Security and privacy

Who can get in

• Your Microsoft 365 sign-in. Staff sign in with their work Microsoft account, so your organization's password rules and two-step sign-in (MFA) apply. There are no separate passwords to manage or leak.
• Only your office. Each office sees only its own faxes. Your office admin can limit sign-in to a named list of people.
• Automatic sign-out after a period of inactivity your office chooses, for shared or unattended computers.
• Freedom Tech access is limited to our support staff, and everything we open is recorded in your Activity log like anyone else.

Encryption

• In transit: every connection to the portal, and between the portal and the fax carrier, uses HTTPS (TLS).
• At rest: fax documents and records are stored encrypted on Cloudflare's infrastructure.
• On the phone network: the last leg of any fax, from the carrier to the other party's fax machine, travels over the public phone network the way all faxes do, which is not encrypted. Fax remains a widely accepted channel for confidential documents because it goes point to point rather than into someone else's mailbox.

Email

• Link-only notifications. Your office can choose to be emailed a notice and a link when a fax arrives, with no document attached. Opening it requires signing in, and every view is recorded.
• Secure links for people outside your office. Instead of attaching a fax to an email, staff can send a secure link. Before the document opens, the recipient enters a one-time code emailed to the same address, so a forwarded or leaked link is useless to anyone else. Links expire, can be opened a limited number of times, and can be turned off at any time.
• Emails are sent from noreply@freedomtech.us over encrypted connections between mail servers.

A record of everything

• Every fax has a History: when it arrived, who it was emailed to, and who opened, downloaded, printed, forwarded, signed or changed it, with the time and the computer's internet address.
• An office-wide Activity log adds sign-ins and settings changes. Both can be filtered and downloaded as a spreadsheet.
• Secure links record when the recipient asked for a code, entered it, and opened the document.

Keeping and removing faxes

• Your office chooses how long documents are kept, from 30 days to 7 years, or forever. After that, the document is permanently deleted and only a record of the fax remains.
• Automatic archiving moves older faxes out of the Inbox while keeping them searchable.
• Junk-fax screening keeps unsolicited faxes out of your Inbox and your email.

Who handles your data

Making faxes searchable happens inside your own web browser: fax pages are not sent to any outside service to be read. Caller names for incoming numbers are looked up through Telnyx, our carrier; to show a sender's home town, only their area code and exchange are checked against a public directory.

Common questions

Is it HIPAA compliant?

The portal includes the safeguards HIPAA expects: individual sign-in, access limits, encryption in transit and at rest, audit logs, and retention controls. Whether a service is "compliant" also depends on agreements and on how your office uses it. If you handle protected health information, talk with us about your requirements.

Can a fax be emailed instead?

Yes, as a secure link with a one-time code, never as an attachment. Your office can turn this off.

What if someone leaves the office?

Disable their Microsoft 365 account as usual and they can't sign in again. If your office limits sign-in to a named list, removing them from that list cuts off access right away, even on a computer that is still signed in. Otherwise an open session ends at your office's automatic sign-out time.