Security

mintfax encrypts stored fax content, requires encrypted API connections, and records access to patient information. Every account includes the controls below.

Encryption

Fax content uses AES-256 envelope encryption, with a separate content key for each environment. mintfax manages and automatically rotates the keys. Database storage also uses the cloud provider’s encryption.

API requests and outbound webhooks require TLS 1.2 or higher. Webhook endpoints must use HTTPS.

Fax transmission over the telephone network is not encrypted end to end. Carrier and recipient systems are outside mintfax’s control.

API keys

API requests use bearer tokens. A key’s prefix identifies what it can access:

A sandbox key cannot access live records. Account administration keys can only be created in the dashboard. The dashboard uses session authentication separately from API keys.

To replace a key, create a new one, update your application, and revoke the old one. Both work during the transition. A revoked key is rejected on the next request.

See API keys and authentication for details.

Webhook verification

Every webhook is signed using HMAC-SHA256 under the Standard Webhooks specification. Each endpoint has its own signing secret.

Your receiver can verify the signature using the webhook-id, webhook-timestamp, and webhook-signature headers. It should also reject timestamps more than five minutes from its clock.

The verification guide explains how to check incoming requests.

Audit logs

The audit log records access to protected health information (PHI) through API downloads, dashboard views, and mintfax support tools. Entries for staff access include an identifier and a required reason.

Each entry includes prev_hash and row_hash fields. These form a chain that you can verify to detect altered records.

You can export audit entries through GET /v1/account/audit or download them as CSV from the dashboard. The log includes records across your account, with an environment filter. Audit records are kept for six years.

Content retention

The default content retention period is 30 days. You can set it between 7 and 365 days for each environment, or delete a fax’s content through DELETE /v1/faxes/{id}/content.

With zero-footprint mode enabled, mintfax deletes PHI when a fax is delivered or fails. Operational records remain available. The retention guide explains which fields are deleted.

Service limits

Data is stored in one US region. Customer-managed keys, region selection, IP allowlisting, and per-resource key permissions are not available. API keys do not expire automatically.

mintfax does not hold SOC 2, ISO 27001, HITRUST, FedRAMP, or PCI DSS Level 1 certification. See compliance for agreements and the scope of mintfax’s commitments.

Report a vulnerability

Email [email protected]. Security reports receive a response within one business day.