Subprocessors
Last updated: September 16, 2026
usfax.com is operated by Mobile Flow Ltd. To provide the service we rely on the third-party providers listed below. This page states what each provider does for us, where it operates, whether it can handle protected health information ("PHI") on our behalf, and the agreement that governs that handling.
This list is updated before any new subprocessor handles PHI. Customers with an executed Business Associate Agreement are notified of additions in advance. The customer-facing BAA is not yet available; the agreements marked "in progress" are being put in place ahead of its launch, and no account is covered by a BAA today.
| Subprocessor | Purpose | Location | Handles PHI | Agreement |
|---|---|---|---|---|
| Google Cloud (Firestore, Cloud Storage, Cloud Run, Identity Platform, Cloud Logging, BigQuery) | Database, encrypted document storage, PDF processing, user authentication and server logs. BigQuery holds first-party product telemetry only (pseudonymous event names; no fax numbers, document contents or free text) | United States regions | Yes — PHI at rest and in compute (telemetry in BigQuery carries no PHI) | Google Cloud Business Associate Agreement — in progress |
| Vercel | Application hosting for the dashboard and API | United States region | Yes — PHI in transit and in request processing | Vercel HIPAA Business Associate Agreement — in progress |
| Telnyx | Fax transmission over the telephone network (send and receive) | United States | Yes — fax content in transit; carrier retention disabled | Business Associate Agreement in progress |
| Amazon Web Services (SES) | Transactional email — delivery and receipt notifications only; fax content is never emailed. Being introduced as the notification sender | United States | No fax content. Notification-only metadata (masked number — area code and last four digits — page count, status, timestamp) | AWS Business Associate Agreement — in progress |
| Postmark (ActiveCampaign) | Transactional email — notification-only; the active notification sender today, being replaced by Amazon SES. Also receives inbound email-to-fax messages (documents emailed to a fax.usfax.com address) | United States | No fax content in notifications. Email-to-fax messages pass through Postmark and are excluded from BAA scope; the feature is disabled for BAA accounts | None; being phased out for notifications |
| Paddle | Merchant of record — billing, invoicing, tax and payment processing (subscriptions, seat add-ons, pay-per-fax) | United Kingdom / United States | No — billing details only, no PHI | Not applicable (no PHI) |
| Google Workspace | Our support mailbox (support@usfax.com) and the replies we send from it | United States data region for mail content; Google-managed locations for logs and indexes | Only if a customer emails PHI to support unsolicited — please do not email PHI to support | Google Workspace Business Associate Amendment — in progress |
| Microsoft Clarity, Google Analytics 4 and Vercel Web Analytics | Usage analytics on the marketing site (www.usfax.com) and the app's public pages (/, /login, /signup, /start, /onboarding). Microsoft Clarity session recordings also run inside the authenticated app; fax pages, file previews and document viewers are masked before recording, other on-screen text is not. Google Analytics and Vercel Analytics never load inside the app. Nothing loads for BAA accounts once the BAA program is live | United States | No fax or file content (previews masked). On-screen account text may be recorded; no BAA account is recorded | Not applicable (no PHI) |
| Mobile Flow Ltd | Operator of usfax.com; engineering, operations and support. Access to production systems is under logged, least-privilege controls | Israel (personnel). PHI is stored and processed only in the United States | Yes — operational access only, under access logging | Operator (will be the party to your BAA) |
Notes
- "In progress" means the agreement has been requested but not yet executed. Until it is, that provider's handling of PHI is not covered by a Business Associate Agreement.
- Email notifications never include fax content or attachments. They carry status, page count, time, a masked sending or receiving number (area code and last four digits) and a link to the fax in your account.
- Analytics scripts run on public marketing pages and the app's sign-in and sign-up pages only, and are not loaded on the authenticated application.
- Fax recipients, the telephone carriers between our carrier and the other party's fax line, the carrier a number is ported from, and your own systems that call our API are not subprocessors.
- PHI is stored and processed only in the United States. Personnel outside the United States access production systems solely for operation, support and engineering, under logged, least-privilege controls.
Questions
Contact support@usfax.com with questions about a provider on this list. See also our Privacy Policy and Security pages.