Faximus Data Retention and Deletion Schedule
Version: 2026.10.27-r1
This schedule describes the default periods Faximus uses for Customer Content, account data, operational records, and related information. It is part of the Faximus Terms of Service, Privacy and Cookie Policy, Data Processing Addendum, and, where applicable, Business Associate Agreement.
A signed order form, legal hold, Customer-configured setting, or law may require a different period. Where a plan does not support a listed option, that option is not available merely because it appears here.
1. Retention principles
Faximus follows these principles:
- retain data only as long as reasonably needed for the Service, Customer instruction, security, billing, legal compliance, or legal claims;
- give Customer control over fax-document retention where the plan supports it;
- keep operational and security records separate from fax content where practical;
- avoid PHI and document content in ordinary logs;
- delete live data after the applicable period once automated deletion for that category is in place, or on request;
- allow encrypted backup copies to expire on their normal rotation rather than restoring a backup solely to delete one record;
- restrict residual or legally retained data from ordinary use; and
- preserve data when a valid legal hold, subpoena, security investigation, or regulatory duty requires it.
2. Retention schedule
Faximus applies the retention periods below to stored fax documents and works to delete content when its period ends. Deletion timing may vary, and backups follow their own rotation.
| Data category | Default retention | Other available or required period | End-of-period treatment |
|---|---|---|---|
| Free, trial, sandbox, or test fax documents | 7 days after receipt or final job status | A shorter period may apply to a particular test environment | Targeted for deletion from live document storage; backups expire on rotation |
| Paid outbound and inbound fax documents | 90 days after receipt or final job status | Where supported: 7, 30, or 90 days; an order form may specify another period | Targeted for deletion from live document storage; metadata may remain separately |
| Customers with a signed order form or BAA: fax documents | 90 days unless the signed order form or BAA states another period | Only as stated in a signed order form or BAA. Not self-serve. | Targeted for deletion from live storage after the applicable period, subject to the BAA and legal hold |
| Fax transmission metadata and status history | 12 months after final status | Only as stated in a signed order form or BAA. | Document content is not retained merely because metadata remains |
| Detailed attempt and carrier diagnostic records | 90 days after final status | Up to 12 months for security, quality, fraud, dispute, or carrier investigation | Deleted or aggregated; limited billing and audit facts may remain |
| Webhook events, payloads, and delivery-attempt history | 30 days after event | A shorter period may apply to high-volume plans; longer only by order or legal hold | Deleted from active event history; aggregate delivery metrics may remain |
| API request and application diagnostic logs | 90 days | Up to 12 months for security, abuse, reliability, or contract investigation | Deleted, aggregated, or de-identified |
| Authentication, administrator, document-access, and security audit logs | Up to 12 months where collected | Only as stated in a signed order form or BAA. | Deleted or archived with restricted access |
| Customer account, user, role, and configuration data | Account term plus 30 days | Longer for unresolved billing, security, legal hold, or required audit records | Deleted or de-identified; limited contract records remain |
| API keys and secrets | Until revoked, rotated, or account termination | Compromise records may be kept in security logs | Secret disabled and deleted; non-secret audit evidence may remain |
| Billing, invoices, payment status, tax, and accounting records | 7 years after the transaction or fiscal period | Longer if tax, audit, litigation, or law requires | Securely deleted or archived at end of obligation |
| Full payment-card or bank credentials | Retained by the payment processor under its policy, not by Faximus as ordinary practice | As required by payment networks and law | Managed by the processor |
| Support tickets and business communications | 3 years after closure | Longer for an active dispute, security incident, contract, or legal obligation | Deleted or de-identified; reusable knowledge is stripped of Customer identifiers |
| Consent attestations, suppression lists, and opt-out evidence | Account term plus 5 years after the last relevant communication or opt-out | Longer if law, complaint, or legal hold requires | Deleted or de-identified after the proof period |
| Privacy requests and verification records | 3 years after closure | Longer if a complaint, appeal, or law requires | Deleted or reduced to non-identifying compliance statistics |
| Security-incident and breach records | 7 years after closure | Longer if law, insurance, litigation, or regulatory order requires | Restricted archive, then secure deletion |
| BAA, DPA, Terms acceptance, recurring-subscription consent, cancellation confirmation, order forms, and contract records | Agreement term plus 7 years | Longer if legal claims or law require | Secure deletion or permanent corporate archive where legally appropriate |
| Website server and edge-security logs | 30 to 90 days | Up to 12 months for security investigation | Deleted or aggregated |
| Cookie consent and preference records | 12 months after the choice or as needed to prove consent | Refreshed when law or configuration requires a new choice | Replaced or deleted |
| Recruiting data for unsuccessful candidates | 2 years after the process ends | Shorter on request where allowed; longer with consent or legal hold | Deleted or de-identified |
| Encrypted backups | Rolling backup cycle, ordinarily no more than 90 days after live deletion | A legal hold or disaster-recovery event may extend isolation | Expired automatically or deleted on the backup rotation |
3. How the fax-document period is measured
For an outbound fax, the retention clock normally begins when the job reaches a final status such as Delivered, Failed, or Canceled. For an inbound fax, it normally begins when Faximus completes receipt and associates the document with Customer's account.
