Data Retention Policy
Effective 16 July 2026. Last updated 16 July 2026.
Data Retention Policy
Purpose
This policy describes how Mintfax retains, protects, and deletes fax content and associated data on behalf of its customers.
Scope
This policy applies to all Mintfax environments (sandbox and live) and to all customers operating under a Mintfax Business Associate Agreement (BAA) or standard terms of service. It governs the retention and deletion of data submitted to or generated by the Mintfax API and dashboard.
Definitions
PHI content refers to the five field categories Mintfax treats as Protected Health Information for retention and scrub purposes: fax content files (uploaded source documents, rendered TIFFs, preview images), cover page body text, sender name, recipient name, and recipient company name.
Operational metadata refers to non-PHI fields preserved after content deletion: destination phone number, fax status, error codes and messages, attempt history, timestamps, page count, document size and type.
Terminal classification means a fax has reached a final status of delivered or failed, at which point retention timers and zero-footprint scrub begin.
Environment refers to a Mintfax API environment (sandbox or live). All retention settings are configured per environment.
1. Default Retention Period
Mintfax retains PHI content for 30 days from terminal classification of a fax. After this period, a scheduled scrub job:
- Nulls all PHI natural-language fields (sender name, recipient name, recipient company, cover page body)
- Deletes uploaded source files, rendered TIFFs, and preview images from object storage
- Sets a
pii_scrubbed_attimestamp on the fax record
The fax resource itself remains queryable with operational metadata intact and PHI fields returned as null.
2. Customer-Configurable Retention
Each environment exposes a phi_retention_days setting. Customers may set this to any integer between 7 and 365 days. The default is 30.
Settings outside the 7–365 range are rejected at the API and dashboard boundary. Retention windows longer than 365 days require a signed addendum; contact [email protected] to begin that process.
Retention controls are available on all Mintfax accounts. No tier restriction applies.
3. Zero-Footprint Mode
Each environment offers a zero_footprint_enabled toggle (default: off). When enabled:
- PHI content is scrubbed immediately upon terminal classification (
fax.deliveredorfax.failed) - The
phi_retention_dayssetting is superseded; no accumulation of PHI occurs - Operational metadata is preserved; the fax resource remains queryable
Zero-footprint mode is designed for workflows operating under heightened regulatory constraint, such as clinical deployments where post-delivery PHI retention is contractually forbidden.
The toggle is per-environment, so a customer can run a live environment with zero-footprint enabled and a sandbox environment with standard 30-day retention for testing, or any other combination.
Sandbox and live environments observe identical scrub behavior. A fax in sandbox is treated as PHI for retention purposes.
Zero-footprint mode is available on all Mintfax accounts. No tier restriction applies.
4. On-Demand Single-Fax Deletion
Customers may delete the PHI content of a specific fax at any time via:
DELETE /v1/faxes/{id}/content
Or via the equivalent action in the Mintfax dashboard. This executes the PHI scrub immediately for that fax, independent of the environment-wide phi_retention_days setting. The fax resource is not deleted; only PHI fields are scrubbed and content files removed.
This endpoint satisfies the HIPAA right-to-deletion path for individual records without altering the environment-wide retention configuration.
5. Operational Metadata
Destination phone number and operational metadata (status, error codes, timestamps, attempt history, document metadata snapshot) are preserved past PHI content deletion. These fields are used for support, dispute handling, and fraud monitoring.
Customers requiring removal of destination phone numbers or full fax record deletion should contact [email protected].
6. Audit Stream Retention
Mintfax retains the customer-visible audit stream for 6 years from row creation, per HIPAA Privacy Rule 45 CFR 164.530(j)(2). This retention period is fixed and is not customer-configurable.
The audit stream covers PHI access events (API content downloads, dashboard “View content” actions, and Mintfax personnel access to customer content in support tooling). Personnel access rows carry a pseudonymous staff identifier and a mandatory reason field, and are visible to customers in their audit feed.
The audit stream uses a SHA-256 hash chain (prev_hash, row_hash) for tamper detection; records are verifiable offline using published reference verifier scripts.
7. Billing Records
Billing records are retained permanently, regardless of retention mode or environment-level settings.
8. Encryption
PHI content at rest is encrypted using SSE-KMS with Mintfax-managed AWS KMS customer master keys (one per environment, with KMS automatic rotation enabled). Database rows are encrypted using cloud-provider default at-rest encryption.
All data in transit uses TLS 1.2 minimum. Webhook endpoints registered with http:// scheme are rejected at registration.
9. Data Residency
All customer PHI and operational metadata is stored in a single US AWS region. The specific region is named in the sub-processor list.
The Data Processing Addendum commits to 30-day advance notice of any regional change and to customer region choice when additional regions become available.
Related Documents
Contact
For questions about this policy or to request data deletion outside the automated paths, contact [email protected].