A fax, from screen to paper: security

Every stretch of the journey examined, with its points of vigilance.

Transmission via Faxeroo unfolds in two distinct phases. Initially, a protected HTTPS tunnel transfers your file onto our infrastructure; once it has facilitated the dispatch, the data automatically erases itself. Next, the path from our infrastructure toward the receiving fax unit travels across the telephone grid, predominantly as unencrypted VoIP packets — an inherent constraint of the fax standard itself, identical across all providers. Genuine breaches seldom stem from wiretapping: they originate from a mistyped number, an unattended printer tray, or residual data never purged from a device.

Pages in this topic

“Data and security” covers several pages, each tackling a distinct question. Choose the page that fits your situation.

Where things go wrong, ranked by frequency

This ranking follows observed incidents. Technical interception comes last.

  1. Two digits swapped

    A faulty number sends the document to a stranger, and everything looks normal: a fax machine picked up, the pages were acknowledged. No procedure then brings the sheets back.

  2. A machine in full view

    The page ends up in a tray that anyone can leaf through: reception desk, open-plan space, reprography room. Every hour spent there adds possible readers.

  3. Copies piling up

    Copies multiply quietly: an all-in-one printer may retain every page it processed on internal storage, and incoming faxes are sometimes redirected to a mailbox several colleagues read. Every one of those copies is something else to secure.

  4. A last stretch in clear

    On this segment, signals pass unencrypted — either analogue, or T.38 packets carried over IP. Eavesdropping requires access to an operator's equipment: conceivable, but far rarer than the first three cases.

What Faxeroo guarantees — and doesn't

Always frankly: what no fax sent online could promise you.

Departure over HTTPS
The PDF is sent to our servers through HTTPS, so on that part of the route its contents cannot be read by anyone. The next section — the telephone line — is not covered by any encryption.
Deletion without intervention
The file exists here only to compose and transmit. Once the send is finished, deletion happens on its own; it is used for nothing else.
A safeguard before departure
No page is sent until you have clicked the link that arrived by email and the roughly 55-second timer has elapsed, though you can stop this timer at any moment. A final check of the number.
Your pages, with nothing added
Only a cover sheet, built from your own fields, precedes the document. No banner, no advertising, no commercial mention on your pages.

Five habits that protect

  1. Get the number straight from the source

    Take the number from an official document your contact has published, not from an old address book. Set the country menu to the recipient's country and check the digits one by one before confirming; if any doubt remains, the country code directory settles it.

  2. Warn them it's coming

    Tell the recipient by phone or SMS — “the file is going out by fax in five minutes” — and they will stay near the machine. The page will not sit in the tray.

  3. Write a useful cover sheet

    It is produced from your own fields: name the recipient, state the subject, and slip into the message a request to be alerted in case of misrouting. Whoever picks up the sheet will know where to take it.

  4. Lighten it before sending

    Before assembling the PDF, remove the annexes and mask what is not needed: full IBAN, tax number, irrelevant medical history. The less it contains, the less a misrouting costs.

  5. Keep the record

    The PDF receipts feature costs €2.99 incl. VAT and is billed only once the fax arrives; it records the request, then the transmission. Faced with an uncertain recipient, you act with dated documents.

What no fax can do

Truly encrypted fax from sender to receiver simply doesn't exist in practice. The ITU's T.30 recommendation does provide for optional security mechanisms; machines in service practically never implement them. Any provider promising encryption down to the recipient's printed page is promising more than the technology allows.

Once printed, the fax escapes your sight: whoever takes the paper, whoever makes a copy, where the document ends up. It proves only that a device linked to a number accepted those pages; who actually read them remains unknown. If the information is highly confidential and your contact suggests a protected messaging tool or an encrypted platform, go with that instead.

What you ask us

Can a fax be listened in on?
From your browser to Faxeroo, everything goes over HTTPS. From there to the recipient, the signal travels in clear; but that requires breaking into an operator's equipment. The concrete risk is a misdialled number, or a page sitting on the machine.
How long does Faxeroo retain my document?
For the duration of the send, and no longer. The file serves to transmit, then deletion follows, automatically. No consultable copy remains on our side.
I faxed the wrong number: what now?
If you can, contact the person holding the number and request that they destroy the document. Record the time and the contents sent, then inform your organisation's data protection lead. Did the document contain personal data? Documentation and, potentially, notification may be required: the GDPR page explains these duties.
Can health data be faxed?
Doctors, pharmacies and establishments still use it, often at their own request. Such use calls for heightened vigilance: verify the number, announce the arrival, and limit content to the strict minimum. Your profession's or establishment's rules come first: consult your data protection lead.

Keep reading

Pages chosen to help you prepare a send, track it, or keep proof of it.

See also