Security at Faximus

Version: 2026.10.27-r1
Public URL: https://faximus.io/legal/security

Faximus is cloud fax infrastructure run by Faximus LLC, a South Carolina limited liability company. This page is an overview of how we protect the Services. It is not a certification, SOC 2 report, HITRUST assessment, or a HIPAA-compliance claim, and it does not add contractual commitments. Binding security terms live in the Terms of Service, Privacy and Cookie Policy, Data Processing Addendum, and, when signed and enabled, a Business Associate Agreement.

What we protect

Customer accounts, credentials, and billing data
Fax documents and transmission metadata while they are in the Services
Administrative, security, and operational logs

Ordinary fax transport can traverse public or carrier telephone networks. It is not end-to-end encrypted between Faximus and the recipient's fax device. Telephone carriers that carry fax calls keep their own call records, such as fax numbers and call times, under their own terms. You decide whether fax is the right channel for a given document.

Controls we maintain

These summarize the technical and organizational measures in the DPA (Annex 2), which remain the binding terms. They apply as appropriate to the system, environment, plan, and risk:

Encryption in transit (TLS) for the web portal and API, and encryption at rest for stored fax documents and production databases
Unique identities and role-based access, with administrative access limited to a small number of named staff; optional authenticator-app (TOTP) two-step verification is available for portal user accounts
Tenant separation in the application, and production run in a dedicated cloud account separated from ordinary development access
Secrets in managed secret storage, not source code
Restricted administrative access, with application services running in private cloud networks (the telephony gateway accepts carrier traffic from the internet)
Application and operational logging, with controls designed to keep PHI and document content out of ordinary logs
Change management with code review, signed commits for application code, and controlled releases
Backups and recovery procedures appropriate to the production data stores
Subprocessor list maintained and reviewed when providers change
Security contact (security@faximus.io), emergency access controls, and incident escalation

We review and improve these controls over time. This overview describes our practices as of the version shown above; it does not describe planned work.

Production infrastructure is hosted in professional cloud data centers operated by authorized providers, currently including AWS. Faximus staff do not have direct physical access to that hardware.

A current list of subprocessors is at faximus.io/legal/subprocessors.

HIPAA

HIPAA-regulated use is account-specific. A BAA is available on request after review. It is effective only when both parties sign it and Faximus confirms in writing that the identified account is HIPAA-enabled. Free, sandbox, trial, and non-BAA accounts must not be used for PHI.

Request a BAA at compliance@faximus.io.

Report a vulnerability or incident

Email security@faximus.io promptly if you suspect an incident involving Faximus, or if you have found a security issue in the Services. Include enough detail to reproduce or investigate. Do not attach PHI or live customer fax content unless we ask for it through a secure channel.

Contact