Security and privacy at ProntoFax

The short answer

There is no account and no password. You send a fax with an email address and a card.
Your card details go to our payment processor and never reach ProntoFax servers.
Your fax is stored encrypted in private storage and deleted automatically about 30 days after you send it.
Apart from our cloud host, our fax carrier is the only company that receives your document. We do not sell it.

What happens to your fax

The same steps, in words

You add your pages. Photos and PDFs upload over an encrypted connection (TLS 1.2 or newer) into private storage.
We turn each page into a clean black and white image. The original photo is deleted as soon as it is processed. The processed pages are deleted automatically within two days.
Before you pay, we check that the number is a valid US number. If the number is in our directory, we show whose it is.
You enter your email and your card. The card form belongs to our payment processor, so your card number goes straight to them. We place a hold, not a charge.
We put your pages and any cover page together into one fax document and store it encrypted.
Our fax carrier fetches the document through a private link that works for 15 minutes. It then sends the fax to the receiving machine as an ordinary fax call.
When the receiving machine confirms delivery, we charge your card and email your receipt. If the fax fails, we release the hold and email you that it did not go through.
About 30 days later the fax document is deleted automatically. The delivery record stays as your proof of transmission.

Your documents

Your pages and your fax are kept in one private storage area at our cloud host. Public access to it is blocked, it accepts only encrypted connections, and everything in it is encrypted at rest.
Nothing in it is published on the web. A stored fax opens only through your receipt link, which carries a random 256-bit code. Each use gives a viewing link that works for 5 minutes. Keep your receipt link private, because anyone who has it can open your receipt.
Original photos are deleted when they are processed. Processed pages and uploaded PDFs are deleted within two days. The fax document, cover page included, is deleted after about 30 days, and so is the copy that arrives on a test fax. After that, neither you nor we can recover them.
The people who run ProntoFax have administrator access to our cloud account, so it is technically possible for us to open a stored document. Our policy is that we do not open customer documents.
We do not control how long our fax carrier keeps its copy of a fax it sent.

Your email address

We store it encrypted with a key we control, which rotates every year. When we need to match an address, we compare a keyed fingerprint of it instead of the address itself.
We use it for your receipt, a notice if your fax fails, and, for a test fax, the copy that arrived. It is not on a marketing list.
Our emails show only the last 4 digits of the fax number and carry no attachment.
No account is tied to it. It is kept with the record of your fax and is not deleted automatically. Email support@prontofax.com and we will remove it.

Payments

On ProntoFax the card form is provided by our payment processor, and in an AI assistant you pay on the processor's own checkout page. Either way, ProntoFax never receives your card number.
We keep the processor's reference for your payment and the amount charged.
You are charged only when the receiving machine confirms delivery.

The fax line itself

The last step is an ordinary fax call over the phone network, and fax calls are not encrypted the way a web connection is. Once your fax arrives, the receiving machine or service holds it, and we cannot control who reads it there.
Check the number before you send. A fax sent to the wrong number cannot be called back.

Analytics and recordings

The send flow loads measurement tools through a tag manager. They include web analytics, a session recording tool that replays clicks, scrolling and what was on screen, and the advertising pixel described in our privacy policy.
In recordings, we mask page images and the page preview, the fax number wherever it appears, the email box, the cover page fields and the coupon box. Card fields sit inside the payment processor's form, which these tools cannot read.
Our own analytics events carry the steps you reach, the page count, and for a paid fax its id and amount. They do not carry your fax number, email or document. If you arrive through a link that already contains the fax number, these tools may see it in the page address before we remove it.
Like most websites, our servers log the IP address of each request. Those logs are deleted after 90 days at most.

HIPAA and ProntoFax

HIPAA applies to health care providers, health plans and the companies that work for them. It does not restrict you from sending your own records, so you can fax your own medical or insurance paperwork with ProntoFax.

If you are a provider, a health plan or a business handling patient information on their behalf, do not send that information through ProntoFax. We do not sign business associate agreements today.

Who we work with

Our cloud host stores your pages, your fax and our database, in the United States.
Our fax carrier receives your fax document and the fax number, to send it.
Our payment processor receives your card details and the amount, and your email address when you pay inside an AI assistant.
Our email provider receives your email address and the receipt or notice we send you.
Measurement tools receive page usage, as described above.
AI assistants, if you use one, see the fax number and agency you ask about, not your pages, email or card.

Report a security problem

If you find a security problem, email support@prontofax.com with what you found and how to reproduce it.

Last reviewed 10-08-2026