Fax API for startups
Fax API for startups
Fax is a channel most startups did not plan for. It appears the week a customer signs, or the week the first regulated buyer asks for a BAA. The team has a two-week window to get a working integration live. The largest fax API vendors are priced for enterprise buyers. Documo bundles fax API access into its Business and Enterprise plans and directs API-only buyers to a Custom tier and Contact Sales. Fax.Plus lists its API only on its Enterprise plan. eFax publishes no per-page pricing for its fax API; the primary call to action is Contact Sales. RingCentral bundles its Fax API inside RingEX seat plans. A startup that wants to try the product this afternoon has to fill out a demo form first.
mintfax is a developer-first fax service. Signup opens the sandbox, which uses the same API as live. Pricing is published per page. The BAA and the DPA are self-serve clicks in the dashboard.
What the startup team actually needs
Three needs for a team wiring fax into a new customer contract:
Sandbox on signup, no card, no BAA, no sales call. The sandbox is created via the API. POST /account/register, then POST /account/register/verify with the six-digit code returned to the signup email, opens an account. The signup flow requires no card, no BAA, and no sales call. The sandbox uses the same endpoints, request shapes, and event stream as live. Three behaviours differ. Top-ups are simulated, faxes go to a deterministic simulator instead of the PSTN, and the sandbox stays active without a first credit purchase. Failure paths are reproducible through a magic-number matrix. Sending to a specific destination number forces a busy line, an invalid number, a line-quality failure, insufficient balance, or a multi-page delivered fax. When the integration is ready for real traffic, a credit purchase activates live and the same code runs against a different environment.
Transparent pricing. Pricing is published on /pricing: $0.060 per page standard, $0.048 at 100,000 pages per month, $0.036 at one million pages per month. Prepaid credits pool at the account level. A credit is held on submission, captured on delivery, and released if the fax fails at the carrier. mintfax does not license by seat or restrict features by tier. Pricing has no monthly commitment, no setup fees, and no long-term contract. A founder modelling next quarter’s fax spend can do the arithmetic from the /pricing page without a call.
Compliance ready when the first regulated customer asks. The BAA and the DPA are self-serve documents in the dashboard, at every tier. An authorized signer reviews the prefilled template, clicks “I agree”, and the executed PDF is downloadable immediately. Acceptance writes a durable evidence record with the account, template version, signer name and title, accepted_at, IP, and user agent. A healthcare customer asking for a BAA on Friday can attach it to the procurement request on Monday morning without touching sales. A European customer asking for a DPA under GDPR, UK GDPR, or LGPD takes the same path.
Compliance controls
mintfax operates under a signed BAA and implements the technical controls a regulated customer asks for during procurement:
- Encryption. AES-256 envelope encryption for fax content at rest under mintfax-managed keys, one per environment, rotated automatically. TLS 1.2 minimum for the inbound API and outbound webhook delivery. Webhook endpoints registered over plain HTTP are rejected at registration.
- PHI handling. PHI content retention defaults to 30 days from the moment a fax reaches a terminal state. It is customer-configurable per environment between 7 and 365 days. Per-fax content deletion runs at any time via
DELETE /faxes/{id}/content. A per-environment zero-footprint mode scrubs PHI the instant a fax hitsfax.deliveredorfax.failed. - Audit. The audit stream is exportable via
GET /v1/account/auditand as a dashboard CSV. Rows carry a SHA-256 hash chain (prev_hash,row_hash) so integrity is verifiable offline. Retention is fixed at six years per 45 CFR 164.530(j)(2). - Send-path predictability. Webhooks are signed with HMAC-SHA256 per the Standard Webhooks specification, with a per-endpoint signing secret and three headers per delivery (
webhook-id,webhook-timestamp,webhook-signature).POST /faxeshonoursIdempotency-Keyfor 24 hours. Every response carriesX-Request-Id. Errors return a stable ten-code taxonomy with an optional subcode and a machine-readable next action.
mintfax operates under a signed BAA and implements the controls above. Meeting HIPAA is the covered entity’s job; the controls above are what it depends on from mintfax. mintfax does not hold SOC 2, HITRUST, or PCI DSS Level 1, and these are not offered. Deeper detail (the full PHI boundary, the audit-stream schema, the error catalog) lives on /compliance.