Security & privacy

PDFs are stored in private US cloud object storage. Media is served over HTTPS with short-lived signed URLs. Account data is stored in encrypted Postgres. Session cookies use industry-standard identity verification; API keys are stored as SHA-256 hashes.

Retention: consumer packages expire per order; media is deleted on the schedule described in our Privacy Policy (typically within about 7 days after service ends unless you download copies).

Access: only the signed-in account owner (or authorized operators) can reach fax media. Agents act only with keys the owner creates. Business subscribers also receive inbound faxes as PDF attachments by email.

Abuse: report misuse to abuse@fax.monster. We block destinations, rate-limit API keys, and can ban accounts.

Medical/HIPAA use is not supported. No BAA.