Fax Data Residency: Where Your Faxes Are Stored, and How to Choose

Data residency is the physical location where your data is stored. For an online fax service, it answers a simple question your security team will ask: when a fax arrives, where does the file actually live? On Fax.Plus, fax files are stored in Swiss data centers by default, and Enterprise customers can choose a different storage location from more than 40 regions, including the United States, Canada, the UK and the EU, and Asia Pacific.

What is data residency?

Data residency means storing data in a specific geographic location, usually a chosen country or region. Organizations choose a location to meet a law, a contract, or an internal policy that says where certain records may be kept.

Two related terms come up in the same conversations:

• Data sovereignty is about whose rules and control data falls under, while residency is about where it sits. It covers where data is stored, but also who operates the service and what they commit to in your agreement.
• Data localization is a legal requirement to keep certain data inside a country's borders. It's the strictest version of a residency rule.

Residency is the part you control when you pick a provider and a storage region. Which rules you need to follow is a question for your legal or compliance team.

Why data residency matters for fax

Fax is still how a lot of regulated paperwork moves: referrals and lab results in healthcare, contracts and court filings in legal, claims in insurance, and signed forms in finance and government. Those documents often fall under rules about where they may be stored.

That's why data residency requirements show up in vendor security questionnaires and procurement reviews. Before a team can move fax to the cloud, someone usually has to confirm where the fax files will be stored, where backups go, and what, if anything, is processed somewhere else.

Where does Fax.Plus store fax data?

By default, Fax.Plus stores fax files in two Swiss data centers, one in Zurich and one in Geneva. Both operate to ISO 27001 security standards and are part of the Cloud Security Alliance. The Zurich facility sits underground in a former military command center. Personal information is protected by the Swiss Federal Act on Data Protection (FADP).

On the Enterprise plan, account owners and admins can choose a different storage location for the account. They can also choose one location for live data and another for backups. Region choice applies to the whole account, so every team member's faxes follow the same rule.

Which regions can you choose?

Fax.Plus Enterprise offers more than 40 storage locations:

The current list is in the data residency FAQ, and the Alohi data residency page gives an overview.

What moves to your region, and what doesn't

Stored in the region you choose:

• Sent fax files, across your entire team
• Received fax files, across your entire team
• Backups of all fax files, in the region you choose for backups

Not moved to the region you choose:

• Files you upload to send. They're converted into a fax-compatible format, then deleted automatically.
• Fax files in transmission. Temporary copies used while a fax is being sent or received, deleted automatically afterwards.
• Metadata. Information about your faxes and your account, such as fax numbers, timestamps, page counts, delivery status, file names, users, and permissions.
• Thumbnails. Small previews of faxes are cached so they load quickly.

So if your policy requires stored fax documents to stay in the United States, choosing a US region keeps your sent and received fax files, and their backups, in the US. If your policy also covers metadata or data in transit, share this list with your compliance team before you decide. If you need a more detailed breakdown, ask the Fax.Plus team before you sign.

Keep live data and backups in different regions

Fax.Plus lets admins set two locations: one for live data and one for backups. You can keep both in the same data center, or put backups in a second location. For example, a team could store live data in one US data center and backups in another, keeping everything in the US with backups in a separate location.

How to change your data region

On Enterprise, an account owner or admin can change the region from the web app:

1. Go to Settings, then the Security tab.
2. Find Data Residency and click Edit.
3. Choose the location for live data and the location for backups.
4. Click Confirm to start the transfer. You'll get an email with the details.

New faxes are stored in the new region as soon as the migration starts. Faxes you already have move over in the background, which takes anywhere from a few minutes to several days depending on how many you have and how large they are. Your plan's features stay the same after the move.

Other ways to control where your faxes live

Data residency covers where Fax.Plus stores your faxes. If your rules go further, Enterprise has three more options:

• Document retention. Set how many days Fax.Plus keeps sent and received faxes, after which they're permanently deleted. A retention period of 0 days deletes faxes as soon as they're transmitted. Deletion is permanent and can't be undone.
• Your own archive through the API. Use the Fax.Plus API to download faxes and store them on your own servers or private cloud. You can also turn off storing faxes in Fax.Plus, so faxes go to your email and are fetched through the API for archiving elsewhere. If your account uses HIPAA mode, check this setup with the Fax.Plus team first.
• Your own S3-compatible bucket. For high-volume teams, Fax.Plus can deliver each fax straight into an Amazon S3-compatible bucket that you own. Contact sales to set it up.

The help center explains each on-premises storage option in more detail.

Encryption and certifications

Wherever your faxes are stored, they're protected the same way. Fax files at rest are encrypted with 256-bit AES, and data in transit between the Fax.Plus apps, API, and servers is protected with TLS, including support for TLS 1.3.

Alohi, the company behind Fax.Plus, holds ISO 27001 and SOC 2 Type 2 certifications issued by EY CertifyPoint. Its compliance program also covers HIPAA, PHIPA, GDPR, CCPA, and CSA STAR. HIPAA-compliant faxing with a signed BAA is available on Enterprise, alongside data residency. See the Alohi compliance page for details, and our guide to HIPAA fax requirements if you handle patient information.

Questions to ask any fax provider about data residency

Use this list when you compare providers:

1. Where are fax files stored by default, and in which country?
2. Can we choose a storage region, and on which plan?
3. Which exact locations are available?
4. Can backups be stored in a different location from live data?
5. What data is processed or stored outside the chosen region, such as metadata, thumbnails, or files in transit, and for how long?
6. What happens to existing faxes when we change region, and how long does the move take?
7. Can we set a retention period, or archive faxes to our own storage?
8. Which independent certifications cover the data centers and the provider?