Faximus Acceptable Use Policy

Version: 2026.10.27-r1

This Acceptable Use Policy (AUP) applies to every use of the Faximus Services. It is part of the Faximus Terms of Service.

Customer is responsible for the actions of its administrators, users, developers, contractors, systems, and anyone else who uses the Services through Customer's account or credentials.

1. Use the Services lawfully

You may use the Services only for lawful purposes and in compliance with the laws that apply to you, the content, the recipient, and the place from which and to which a fax is sent. Relevant laws may include telecommunications, advertising, privacy, health information, consumer protection, intellectual property, records, licensing, sanctions, and export-control laws.

Faximus does not approve a use merely because the product technically allows it. You are responsible for obtaining legal advice about your use case.

2. Rules for outbound fax communications

2.1 You control the communication

As between you and Faximus, you are responsible for the message, recipient, number, purpose, timing, sender identity, and legal basis for each outbound fax. Faximus transmits the fax at your direction. This contractual allocation does not change any independent rights or remedies a recipient, regulator, or other third party may have.

2.2 Consent and other legal basis

Do not send a fax unless you have a lawful basis to send it. Depending on the communication and jurisdiction, that basis may be prior express invitation or permission, an established business relationship meeting all legal conditions, a transactional or operational purpose, a legally permitted healthcare purpose, an emergency purpose, or another basis recognized by law.

When the Services ask for a consent basis, campaign type, or related attestation, you must provide complete and accurate information. Do not select a transactional, emergency, healthcare, or other category merely to bypass marketing or abuse controls.

You must keep records reasonably sufficient to prove the legal basis for a communication. For promotional or advertising faxes, keep the records for at least five years after the last fax relying on them, unless a longer period is required by law or your own policy.

2.3 Promotional and advertising faxes

You may not use Faximus for unsolicited bulk advertising or a high-volume promotional campaign without Faximus's prior written approval.

Any advertising or promotional fax must:

• comply with the Telephone Consumer Protection Act, Junk Fax Prevention Act, 47 U.S.C. 227, 47 C.F.R. 64.1200, and applicable state and foreign law;
• be sent only to recipients for whom you have a legally sufficient basis;
• include all notices and sender information required by law;
• include a clear and conspicuous, cost-free way to opt out, even when Faximus contractually requires that notice as a stricter rule than the minimum law may require in a particular circumstance;
• identify the person or business on whose behalf the fax is sent; and
• avoid false, deceptive, or misleading statements.

You may not buy, scrape, harvest, rent, or use a fax list unless you can document that each number was obtained and may be used lawfully for the intended communication.

2.4 Sender identification

Every outbound fax must clearly show the date and time sent, the identity of the sender, and a telephone number for the sending machine or sender, as required by 47 U.S.C. 227(d) and applicable regulations.

If Faximus provides a cover sheet or header, you must keep your account information accurate and must not remove required compliance text. If you upload your own cover sheet or document, you remain responsible for compliance.

2.5 Opt-outs and suppression lists

You must provide and monitor every opt-out channel stated in your fax. You must add a valid opt-out request to your suppression list promptly and no later than 10 business days after receipt, or sooner if law requires. Do not send another promotional fax to that recipient unless the recipient later gives new permission that legally overrides the opt-out.

You are responsible for opt-outs received outside Faximus, including by telephone, email, mail, another fax number, a sales representative, or a third-party platform. Upload or synchronize those requests before sending.

You may not remove, hide, bypass, or work around a Faximus suppression, block, destination restriction, or abuse control.

2.6 Recipient and number accuracy

Use reasonable procedures to verify fax numbers and recipients before sending. Do not rely on stale directories or unverified data for sensitive content. A wrong-number fax can create privacy, contractual, professional, and regulatory consequences even when the platform functions correctly. Customer is responsible for the destination it submits. An attempt to an invalid number, non-fax destination, busy or unanswered line, or incompatible recipient device may still create billable usage under the Terms of Sale and Fax Delivery Disclaimer.

3. Rules for inbound fax use

You may not obtain or configure a fax number to impersonate another person, intercept communications you are not authorized to receive, mislead senders about the recipient, or collect personal information through deception.

You must notify senders of any privacy notice, consent term, or special handling instruction that law requires for your inbound workflow. You are responsible for users who can access the inbox and for promptly removing access when it is no longer needed.

4. Healthcare and sensitive data

4.1 Protected Health Information

PHI is prohibited unless:

• the plan is BAA-eligible;
• Customer and Faximus have signed a Business Associate Agreement;
• Faximus has confirmed that the specific account or tenant is HIPAA-enabled; and
• Customer follows the BAA and required configuration.

PHI is always prohibited on free, trial, sandbox, test, and non-BAA accounts.

4.2 Minimum necessary and correct recipient

When sending PHI, you must apply the HIPAA minimum-necessary standard when it applies, verify the recipient and fax number, use a suitable cover sheet, restrict access, and follow your organization's privacy and security procedures. Faximus cannot determine whether the document contains only the minimum necessary information.

4.3 Other highly regulated data

Do not use the Services for records governed by 42 C.F.R. Part 2, classified information, export-controlled technical data, biometric templates, authentication secrets, or full payment-card data unless Faximus has expressly agreed in writing to that use and the account is configured for it.

Never place PHI or other sensitive content in a URL, query string, API key label, idempotency key, filename visible to an unintended recipient, webhook destination, log field, or support ticket unless the field is expressly designed for that information.

