Subprocessors
Last updated: September 8, 2026
usfax.com is operated by Mobile Flow Ltd. To provide the service we rely on the third-party providers listed below. This page states what each provider does for us, where it operates, whether it can handle protected health information ("PHI") on our behalf, and the agreement that governs that handling.
This list is updated before any new subprocessor handles PHI. Customers with an executed Business Associate Agreement are notified of additions in advance.
| Subprocessor | Purpose | Location | Handles PHI | Agreement |
|---|---|---|---|---|
| Google Cloud (Firestore, Cloud Storage, Cloud Run, Identity Platform) | Database, encrypted document storage, PDF processing and user authentication | United States regions | Yes — PHI at rest and in compute | Google Cloud Business Associate Agreement |
| Vercel | Application hosting for the dashboard and API | United States region | Yes — PHI in transit and in request processing | Vercel HIPAA Business Associate Agreement |
| Telnyx | Fax transmission over the telephone network (send and receive) | United States | Yes — fax content in transit; carrier retention disabled | Business Associate Agreement in progress |
| Amazon Web Services (SES) | Transactional email — delivery and receipt notifications only; fax content is never emailed | United States | No fax content. Notification-only metadata (sender or recipient number, page count, status) | AWS Business Associate Agreement — in progress |
| Postmark | Transactional email — notification-only; being replaced by Amazon SES | United States | No fax content. Notification-only metadata | None; being phased out |
| Paddle | Billing, invoicing and payment processing | United Kingdom / United States | No — billing details only, no PHI | Not applicable (no PHI) |
| Microsoft Clarity and Google Analytics | Usage analytics on the marketing site and public pages only. Never loaded on the authenticated dashboard | United States | No — never present where PHI is handled | Not applicable (no PHI) |
| Mobile Flow Ltd | Operator of usfax.com; engineering, operations and support. Access to production systems is under logged, least-privilege controls | Israel (personnel). PHI is stored and processed only in the United States | Yes — operational access only, under access logging | Operator (party to your BAA) |
Notes
- "In progress" means the agreement has been requested but not yet executed. Until it is, that provider's handling of PHI is not covered by a Business Associate Agreement.
- Email notifications never include fax content. They carry status, page count and the sending or receiving number only.
- Analytics scripts run on public marketing pages only and are not loaded on the authenticated application.
- PHI is stored and processed only in the United States. Personnel outside the United States access production systems solely for operation, support and engineering, under logged, least-privilege controls.
Questions
Contact privacy@usfax.com with questions about a provider on this list. See also our Privacy Policy and Security pages.