Fax security, honestly explained

Where your document is safe, where it is exposed, and your options.

Updated on:

A CaptainFax transmission has two stages. Between your browser and our servers, HTTPS keeps the file unreadable in transit. From our servers to the recipient, the fax crosses the phone network, whose fax protocol itself offers no real encryption. This applies to all fax services and all fax machines alike. The uploaded file is used to send your fax and is removed automatically afterwards. Most real incidents have little to do with wiretapping: a mistyped number, a printer in a corridor, a forgotten copy.

Where things actually go wrong

Four weak points, listed by how often they cause trouble, starting with the most frequent.

  1. One wrong digit

    Dial a number that differs by a single digit and the fax reaches someone else. The transmission is a success from a technical point of view, since a machine answered and took the pages, and it cannot be recalled.

  2. A shared output tray

    Incoming faxes usually print on the spot. If the machine sits in a reception area or a shared office, the pages wait there for whoever walks past first.

  3. Forgotten copies

    Many office machines store documents in memory or on an internal disk, and some forward incoming faxes to a mailbox that several people read. Each copy is one more thing to protect or to wipe.

  4. No encryption on the phone leg

    In everyday use, the phone portion of a fax is unencrypted, whether it travels as analogue audio or as T.38 data over IP. Eavesdropping would require access to a carrier's network, which makes it the least probable of the four.

What CaptainFax does for you

Four measures we apply, and the limit that stays the same whichever provider you choose.

HTTPS on the way in
Your file reaches us over an encrypted connection, so nobody between your device and our servers can read it. We cannot extend that protection to the phone line that follows.
The file is deleted after sending
Your document is kept only as long as it takes to convert and transmit it. Once the transmission ends, the uploaded file is erased automatically and is never reused for any other purpose.
You confirm before it leaves
A fax is only dispatched after you open the link in the confirmation e-mail and a short countdown of about 55 seconds ends. You can cancel during the countdown, which gives you one more look at the number.
Nothing added to your pages
Apart from the cover sheet generated from the form, your pages go out as they are. No advertising and no footer promoting the service.

Five habits that make a difference

  1. Get the number from a reliable source

    Use the recipient's letterhead, website or a recent e-mail, not an old note. Select the correct country in the form and read the number back digit by digit. The number checker and the dial-code directory on this site can settle a doubt.

  2. Warn the recipient

    A short call or message saying that a fax is on its way lets the other side stand near the machine. The pages spend less time in the tray.

  3. Use the cover sheet properly

    Address a person, not just a company, give a clear subject, and request in the message that they tell you if the fax reached the wrong desk. Whoever finds a stray page will then know what to do.

  4. Send the minimum

    Before making the PDF, strip out unnecessary pages and conceal details the recipient does not need, for example a complete bank account number or unrelated health information. If something goes astray, less is exposed.

  5. Keep a record

    PDF receipts, which are optional (€2.99 including VAT, payable only after successful delivery), give you a dated record of the request and of the transmission. Should you later wonder where a fax went, you have a starting point.

Limits you should know about

Fax has no practical end-to-end encryption. The T.30 standard that governs fax machines includes optional security features, but they are rarely implemented in equipment actually in use. A service that claimed encryption from your screen to the recipient's paper would be overstating what the technology can do.

Nothing in a fax tells you what becomes of the pages once printed: who picks them up, who copies them, where they are filed. It shows that a machine at a given number accepted a document, not that a given person read it. For highly confidential content, favour a secure messaging or document-sharing channel whenever the other party has one.

Frequently asked questions

Can a fax be intercepted?
On the browser side, no one can read the file in transit, because it is sent over HTTPS. On the telephone side the signal is not encrypted, so an attacker with access to a carrier's equipment could capture it in theory. In practice, misdirected or uncollected pages are a much more common cause of leaks.
How long do you keep my document?
Only as long as it takes to send it. After the transmission, the uploaded file is deleted automatically. We do not keep a copy that we, or anyone else, could open afterwards.
I sent a fax to the wrong number. What now?
If you can find out who owns the number, ask them to shred the pages. Record the time and the content sent, and tell whoever is in charge of data protection where you work. When the document held personal data, you may need to log the incident and sometimes report it; our privacy page walks through the steps.
Can I fax medical documents?
Fax is still common between practices, pharmacies and hospitals, and the receiving side often asks for it. Take extra care: verified number, recipient warned, only the necessary pages. The rules of your profession or institution come first, so check them if you are unsure.

Keep exploring

A few pages that go well with the one you just read.

Related questions