Choosing an online fax provider: 10 criteria

Short answer: online fax services all look alike on the pricing page and diverge radically in their terms and conditions. Ten criteria are enough to tell them apart: the hosting location of your documents, encryption in transit and at rest, the retention period for files and logs, the availability of a detailed, exportable transmission receipt, formal GDPR processor status backed by a contract, certification as a health data host (HDS) if you are a healthcare professional, number portability, exit rights covering your archives at the end of the contract, the quality of support with a real human you can reach, and finally the actual pricing structure (pages, destinations, inbound numbers, overages). A €2-a-month service that wipes your sent items after thirty days and signs no data processing agreement will cost you far more the day a dispute or an audit lands. The right reflex: read the terms before the price list.

Why choosing a provider is a compliance decision

When you send a fax from a machine plugged into a phone line, nobody stores your document: it leaves, it arrives, the original stays in the tray. With an online service, everything changes. Your document passes through a third party's servers, is converted there, often retained, indexed, backed up, sometimes replicated across several data centres. You are no longer merely an operator's customer: you are a data controller entrusting data to a processor within the meaning of Article 28 of the GDPR.

This shift has three very concrete consequences.

First, you must be able to document who processes your data, where, and with what safeguards. A CNIL inspection, a client audit, an ISO 27001 certification in progress: in every one of these cases, you will be asked for the data processing agreement and the list of sub-processors. A service that offers none puts you in breach, not itself.

Next, the evidential value of what you send now depends on the quality of the provider's logs. We cover elsewhere what a transmission report is really worth before a judge; the point to remember here is that a bare-bones receipt, non-exportable, deleted after a few weeks, will be of no use to you three years later.

Finally, there is the risk of lock-in. A fax number appears on your prescriptions, your letterheads, your company registration extract, professional directories, your clients' files. If it is not portable, changing provider means changing number — and discovering, months later, documents sent into the void by correspondents who never updated their address book.

The ten criteria, in the order that matters

1. Where documents are hosted

This is the first filter, and it eliminates a lot of candidates. Ask explicitly: in which country are the files and metadata stored? Hosting within the European Union avoids questions about transfers outside the EU. Hosting with a US provider, even on servers physically located in Frankfurt or Paris, raises the question of the extraterritorial reach of the Cloud Act. That is not a deal-breaker for an SME faxing purchase orders; it often is for a law firm, a notary or a healthcare facility.

The criterion is verifiable: the terms or the privacy policy should name the countries, not settle for "our secure servers".

2. Encryption, in transit and at rest

Two distinct moments, two distinct guarantees.

• In transit: the connection between your browser or mail client and the platform must use TLS. That is the absolute minimum, checkable in three seconds in the address bar.
• At rest: are the files stored on the servers encrypted? With which keys, managed by whom?

Watch out for the well-known weak link: the last mile remains analogue. The fax reaches the recipient over the telephone network, unencrypted. The provider's encryption protects your document in the cloud, not on the final leg. This is a structural limitation of fax, not a flaw in any particular provider, and it explains why certain sensitive transmissions should go through secure messaging instead.

3. Retention period — and the ability to set it

Many consumer offerings keep documents "for as long as your account is active", which is convenient but contrary to the data minimisation principle. Others purge after thirty days, which is compliant but destructive if you have archived nothing on your side.

A good service lets you choose: automatic purge after X days for content, longer retention for transmission logs alone. That is precisely the split we recommend in our guide on archiving faxes and evidential value over ten years: the content lives in your archiving system, the proof of sending lives in the log.

4. The quality of the transmission receipt

A useful receipt states at minimum: date and time with time zone, number called, calling number, number of pages transmitted, call duration, outcome (OK / failure / busy), session identifier, and ideally a document hash or a thumbnail of the first page.

Test before signing: send a fax, export the receipt. If it comes out as a screenshot or as unprintable HTML, walk away. A receipt must be producible as a PDF, attachable to a file, submittable in proceedings.

5. The GDPR data processing agreement

A simple question: does the provider offer a signed DPA (Data Processing Agreement), available without negotiation? Serious providers publish it as a download or fold it into their terms with the Article 28 content: subject matter, duration, nature of processing, categories of data subjects, staff confidentiality obligations, list of sub-processors, fate of data at the end of the contract, assistance in the event of a breach.

This is also the point at which you check whether an identifiable data protection officer exists. The CNIL publishes model processing clauses on its website that let you compare point by point.

6. HDS certification for health data

If you are a doctor, pharmacist, laboratory, self-employed nurse or healthcare facility, your faxes contain health data. Hosting them with a third party then falls under Article L. 1111-8 of the French Public Health Code: the host must be HDS-certified. The list of certified hosts is published by the Agence du numérique en santé.

A general-purpose, uncertified online fax service is not an acceptable choice for transmitting test reports or prescriptions. We develop this point in the article devoted to medical faxing and health data.

7. Portability of the inbound number

Ask the question before subscribing, not after: can I port my current number to your service, and will I be able to port it elsewhere tomorrow? Number portability is a right regulated by ARCEP, but not every online fax service provides genuine portable geographic numbers — some assign technical numbers tied to their platform, which you will lose when you leave.

