Vulnerability management
Dependencies and infrastructure are patched on a published cadence, with severity-based deadlines for anything urgent.
Trust centre
Security you can verify, not just trust
See where documents are stored, how they are protected, who can reach them, and how every action is recorded.
Controls
Each claim, and the control behind it
Compliance badges without explanation are decoration. Open any claim below to see what the platform actually does.
When your account is provisioned you select a residency region — Canadian or United States. Documents, metadata and backups for that account are stored and processed within it. The region is recorded in your service agreement, not just in a settings panel, and it does not change without a written amendment.
Documents are encrypted while they travel and while they are stored, and the keys are held apart from the documents themselves. No support tool can open one of your faxes without writing an access record first. If your reviewers need the specifics for an assessment, ask us and we will provide them under NDA.
Members see only the numbers and inboxes assigned to them. Administrators can restrict export and deletion. Every view, download, send and delete is written to an audit log you can export at any time.
Choose how long documents are kept, whether deletion is permitted, and whether an immutable copy is retained for regulatory purposes. Deletion requests are honoured across primary storage and backups within a published window.
Every transmission produces a timeline with timestamps for each stage and a receipt confirming what the receiving device acknowledged. Failed transmissions record the reported cause rather than a generic error.
Component-level status, historical uptime, incident write-ups and scheduled maintenance are published on a status page that stays up independently of this site.
Programme
How the security programme runs
Independent testing
Third-party penetration testing on a recurring schedule. Summary reports are available under NDA.
Employee access
Support staff cannot read a document without an access record being written and retained.
Subprocessors
A current register of every subprocessor, what it does, and where it operates.
Incident response
A defined severity ladder, notification commitments, and public write-ups after resolution.
Responsible disclosure
A published route for reporting a vulnerability, with a commitment not to pursue good-faith researchers.
On compliance language
No software makes an organization compliant on its own. We describe the specific controls Faxdirect provides — access scoping, audit logging, retention limits, encryption and contractual residency — so your privacy officer can map them to your obligations under PHIPA, PIPEDA or HIPAA. We do not claim that using Faxdirect satisfies those regimes for you.
Bring your security review. We will answer it.
Questionnaires, architecture diagrams, subprocessor registers and data-processing agreements — request what your team needs and a named contact will handle it.
- Free standard number porting
- Combined sent and received pages
- Cancel from account settings, any time