Security

• Documents are kept in private storage. There are no public links to them.
• When you download a fax, we create a link that works for a minute, only after checking that the fax is yours.
• Our fax provider gets a link to the document it has to send, which stops working after an hour.
• We delete the documents of each fax, sent or received, 30 days after it finishes.
• Our logs never contain the content of your documents.

• You sign in with Google or with your email and a password.
• A fax sent without signing in opens only with its private link, which we email to the address given, or in the browser that sent it. The link opens that one fax and nothing else.
• We don't store passwords. Our sign-in provider keeps only a one-way hash (bcrypt), so a password can't be read back.
• Passwords need at least 10 characters. After too many attempts for one email address or from one network, password sign-in pauses for up to an hour.
• A new account with a password works only after its email address is confirmed, so no one can open an account with your email.
• The database only returns an account's own faxes, numbers and invoices to that account.
• Our support team can open a document only after writing down why. Each time, we record who opened it and when.

• The website and the app use encrypted connections (HTTPS), and our database accepts nothing else.
• We check the signature of every message our payment, fax and email providers send us before acting on it.
• You pay on Stripe's checkout page. Your card number never goes through our servers.

• Fax isn't end-to-end encrypted. After our provider sends it, your fax travels over the telephone network, like any fax, and the receiving machine prints or stores it.
• If you turn on PDF attachments for received faxes, the document sits in your email inbox, outside our control.
• Faxies doesn't offer HIPAA compliance, and we don't sign business associate agreements (BAAs).

If you find a security issue, write to support@faxies.com. Please don't access other people's data while testing. Read our Privacy policy for what we collect and when we delete it.