Fax security, honestly explained

Which parts of the journey are protected, which are not, and what you can do about the gaps.

Updated on:

Every CaptainFax transmission happens in two stages. Between your browser and our servers the connection is HTTPS, so nobody can read the file in transit. Between our servers and the recipient the fax goes over the phone network, where the fax protocol offers virtually no encryption; that holds for every fax service and every fax machine. We use the uploaded file to send your fax and then delete it automatically. Wiretapping rarely causes real-world incidents; far more often it is a mistyped number, a printer in a hallway or a forgotten copy.

Where things actually go wrong

Four weak points, listed by how often they cause trouble, starting with the most frequent.

  1. One wrong digit

    Dial a number that differs by a single digit and the fax reaches someone else. The transmission is a success from a technical point of view, since a machine answered and took the pages, and it cannot be recalled.

  2. A shared output tray

    Incoming faxes usually print on the spot. If the machine sits in a reception area or a shared office, the pages wait there for whoever walks past first.

  3. Forgotten copies

    Many office machines store documents in memory or on an internal disk, and some forward incoming faxes to a mailbox that several people read. Each copy is one more thing to protect or to wipe.

  4. No encryption on the phone leg

    The phone leg of a fax is not encrypted in everyday use, whether it travels as analog audio or as T.38 data over IP. Listening in would need access to a carrier's network, which makes it the least likely of the four.

What CaptainFax does for you

Four measures we apply, and the limit that stays the same whichever provider you choose.

HTTPS on the way in
Your file reaches us over an encrypted connection, so nobody between your device and our servers can read it. We cannot extend that protection to the phone line that follows.
The file is deleted after sending
Your document stays with us only as long as it takes to convert and send it. Once the transmission ends, the uploaded file is erased automatically and is never reused for any other purpose.
You confirm before it leaves
A fax is only dispatched after you open the link in the confirmation email and a short countdown of about 55 seconds ends. You can cancel during the countdown, which gives you one more look at the number.
Nothing added to your pages
Apart from the cover sheet generated from the form, your pages go out as they are. No advertising and no footer promoting the service.

Five habits that make a difference

  1. Get the number from a reliable source

    Use the recipient's letterhead, website or a recent email, not an old note. Select the correct country in the form and read the number back digit by digit. The number checker and the dial-code directory on this site can settle a doubt.

  2. Warn the recipient

    A short call or message saying that a fax is on its way lets the other side stand near the machine. The pages spend less time in the tray.

  3. Use the cover sheet properly

    Address the fax to a named person rather than only a company, write a precise subject line, and add a request to be told should it end up at the wrong desk. Whoever picks up a stray page will then know what to do.

  4. Send the minimum

    Before building the PDF, drop pages that aren’t needed and mask anything the recipient doesn’t require, like a complete bank account number or unrelated health details. Should the fax go astray, there is less to expose.

  5. Keep a record

    Optional PDF receipts cost €2.99 with VAT included and are billed solely when the fax is delivered. With a dated record for both the request and the transmission in hand, you have a starting point if you ever need to trace a fax.

Limits you should know about

Fax has no practical end-to-end encryption. The T.30 standard that governs fax machines includes optional security features, but they are rarely implemented in equipment actually in use. A service that claimed encryption from your screen to the recipient's paper would be overstating what the technology can do.

Faxing also leaves a blank about the period after printing: who collects the pages, who copies them, where they end up filed. It shows that a machine at a certain number took a document, not that a particular person read it. When the content is highly confidential, choose a secure messaging or document-exchange channel instead if the other party has one.

Frequently asked questions

Can a fax be intercepted?
On the browser side, no one can read the file in transit, because it is sent over HTTPS. On the telephone side the signal is not encrypted, so an attacker with access to a carrier's equipment could capture it in theory. In practice, misdirected or uncollected pages are a much more common cause of leaks.
How long do you keep my document?
Only as long as it takes to send it. After the transmission, the uploaded file is deleted automatically. We do not keep a copy that we, or anyone else, could open afterwards.
I sent a fax to the wrong number. What now?
If you can work out who owns the number, ask them to shred the pages. Note the time and what was sent, then inform the person in charge of privacy compliance where you work. If the document held personal data, you might need to log the incident and, in some cases, report it; our privacy page walks through the steps.
Can I fax medical documents?
Fax is still common between medical offices, pharmacies and hospitals, and the receiving side often asks for it. Take extra care: verified number, recipient warned, only the necessary pages. The rules of your profession or institution come first, so check them if you are unsure.

Keep exploring

A few pages that go well with the one you just read.

Related questions