Compliance
mintfax is a developer-first fax service, and compliance is built in at every tier. The BAA is a click in the dashboard, on every account, at every tier. So is the DPA. Encryption, retention, audit export, and zero-footprint mode come with the account, not with the invoice.
What mintfax does
The five compliance mechanisms are encryption at rest, encryption in transit, an exportable audit log, configurable retention, and zero-footprint mode.
Encryption at rest. Fax content is stored with envelope encryption under mintfax-managed keys, one key per environment, rotated automatically. Content encryption uses AES-256; the database itself sits behind cloud-provider at-rest encryption on top of that.
Encryption in transit. Inbound API calls and outbound webhook delivery use TLS 1.2 minimum. Endpoints registered with plain HTTP are rejected at registration time.
Exportable audit log. Every account can pull its audit stream over HTTP via GET /v1/account/audit (paginated JSON, cross-environment with a filter), or download CSV from the dashboard. Each row carries prev_hash and row_hash fields, so integrity is verifiable offline against a published reference verifier. Read events for PHI content access appear in the same stream. That includes any mintfax personnel action that renders customer content in support tooling, tagged with a pseudonymous staff identifier and a mandatory reason. Audit retention is fixed at six years from row creation to match HIPAA 45 CFR 164.530(j)(2).
Configurable retention. PHI content retention defaults to 30 days, customer-configurable per environment in the range 7 to 365 days. Active per-fax deletion is available at any time via DELETE /faxes/{id}/content; the fax resource itself remains queryable with PHI fields nulled. Billing records are retained permanently regardless of retention mode.
Zero-footprint mode. A per-environment toggle. When enabled, PHI is scrubbed the moment a fax reaches a terminal state (fax.delivered or fax.failed). Operational metadata (status, error codes, timestamps, attempt history) is preserved. Default off.
BAA at every tier
The BAA is a click in the dashboard, on every account, at every tier. No sales call, no procurement gate. Accepting it writes a durable evidence record (account, template version, signer name and title, IP, user agent, accepted_at) and the executed PDF is downloadable immediately. When the template updates, existing acceptances stay valid against their original version. Admins are prompted to re-accept, and the older PDF stays downloadable as a historical record.
The DPA is a separate document, accepted through the same click-through path. A customer can accept neither, one, or both.
Regimes addressed
HIPAA and GDPR are the two anchored sub-pages.
- HIPAA. BAA availability plus the mechanisms above (encryption, audit, retention, zero-footprint).
- GDPR. DPA availability, subprocessor publication with 14-day advance notice on primary changes, and the Article 32 security controls.
Other regimes on the hub, each answered by the DPA and the mechanisms above:
- LGPD (Brazil)
- PIPEDA (Canada)
- APPI (Japan)
- PDPA (Singapore)
- Australian Privacy Act
- UK GDPR
- CCPA (California)
Frameworks mintfax does not hold
mintfax does not hold SOC 2, ISO 27001, HITRUST, FedRAMP, or PCI DSS Level 1. These require external auditor engagement and recurring audit cost, and are not offered. mintfax also does not claim end-to-end encryption; the T.30 carrier and recipient legs sit outside mintfax control. Customer-managed encryption keys are not offered, and storage is single-US-region; data residency selection is not offered.
Paperwork
- BAA. Self-serve in the dashboard, downloadable PDF, template versioning tracked with the evidence record.
- DPA. Same self-serve path, separate document. Covers GDPR, UK GDPR, LGPD, and similar regimes. See /legal/dpa for the master paperwork index.
- Subprocessor list. Published publicly. Adding or replacing a primary subprocessor triggers 14-day advance notice through email to account admins, a dashboard banner, and an Atom feed. A “standby” section pre-discloses candidates that may be activated on short notice. Adding to standby carries the same 14-day advance notice as adding a primary.
If you move off mintfax, two artifacts stay portable. The audit log exports via GET /v1/account/audit and CSV. The error taxonomy is documented and stable.