Compliant by Design. Secure by Protocol.

Compliance That Starts at the Architecture Level

Most fax compliance conversations begin with certifications and end with a list of controls. With T38Fax, it’s worth starting one level deeper — with how T.38 actually works — because it changes the shape of every compliance question that follows.

T.38 is a real-time fax transmission protocol. When your equipment sends a fax over T38Fax, the data travels through our network in real time and terminates at the destination. We don’t store fax content on our servers. We don’t buffer it, index it, or retain it. There is no database of transmitted documents on our end, because the protocol doesn’t create one. The fax passes through and it’s gone — the same way a phone call works on a traditional POTS line.

This isn’t a policy decision. It’s a consequence of how the protocol operates. And it has direct, meaningful implications for HIPAA, for data security, and for the compliance posture of any organization that handles sensitive documents over fax.

T38Fax Compliance at a Glance

No Business Associate Agreement Required

T38Fax is HIPAA compliant. For healthcare organizations, the most important practical consequence of this is straightforward: a Business Associate Agreement is not required.

Under HIPAA, a vendor that creates, receives, maintains, or transmits Protected Health Information (PHI) on behalf of a Covered Entity is a Business Associate, and a BAA is required. But HIPAA includes an important exception for “conduits” — entities that transmit PHI but do not access or store it. The classic example is a postal carrier: it handles envelopes containing PHI but never opens them, so it is not a Business Associate.

T38Fax operates as a conduit under this exception. When a healthcare organization sends a fax containing PHI over T38Fax, the data passes through our network in real time. We transmit it. We don’t store it, access it, or retain copies of it. Because we don’t maintain PHI — we only move it — HIPAA’s conduit exception applies and the BAA requirement does not.

If your compliance team requires written confirmation of our HIPAA posture, contact our sales team and we can provide documentation for your records.

Independently Audited Security Controls

T38Fax is SOC 2 Type II certified. SOC 2 Type II is an independent audit of a service provider’s security controls conducted by a third-party CPA firm. Unlike a SOC 2 Type I report — which is a point-in-time assessment — Type II covers an extended observation period, typically six to twelve months. It confirms that our security controls were not just designed correctly, but were operating effectively over time.

For enterprise procurement teams evaluating T38Fax, SOC 2 Type II certification means you have independent third-party verification of our security posture — not just our self-attestation. It is increasingly a baseline requirement for vendor approval in enterprise and regulated-industry environments.

Encryption and Private Network Options

For organizations that require encrypted transport between their infrastructure and T38Fax, we offer two options that address different levels of requirement.

IPSec VPN tunnels are available at no additional charge. A VPN tunnel encrypts the SIP signaling and UDPTL media path between your network and our gateways, so fax traffic travels over an encrypted channel end-to-end rather than over the public internet. This is the right option for most organizations with encryption requirements — it adds a meaningful layer of transport security without adding cost or significant configuration complexity.

Private dedicated circuits are available for environments with stricter network isolation requirements. If your security policy prohibits fax traffic from traversing the public internet under any circumstances — as is common in certain government, financial, and defense adjacent environments — we can provision a private MPLS or direct circuit connection between your facility and our network. Additional monthly charges apply for this option; contact our sales team for details and lead times.

Direct Connections for Cloud-Hosted Fax Infrastructure

Organizations running fax servers or fax-capable infrastructure in cloud environments — AWS, Azure, and similar platforms — can connect to T38Fax directly without routing traffic through an on-premises network. Direct cloud interconnects are available for environments where standard SIP over the public internet does not meet your network policy requirements.

If your fax server runs in a hosted environment and you have specific connectivity requirements, contact our sales team to discuss your architecture. We’ve worked through a wide range of hosted configurations and can advise on the right connection model for your setup.

More on T38Fax