Haze Fax

Haze Fax / Security

Who can reach your documents, and for how long.

People fax things they would not email: medical records, signed agreements, court paperwork. This page says plainly how those documents are handled, and it is written to be checkable rather than reassuring.

In transit
Every connection to Haze Fax is over HTTPS, in a browser and in the phone app alike. The carrier fetches a document over HTTPS too.
At rest
Documents are held in Cloudflare R2 and the rest of the account in Supabase’s Postgres. Both encrypt stored data at rest as a property of the platform — that is their guarantee rather than a cryptographic claim of our own, which is the honest way to put it.
A document is never publicly addressable
The storage bucket is private. When a document has to be read — by you, or by the carrier about to send it — a signed URL is minted that expires in fifteen minutes. There is no link to a document that keeps working.
One workspace cannot read another
Access is enforced in the database itself, per workspace, rather than by the application remembering to filter. A query that forgot the filter returns nothing rather than somebody else's faxes.
Signing links are long, random, and expire
A signing link carries 32 bytes of randomness, which is not guessable, and it stops working after 30 days. Expiry is checked when the page is opened, when the document is fetched, and again when the signature is submitted — so a link left open in a tab cannot be used later.
Error reports do not carry your documents
When the software fails we receive a report. It is scrubbed first: the page content and the request body are removed, and what is attached is the account id it happened to — not your email address, and never the document.

The companies involved, all of them

A fax does not travel alone. These seven are the only outside companies that any part of your account passes through, and each one is there for a named reason.

  • Telnyx carries the fax to and from the phone network.
  • Supabase is the database and the sign-in.
  • Cloudflare R2 stores the documents.
  • Stripe takes the payments.
  • Vercel runs the website.
  • Hostinger carries the email we send you.
  • Sentry receives a report when the software fails.

The privacy policy says what each one receives and why, and a test fails the build if a new company is added to the product without being named there.

What we do not claim

Haze Fax is not certified under HIPAA, SOC 2, or any similar scheme, and we do not sign business associate agreements. We have not been audited, so we do not say we have.

We mention it because the word appears freely in this category and it is worth knowing what it means: a certification is an audit by somebody else, and an agreement is a contract that assigns liability. If your work genuinely requires either, ask any provider — including this one — to put it in writing before you send a patient record through it. A provider that will not is telling you something.

Found something?

If you believe you have found a security problem, write to info@hazefax.com with enough detail to reproduce it. We would rather hear about it from you than from somebody else.