Is Fax.Plus Safe?

Yes. Fax.Plus provides documented safeguards for stored documents, account access and connections to its applications. Whether it is appropriate for your information also depends on your plan, security settings, recipient and any connected email or other systems.

Fax.Plus is an online fax service operated by Alohi. This guide explains what its protections cover, which controls require activation or Enterprise, and what to check before sending sensitive documents.

How does Fax.Plus protect your documents?

Stored files use AES-256 encryption, with unique encryption keys for each user. Connections between Fax.Plus web or mobile applications, the API and its servers use TLS; the platform supports TLS 1.3.

Those protections cover different stages. Encryption at rest protects stored files. TLS protects the application-to-server connection. Neither means that a fax is encrypted end to end across every external carrier network and receiving fax machine. The final telephone-network segment has a different security boundary.

The Alohi service-security overview describes these controls and wider safeguards, including infrastructure protection and security testing. Review that evidence against the documents and workflow you intend to use.

Which account controls should you enable?

Two-factor authentication is available on every plan, but it must be activated. Enable it to add a verification step beyond your password. Availability does not mean every account already has it switched on.

For a team, the Owner can enforce two-factor authentication. Enterprise also provides single sign-on, and team roles and number assignments help organize access. Use individual accounts so access can be managed when responsibilities change or someone leaves.

Check the two-factor authentication instructions and role permissions for your setup. A shared password makes individual access harder to manage even when the underlying service offers suitable controls.

What do reports and connection logs prove?

Fax records identify information such as the sender, destination fax number, date, time and transmission status. Confirmation reports provide transmission details, including pages. Enterprise connection logs include device and IP information.

These records help investigate delivery and account activity. They should not be described as an exhaustive audit trail of every document view, download or edit.

A successful fax transmission also does not prove that a person read the document, acted on it or placed it in the correct patient chart. For urgent referrals or deadlines, follow your organization’s procedure for checking that the receiving office has handled the document.

Is Fax.Plus safe for healthcare information?

For protected health information, Fax.Plus’s HIPAA configuration requires Enterprise, enabled Advanced Security Controls (ASC) and a signed Business Associate Agreement (BAA).

The HIPAA eligibility documentation explains those prerequisites. The service’s controls and agreement support your organization’s workflow; staff still need to verify recipients, manage access and handle exported copies appropriately.

For example, decide which front-desk staff can receive records, who reviews incoming referrals and how access changes when an employee leaves. Establish the covered account configuration before uploading patient documents.

How are email and integrations handled under ASC?

With Advanced Security Controls enabled, incoming fax attachments in email notifications are disabled by default. Attachments can be enabled with Owner or Admin consent, individual user activation and a receiving server supporting TLS 1.2 or later.

If the required TLS delivery fails, no replacement email is sent; the fax remains available in the account. Once delivered to your mailbox, an attachment also needs protection through your own email access, retention and forwarding controls.

Authorized members can use the dedicated @tls.fax.plus email-to-fax route. The REST API remains available under ASC; Zapier is unavailable. Check the email attachment requirements and ASC integration restrictions before building a workflow around them.

Where are fax files stored?

Enterprise offers separately selectable locations for stored fax files and backups. These selections do not mean that every processing step, temporary file, metadata item or thumbnail remains in the selected location.

Check the data-residency documentation against your organization’s requirements. Also establish the retention settings and export process you need. Downloaded documents and emailed copies must be included in your own information-handling policy.

What do ISO 27001 and SOC 2 Type 2 mean?

Alohi maintains ISO 27001 certification for its information security management system and a SOC 2 Type 2 report assessing relevant controls over a period of time.

These are different forms of independent assurance. A SOC 2 report is not a product certification, and neither establishes that every customer configuration or disclosure is compliant. During vendor review, examine the scope, period and available documentation alongside your own requirements.

What should you check before sending sensitive information?

Use your own account, enable two-factor authentication and confirm the recipient’s fax number through a trusted source. Review the selected document and destination before sending, then check its transmission status.

For a team, confirm staff permissions, retention and the handling of email or downloaded copies. For healthcare, complete Enterprise, ASC and BAA setup first. Preserve required records before changing providers or closing an account.

Fax.Plus can reduce reliance on shared paper trays and provide managed account access.