators and competitors on this page come from the documents below, read on the dates shown. Carrier rules change; when a detail matters for your line, check with your carrier.
- usfax.com Privacy Policy (security measures, staff access, retention) — usfax.com, accessed September 21, 2026.
- usfax.com Terms of Service (cancellation, refunds, porting) — usfax.com, accessed September 21, 2026.