Where the risks are
- The phone call: between the provider and the receiving machine, fax travels like any fax, unencrypted.
- The receiving side: a fax machine in a shared room can be read by anyone passing by.
- Your account: a weak password or a shared login exposes every fax.
- Storage: documents kept by the provider must be protected.
What to ask a provider
- Is the connection to the service encrypted (HTTPS)?
- Are stored documents encrypted?
- Is two-factor sign-in available, or required?
- Are uploads checked for viruses?
- Can you see who in your team did what (an audit log)?
- Do they sign the agreements your industry needs? Ask before you send regulated data.
What faxB2B does today
The service runs only over HTTPS. Stored documents are encrypted with a separate key for each organization, and one organization cannot read another's records. Every upload is virus-scanned. Sign-in uses email codes, and two-factor authentication is required for everyone. Sign-ins and sensitive actions go into an audit log. Email notifications never contain document content, only a partly hidden number and a link that needs signing in. The full list is on our security page.
What we do not offer yet
We do not sign Business Associate Agreements and do not claim HIPAA compliance, and no third-party security certification is completed. Please do not send protected health information through faxB2B until that changes.
Good habits
- Double-check the number before sending.
- Use a cover sheet with a confidentiality notice for private documents.
- Give each person their own account instead of sharing one.