If you are moving a long-established, widely circulated number, plan an overlap period: keep the old one active for a few months while you update your materials. A set of customisable self-inking stamps helps you quickly correct the letterheads of remaining paper documents, and a pack of printable adhesive labels lets you cover up old contact details on already-printed brochures without reprinting everything.

8. Exit rights: what do you take with you?

This is the most neglected and most expensive criterion. Read the end-of-contract clause and look for three answers:

1. In what format can I export the history — individual PDFs, a ZIP archive, a CSV log file, an API?
2. For how long after termination does the data remain accessible?
3. Is the export free or billed by volume?

A service that only lets you export page by page, manually, from a web interface, is a service you will never leave cleanly if you have five thousand transmissions behind you. Plan ahead: even with a good provider, export your logs periodically and store them off-platform. An encrypted external hard drive or a two-bay backup NAS is enough for a small organisation, provided you test the restore at least once a year.

9. Support: human, reachable, speaking your language

A fax that fails to go out the day before a deadline is a one-hour problem or a one-week problem depending on the support. Check before signing:

• is there a phone number, or only a contact form?
• what response-time commitment is offered, if any?
• does support speak your language, and does it know the local specifics (short numbers, dialling codes, the PSTN switch-off)?
• is there a public service status page listing ongoing incidents?

That last point says a lot. A provider who publishes its incidents owns its operations; one who publishes none will leave you guessing whether the outage is yours or theirs. Our article on the 24-hour continuity plan sets out what you should have ready on your side when the service goes down.

10. The real pricing structure

The advertised price is almost always a teaser. The line items that make the invoice diverge:

Does a failed send count as a billable page? With some providers, yes — and a busy line retried five times can cost you five pages. Ask for it in writing.

Three profiles, three different trade-offs

The occasional private individual — a few faxes a year to a government office, an insurer, a landlord. Priority: simplicity and no commitment. Criteria 1, 4 and 10 are enough. There is no point paying for a permanent inbound number for three transmissions.

The independent professional — lawyer, notary, accountant, doctor. Priority: confidentiality, a data processing agreement, controlled retention, HDS where applicable. Criteria 1, 2, 5, 6 and 8 are deal-breakers. Price comes a distant last: the difference between two offerings amounts to tens of euros a year, the cost of a confidentiality incident to thousands. A cross-cut document shredder remains, in these practices, the indispensable complement to going digital: pages that are scanned and then destroyed must not resurface from the waste bin.

The SME with volume — several hundred pages a month, several departments. Priority: integration (API, send by email, connector to the document management system), multi-user administration, bulk-exportable logs, exit rights. Criteria 7, 8 and 10 dominate. At this level, a duplex scanner with an automatic document feeder pays for itself within weeks on handling time alone.

The ten-minute subscription checklist

Before you enter a payment method:

1. Open the terms and search for "personal data", "retention", "termination".
2. Look for the "compliance" or "GDPR" page: is there a downloadable DPA?
3. Identify the publishing company, its country of establishment, its registration number.
4. Try the free send if one is offered, then export the receipt you get.
5. Send a question to support and time the reply.
6. Check the renewal clause and the notice period.
7. Record the new processor in your record of processing activities.

Seven steps, ten minutes, and you avoid most nasty surprises. For practical questions about sending and coverage, our FAQ and the list of available countries usefully complete this framework.

Frequently asked questions

Can a free online fax service be GDPR-compliant?

Yes, being free is not in itself a compliance failing. What matters is the business model: a free service funded by contextual advertising or by exploiting data would be problematic; a free service with limited volume, acting as an on-ramp to a paid plan, is not. Read the privacy policy: if it mentions sharing data for marketing purposes, rule it out for any sensitive document.

Can I use the same provider for health data and for everything else?

Only if it is HDS-certified. The certification covers hosting, not use: if the provider holds it, nothing stops you from routing your invoices through it as well. The reverse is not true — an uncertified general-purpose provider cannot host your medical reports, not even occasionally.

What is a provider-generated transmission receipt worth in court?

It is prima facie evidence, whose weight depends on its precision and on the credibility of its issuer. A detailed, timestamped, exportable log, corroborated by other elements (a follow-up, the recipient's reply, a mention in a case file), genuinely carries weight. A simple "sent" displayed on screen carries none. That is why criterion 4 matters more than price.

How long should I keep my transmission logs?

Align yourself with the limitation period applicable to the underlying relationship: five years for commercial matters, ten years for certain accounting obligations and for builders' liability, longer for medical records. Keep the logs for a long time, purge the content sooner: the log proves the transmission without exposing the document.

What if my provider shuts down overnight?

That is the scenario criterion 8 anticipates. Without regular exports on your side, you lose everything — a company's liquidation obliges nobody to keep a service running. Hence the rule: export your logs at least once a quarter and keep them off the platform, in your own archive.

In summary

• The online fax provider is a processor within the meaning of the GDPR: the choice is a compliance matter, not just a budget one.
• The deal-breaker criteria are hosting, encryption, the data processing agreement and, for healthcare, HDS certification.
• The quality of the transmission receipt determines the evidential value of every future transmission.
• Number portability and archive exit rights prevent lock-in: check them before subscribing, never after.
• The advertised price often lies: look at overages, destinations, inbound numbers and automatic renewal.
• Match your requirements to your profile: an occasional private user does not face the same obligations as a professional practice or a high-volume SME.
• Whatever the provider, export your logs regularly and keep them in your own archiving system.