GDPR compliant fax service
You can review and sign mintfax’s Data Processing Agreement (DPA) in the dashboard at every price tier. An authorized signer accepts the agreement and can download the signed PDF immediately.
The acceptance record includes the signer, agreement version, date, and a copy of the subprocessor list at signing. The Business Associate Agreement (BAA) is a separate document; you can sign either or both.
Data processing terms
Under the DPA, mintfax is the processor and you are the controller. The agreement covers GDPR, UK GDPR, and LGPD obligations.
Its Article 28 terms cover processing instructions, confidentiality, security, and subprocessor authorization. They also cover assistance with data-subject requests, breach reporting, deletion or return of data, and audit rights.
Encryption and access records
Fax content uses AES-256 envelope encryption, with a separate mintfax-managed key for each environment. Keys rotate automatically. Database storage also uses the cloud provider’s encryption.
API requests and outbound webhooks use TLS 1.2 or higher. Webhook endpoints must use HTTPS.
The audit log records access to content, including access through mintfax support tools. Staff entries include an identifier and a reason. Records include linked hashes so you can check for alterations.
You can export the log through GET /v1/account/audit or download CSV from the dashboard. Records are kept for six years and can support your own record of processing activities.
Retention and deletion
Content is kept for 30 days after delivery or failure by default. You can set a period between 7 and 365 days for each environment.
To delete an individual fax’s content, use DELETE /v1/faxes/{id}/content. The fax record remains available, with the content and personal-data fields cleared. This is the API operation for deleting a specific fax’s content in response to an erasure request.
Zero-footprint mode deletes personal content when a fax is delivered or fails. Operational records remain. Billing records are kept permanently regardless of the retention setting.
See the retention guide for configuration and affected fields.
Subprocessors
The subprocessor list gives each provider’s name, role, region, DPA link, and status.
Changes to primary providers are announced at least 14 days in advance through email, the dashboard, and an Atom feed. This gives you time to object under the DPA’s terms. Standby providers may be activated on short notice; adding one to the list requires the same 14-day notice.
US storage and cross-border transfers
Data is stored in one US AWS region, identified in the subprocessor list. You cannot select a storage region.
The DPA requires at least 30 days’ notice of a change to an existing customer’s storage region, with a way to object. It also provides for region choice and migration when additional regions become available.
Transfers from the EU or EEA to mintfax in the United States are covered by the EU Standard Contractual Clauses, Module Two (controller to processor), under Decision (EU) 2021/914. UK transfers use the UK International Data Transfer Addendum. Where an applicable EU adequacy decision covers the destination, SCCs are not required for that transfer.
Scope and limits
mintfax’s Article 28 commitments cover its API infrastructure, content storage, operational databases, and application logs. They exclude upstream carriers, recipient fax systems, your webhook endpoints, and payment processors.
Fax transmission over the telephone network is not encrypted end to end. Customer-managed encryption keys are not available.
mintfax does not hold SOC 2, ISO 27001, HITRUST, FedRAMP, or PCI DSS Level 1 certification.
You can download your signed DPA and export the audit log for your own records, including if you leave mintfax.