Changing a retention setting normally applies prospectively and may also shorten the remaining period for existing documents. Faximus may require confirmation before applying a change that will delete existing documents sooner.
4. Customer responsibilities
Customer must:
- select a retention period appropriate to its legal, professional, clinical, contractual, and business duties;
- export documents before they expire or before a downgrade or termination;
- maintain an independent system of record where required;
- place a legal hold promptly when needed;
- avoid using Faximus as the only copy of a record that must be preserved; and
- ensure that downstream recipients, integrations, email systems, and webhook endpoints apply appropriate retention.
Faximus does not decide how long a medical, legal, financial, employment, education, or other business record must be retained.
5. Deletion methods
Depending on the system, deletion may occur through object lifecycle expiration, database deletion, cryptographic erasure, secure overwrite by the cloud provider, credential revocation, or expiration of an encrypted backup.
When data is deleted from the live Service, it may remain for a limited time in:
- encrypted backups;
- immutable security or audit records;
- carrier or payment-provider records controlled by those providers;
- legal-hold repositories; or
- records that law requires Faximus to keep.
Residual data remains protected and is not returned to ordinary production use.
6. Account termination
After account termination, Customer should request or complete an available export within 30 days. Faximus may suspend access immediately for security or abuse, but will use reasonable efforts to support a lawful export that does not create further risk.
After the export window, Faximus applies the applicable content period and this schedule to Customer Content and works to delete it when that period ends; deletion timing may vary. Fax-number release and carrier records may follow a different operational or legal timeline.
7. Deletion and privacy requests
A verified deletion request is subject to exceptions for:
- providing a Service the person or Customer still requests;
- security, fraud, debugging, and abuse prevention;
- billing, tax, and accounting;
- legal claims, subpoenas, or regulatory duties;
- opt-out and suppression evidence;
- data controlled by a Faximus Customer; and
- data that cannot reasonably be isolated from an encrypted backup before normal rotation.
Where Faximus is Customer's Processor, Customer gives the deletion instruction and Faximus assists under the DPA.
8. Legal holds
Faximus may suspend deletion for a documented legal hold, preservation request, subpoena, investigation, insurance matter, or dispute. Access will be restricted to people with a need to know. When the hold ends, the ordinary deletion schedule resumes.
Customer must send a preservation request to legal@faximus.io with enough information to identify the account and data. A request does not require Faximus to preserve data that was already deleted before receipt.
9. De-identified and aggregate information
Faximus may retain de-identified or aggregated operational statistics without a fixed period if they cannot reasonably be linked to an individual or Customer document. Faximus will not attempt to re-identify data maintained as de-identified except to test the process or as permitted by law.
10. Changes
Faximus may update this schedule prospectively under the Terms of Service. We will not materially shorten the active retention commitment of a paid order during its current term without notice, except where required by law, security, Customer instruction, or an urgent provider limitation.
11. Contact
Retention and export questions: support@faximus.io
Privacy deletion requests: privacy@faximus.io
Legal holds: legal@faximus.io