Faximus Subprocessors
Version: 2026.10.27-r1
Public URL: https://faximus.io/legal/subprocessors
This page is the current customer-accessible list of subprocessors and service providers Faximus uses to operate the Services. It supplements the Privacy and Cookie Policy and Data Processing Addendum. If this page and Annex 3 of the DPA differ, this page controls for operational updates made under the DPA.
A provider may process information in the United States or another location described below. A payment processor may act as an independent controller for some payment and fraud data under its own legal obligations.
Current subprocessors
| Provider | Purpose | Typical processing location | May handle Customer Content or PHI |
|---|---|---|---|
| Amazon Web Services, Inc. | Cloud hosting, storage, databases, identity, messaging, logging, monitoring, and key management | United States | Customer Content: yes, when stored or processed in the Services. Protected health information: only for accounts with a signed BAA, and only after Faximus has the required upstream agreements in place |
| Cloudflare, Inc. | DNS and bot verification (Turnstile) only | United States and global edge locations | No Customer Content |
| Telnyx LLC | Telecommunications, SIP routing, fax transmission, numbering, and delivery metadata, when used for the relevant route or number | United States and carrier networks | Customer Content: carried in transit only. Faximus uses this carrier for SIP trunking and telephone-network connectivity, not for fax storage or recording, and treats it as a transmission conduit. The carrier keeps call detail records (fax numbers, date, time, and duration) under its own terms. Faximus does not have a Business Associate Agreement with this carrier, and a BAA with Faximus does not extend to carrier-operated networks |
| Flowroute Inc. | Telecommunications, SIP routing, fax transmission, numbering, and delivery metadata, when used for the relevant route or number | United States and carrier networks. Flowroute's terms also permit processing in the United Kingdom, the European Union, and other countries | Customer Content: carried in transit only. Faximus uses this carrier for SIP trunking and telephone-network connectivity, not for fax storage or recording, and treats it as a transmission conduit. The carrier keeps call detail records (fax numbers, date, time, and duration) under its own terms. Faximus does not have a Business Associate Agreement with this carrier, and a BAA with Faximus does not extend to carrier-operated networks |
| Stripe, Inc. | Payment collection, subscription billing, invoicing, and fraud prevention, when shown at checkout | United States and Stripe locations | Billing data only: account, contact, and payment information. No fax content |
| Amazon SES (Amazon Web Services, Inc.) | Inbound email-to-fax messages; fax-to-email delivery where enabled; transactional account, security, billing, and service email | United States | Customer Content: yes. Inbound email-to-fax messages including attachments, and outbound fax-to-email messages where enabled. Protected health information: only for accounts with a signed BAA, and only after Faximus has the required upstream agreements in place |
| Google LLC | Google Workspace email for Faximus mailboxes, including support@faximus.io and compliance@faximus.io; Google sign-in (identity only), if you use it | United States and Google locations | Email you send to Faximus mailboxes, including any attachments. Google sign-in: identity data only, no fax content. Protected health information must not be emailed to support@faximus.io or compliance@faximus.io |
Other authorized categories
These categories are authorized by the DPA. Named providers will be added to the table above when they process Customer Personal Data on an ongoing production basis.
| Category | Purpose | Typical processing location |
|---|---|---|
| Support, monitoring, and error-management providers | Customer support, incident response, performance, and error analysis | United States or a location disclosed when named |
| Professional advisers and contractors | Legal, accounting, audit, insurance, and specialized operations | As needed, subject to confidentiality |
Faximus does not use Customer fax content for advertising. Ordinary application logs are designed to avoid PHI and document content.
Changes
Faximus will provide at least 30 days' advance notice before authorizing a new subprocessor to process Customer Personal Data, where practicable. Notice may be posted on this page, with email notice to a subscribed contact.
To subscribe to subprocessor notices, email privacy@faximus.io with the subject line "Subprocessor notices" and the account email you want notified.
Objections
If you have a DPA in place, you may object within 15 days after notice, on reasonable documented grounds relating to data protection. The process is in Section 11 of the DPA.
Urgent replacements (for example, a failed provider) will be documented and notified as soon as practicable.