GDPR compliant fax service
On mintfax, the DPA is a click in the dashboard, at every tier. No sales call, no support ticket, no email round-trip. The customer’s authorized signer reviews the prefilled template, clicks “I agree”, and the executed PDF is downloadable immediately. The same click writes a durable evidence record: account, template version, signer name and title, accepted_at, IP, user agent, and a snapshot of the current subprocessor list at the moment of acceptance. The BAA lives on the same self-serve path as a separate document; a customer can accept neither, one, or both.
The paperwork is a dashboard action, not a procurement cycle, and the Article 32 controls come with the account rather than with the invoice. mintfax is the processor; the customer is the controller.
Across the fax market, a DPA is usually available on request through sales, published without a self-serve execution path, or gated behind an enterprise tier. On mintfax it is one click, at every tier, with the executed PDF and the subprocessor-list snapshot in hand the moment the customer clicks.
GDPR-relevant controls
| Control | mintfax detail | Notes |
|---|---|---|
| Signed DPA | Self-serve dashboard click-through at every tier. Executed PDF downloadable immediately. Evidence record includes a snapshot of the current subprocessor list at acceptance. | Covers GDPR, UK GDPR, and LGPD. |
| Processor role and Article 28 scope | mintfax is the processor; the customer is the controller. The DPA covers documented instructions, confidentiality, security, sub-processor authorization, data-subject assistance, breach notification, deletion or return, and audit rights. | Article 28(2) right-to-object encoded through the 14-day subprocessor change window. |
| Encryption at rest and in transit | AES-256 envelope encryption for fax content under mintfax-managed keys, one per environment, rotated automatically. TLS 1.2 minimum on inbound API and outbound webhook delivery. | Aligned with Article 32(1)(a). Customer-managed keys (BYOK) are not offered. |
| Exportable audit log | GET /v1/account/audit (paginated JSON, cross-environment with an environment filter) and CSV download from the dashboard. SHA-256 hash chain via prev_hash and row_hash, verifiable offline. Retention 6 years from row creation. | Supports the controller’s Article 30 record on the mintfax processing leg. |
| Retention and right to erasure | Content retention default 30 days, customer-configurable per environment between 7 and 365 days. Active per-fax deletion via DELETE /v1/faxes/{id}/content. Zero-footprint mode is a per-environment toggle. | The per-fax deletion endpoint is the operational path for an Article 17 data-subject erasure request. |
| Public subprocessor list | Name, role, region, subprocessor DPA link, and status published on a public page. Primary changes announced 14 days in advance via email to account admins, dashboard banner, Atom feed, and the page itself. | A standby section pre-discloses candidates that may be activated on short notice, with the same 14-day notice. |
| Data residency and cross-border transfer | Storage is in a single US AWS region, named in the subprocessor list. Cross-border transfers covered by the EU Standard Contractual Clauses (Commission Implementing Decision 2021/914, Module Two: controller to processor). UK transfers covered by the UK IDTA Addendum. | The DPA carries a forward commitment on region change and on customer region choice when additional regions launch. |
| Compliance boundary | Covers API infrastructure, content storage, operational databases, and application logs. Does not cover upstream carriers, recipient fax infrastructure, developer webhook endpoints, or payment processors. | The T.30 carrier leg over the PSTN is unencrypted by protocol. |
Encryption at rest. Content encryption is AES-256 with envelope encryption under mintfax-managed keys, one key per environment, rotated automatically. The database itself sits behind cloud-provider at-rest encryption on top of that. Customer-managed encryption keys are not offered.
Encryption in transit. TLS 1.2 minimum for both inbound API traffic and outbound webhook delivery. Endpoints registered with plain HTTP are rejected at registration time.
Exportable audit log. Every account can pull its audit stream over HTTP via GET /v1/account/audit or download CSV from the dashboard. Each row carries prev_hash and row_hash fields, so integrity is verifiable offline. Read events for personal-data content access appear in the same stream, including any mintfax personnel action that renders customer personal data in support tooling. Personnel rows carry a pseudonymous staff identifier and a mandatory reason. The audit stream supports the controller’s own Article 30 record on the mintfax processing leg.
Retention and right to erasure. Content retention defaults to 30 days from the moment a fax reaches a terminal state. It is customer-configurable per environment between 7 and 365 days. Active per-fax deletion is available at any time via DELETE /v1/faxes/{id}/content; the fax resource remains queryable with content and personal-data fields nulled. That endpoint is the operational path for an Article 17 data-subject erasure request on a specific fax. Zero-footprint mode is a per-environment toggle that scrubs personal data on fax.delivered or fax.failed; operational metadata is preserved. Billing records are retained permanently regardless of retention mode.
Public subprocessor list. Every entry lists name, role, region, link to the subprocessor’s own DPA, and status (primary, standby, or historical). A standby section pre-discloses candidates that may be activated on short notice. Adding to standby carries the same 14-day advance notice as adding a primary.
Data residency and cross-border transfers
Storage is in a single US AWS region. The specific region is named on the subprocessor list. The DPA carries a forward commitment on region change: any change to the storage region for an existing customer is announced at least 30 days in advance, with a mechanism for the customer to object. When additional regions become available, customers will be able to choose a region at account creation, and existing accounts will be offered migration on a published schedule.
Cross-border transfers from the EU or EEA to mintfax in the United States are covered by the EU Standard Contractual Clauses (Commission Implementing Decision (EU) 2021/914, Module Two: controller to processor). UK transfers are covered by the UK International Data Transfer Addendum to the EU SCCs. Where the customer’s jurisdiction has an EU adequacy decision covering the receiving country, the SCCs are not required for that leg; otherwise the SCCs cover the transfer.
Compliance boundary
mintfax’s Article 28 commitments cover the API infrastructure, content storage, operational databases, and application logs. They do not cover upstream carriers, recipient fax infrastructure, developer webhook endpoints, or payment processors. The T.30 leg over the PSTN is unencrypted by protocol. The DPA states this boundary. The developer-facing guide at /docs/data-retention covers the retention configuration, per-fax deletion, and zero-footprint mode in full.
Frameworks not held and controls not provided
No GDPR certification exists. mintfax operates under a DPA covering GDPR, UK GDPR, and LGPD obligations, and publishes the subprocessor list with 14-day advance notice on primary changes.
mintfax does not hold SOC 2, ISO 27001, HITRUST, FedRAMP, or PCI DSS Level 1. These are not offered.
mintfax does not claim end-to-end encryption. Customer-managed encryption keys are not offered. Storage is single-US-region; region selection is not offered.
Portability
If a customer moves off mintfax, three artifacts stay: the executed DPA PDF, the audit stream export (which supports the controller’s own Article 30 record), and the machine-readable error catalog. The full portability answer lives on /compliance.