5. Prohibited content and activity

You may not use the Services to create, send, receive, store, facilitate, or promote:

5.1 Illegal or fraudulent activity

• fraud, identity theft, forgery, extortion, money laundering, trafficking, sanctions evasion, or other illegal activity;
• false government, court, law-enforcement, healthcare, financial, or business documents;
• attempts to obtain passwords, payment credentials, health information, or other data by deception;
• unlicensed activity where a license is legally required; or
• instructions or content designed to evade a court order, regulator, carrier rule, or legal restriction.

5.2 Harm, harassment, and exploitation

• threats, stalking, targeted harassment, doxxing, extortion, or incitement of violence;
• content that unlawfully discriminates against or attacks a person based on a protected characteristic;
• child sexual abuse material, sexual exploitation, or content that facilitates abuse of a minor;
• non-consensual intimate imagery; or
• content intended to cause physical harm or deprive a person of lawful access to care, safety, or property.

5.3 Privacy and confidentiality violations

• personal, health, financial, education, employment, or other confidential information without a lawful basis;
• material obtained through unauthorized access, surveillance, or interception;
• information subject to a protective order, professional duty, or contract when you are not authorized to transmit it; or
• mass data collection or enrichment unrelated to a legitimate Faximus workflow.

5.4 Malware and system abuse

• malware, ransomware, spyware, destructive code, exploit payloads, or files intended to compromise a recipient or the Services;
• vulnerability scanning, penetration testing, or security research against Faximus without written authorization from security@faximus.io;
• denial-of-service activity, resource exhaustion, intentionally malformed files, or traffic designed to degrade service;
• automated account creation, credential stuffing, scraping, or use of undocumented interfaces;
• bypassing limits, metering, payment, authentication, tenant boundaries, or access controls; or
• accessing another customer's account, data, number, or credentials without authorization.

5.5 Intellectual-property and identity violations

• content that infringes copyright, trademark, patent, trade secret, publicity, or privacy rights;
• impersonation of a person or organization;
• false or misleading sender identification; or
• use of Faximus trademarks or branding in a way that suggests sponsorship or endorsement without permission.

5.6 Regulated goods and services

You may not use the Services to advertise, sell, prescribe, arrange, or facilitate regulated goods or services in violation of law. This includes controlled substances, gambling, firearms, financial products, healthcare services, insurance, debt relief, political communications, and age-restricted products. You must hold every required license, registration, authorization, and consent.

6. No life-safety or emergency dependency

Do not use Faximus as the only channel for:

• emergency services or 911 communications;
• urgent diagnosis, treatment, prescription, or clinical instructions;
• critical infrastructure commands;
• court, filing, tender, or regulatory deadlines;
• safety recalls or evacuation notices; or
• any situation where delay, failure, duplication, misdelivery, or illegibility could cause serious harm.

Use an independently verified backup channel and confirm receipt for critical communications.

7. Free, trial, sandbox, and test accounts

Unless Faximus states otherwise in writing, a free, trial, sandbox, or test account:

• is for evaluation, development, integration testing, and low-volume non-production use;
• may have restricted destinations, pages, numbers, file sizes, API rates, webhook delivery, storage, and support;
• may not be used for PHI or other regulated production data;
• may not be resold or used to provide a production service to third parties; and
• may be suspended or removed at any time.

Do not use real personal data in a sandbox when synthetic or de-identified data will work.

8. Account, API, and webhook security

You must:

• use unique accounts and credentials;
• enable multi-factor authentication where available and appropriate;
• keep API keys and webhook secrets out of public or client-side code;
• use least-privilege access;
• rotate secrets after suspected exposure;
• use HTTPS for webhook endpoints and supported secure transport for integrations;
• validate inputs and documents received through your systems;
• process webhook events idempotently; and
• notify Faximus promptly of a suspected compromise.

You may not share one account among unrelated organizations or use one tenant to conceal the identity or activity of another party.

9. Resale and third-party use

You may not resell, white-label, sublicense, broker, or embed the Services for use by unrelated third parties unless Faximus has approved the arrangement in writing. Approved resellers and platforms remain responsible for their users and must provide terms at least as protective of Faximus, recipients, and data subjects as this AUP.

10. Investigations and enforcement

10.1 Investigation

Faximus may review account information, transmission metadata, status records, consent attestations, suppression lists, usage patterns, and security events to investigate suspected violations. Faximus may review fax content only when reasonably necessary and permitted under the Agreement, such as to respond to a support request, investigate a credible abuse report, address imminent harm, respond to a security incident, or comply with legal process.

10.2 Actions

Depending on the risk and history, Faximus may warn, require information, impose limits, reject traffic, block a destination, quarantine a file, suspend a credential or number, suspend the account, remove content, or terminate the Agreement. Faximus may act immediately when needed to protect people, networks, carriers, data, or the Services.

Faximus may preserve and disclose information when required by law or reasonably necessary to investigate fraud, abuse, threats, or security incidents.

10.3 Appeal

Unless prohibited by law or urgent risk, Customer may appeal an enforcement action by emailing report-abuse@faximus.io with the account name, relevant job or event identifiers, and a clear explanation. An appeal does not automatically pause the action.

11. Reporting abuse

Report suspected abuse, unwanted faxes, or AUP violations to report-abuse@faximus.io. Include the received fax, date and time, sending number if available, and any transmission identifier. Do not send unnecessary sensitive information in the report.

Security vulnerabilities should be reported privately to security@faximus.io, not publicly disclosed before Faximus has a reasonable opportunity to investigate and remediate them.

12. Changes

Faximus may update this AUP under the change process in the Terms of Service. We may make an immediate change when reasonably necessary to address law, security, carrier requirements, or abuse.