A fax, from screen to paper: security

Every stretch of the journey examined, with its points of vigilance.

A Faxeroo fax travels two legs. From your browser to our servers: an encrypted HTTPS connection; the file serves the send, then vanishes on its own. From our servers to the fax machine: the journey runs across the telephone network, chiefly as VoIP traffic with no encryption whatsoever — a constraint of the fax protocol, the same at every carrier. Real incidents seldom stem from an ear on the line: they stem from a wrong digit, a machine left open, or a memory that is never wiped.

Pages in this topic

“Data and security” covers several pages, each tackling a distinct question. Choose the page that fits your situation.

The weak points, from most common to rarest

This ranking follows observed incidents. Technical interception comes last.

  1. Two digits swapped

    A faulty number sends the document to a stranger, and everything looks normal: a fax machine picked up, the pages were acknowledged. No procedure then brings the sheets back.

  2. A machine in full view

    The page ends up in a tray that anyone can leaf through: reception desk, open-plan space, reprography room. Every hour spent there adds possible readers.

  3. Copies piling up

    A multifunction device frequently keeps a trace of what passed through in memory or on disk; some installations route incoming faxes to a shared mailbox. Each additional copy adds another spot that needs protecting.

  4. A last stretch in clear

    On this segment, signals pass unencrypted — either analogue, or T.38 packets carried over IP. Eavesdropping requires access to an operator's equipment: conceivable, but far rarer than the first three cases.

What Faxeroo guarantees — and doesn't

Always frankly: what no fax sent online could promise you.

Departure over HTTPS
Your PDF reaches our servers over an HTTPS connection: on that stretch, its content is unreadable to anyone. The next link — the telephone line — remains beyond the reach of any encryption.
Deletion without intervention
The file exists here only to compose and transmit. Once the send is finished, deletion happens on its own; it is used for nothing else.
A safeguard before departure
No page moves before you have opened the link received by email, nor before the countdown of about 55 seconds, which you can stop at any moment. A last check of the number.
Your pages, with nothing added
Only a cover sheet, built from your own fields, precedes the document. No banner, no advertising, no commercial mention on your pages.

Five habits that protect

  1. Get the number straight from the source

    Take it from a document your contact officially published, never from an old notebook; choose the right country in the form, then compare digit by digit before confirming. The dialling code directory settles any lingering doubt.

  2. Warn them it's coming

    Tell the recipient by phone or SMS — “the file is going out by fax in five minutes” — and they will stay near the machine. The page will not sit in the tray.

  3. Write a useful cover sheet

    It is produced from your own fields: name the recipient, state the subject, and slip into the message a request to be alerted in case of misrouting. Whoever picks up the sheet will know where to take it.

  4. Lighten it before sending

    Before assembling the PDF, remove the annexes and mask what is not needed: full IBAN, tax number, irrelevant medical history. The less it contains, the less a misrouting costs.

  5. Keep the record

    The PDF receipts feature costs €2.99 incl. VAT and is billed only once the fax arrives; it records the request, then the transmission. Faced with an uncertain recipient, you act with dated documents.

What no fax can do

Truly encrypted fax from sender to receiver simply doesn't exist in practice. The ITU's T.30 recommendation does provide for optional security mechanisms; machines in service practically never implement them. Any provider promising encryption down to the recipient's printed page is promising more than the technology allows.

After printing, the fax sees nothing more: who picks up the sheet, who duplicates it, where it ends up. It certifies that a device attached to a number accepted pages — nothing about the person who read them. For highly sensitive information, and if your contact offers secure messaging or an encrypted platform, turn to that.

What you ask us

Can a fax be listened in on?
From your browser to Faxeroo, everything goes over HTTPS. From there to the recipient, the signal travels in clear; but that requires breaking into an operator's equipment. The concrete risk is a misdialled number, or a page sitting on the machine.
How long do you keep my file?
For the duration of the send, and no longer. The file serves to transmit, then deletion follows, automatically. No consultable copy remains on our side.
I faxed the wrong number: what now?
If you can, contact the person holding the number and request that they destroy the document. Record the time and the contents sent, then inform your organisation's data protection lead. Did the document contain personal data? Documentation and, potentially, notification may be required: the GDPR page explains these duties.
Can health data be faxed?
Doctors, pharmacies and establishments still use it, often at their own request. Such use calls for heightened vigilance: verify the number, announce the arrival, and limit content to the strict minimum. Your profession's or establishment's rules come first: consult your data protection lead.

Keep reading

Pages chosen to help you prepare a send, track it, or keep proof of it.

See also