Terms of Service

Version 2026-10-12.1. These terms include the Business Associate Agreement in Exhibit A.

1. Agreement

These Terms of Service ("Terms") are an agreement between the organization that creates an account ("Customer") and DocuFax ("Provider") for the use of DocuFax (the "Service"). The person who creates the account confirms that they are authorized to accept these Terms, and the Business Associate Agreement in Exhibit A, on Customer's behalf. If you are not authorized, do not create an account.

2. The Service

The Service lets Customer send and receive faxes through a web application and, on plans that include it, through an API and connected integrations. The features, page allowances and limits of each plan are described on the pricing page and form part of these Terms.

Fax delivery depends on telephone networks and on the receiving machine, which Provider does not control. Provider does not guarantee that any particular fax will be delivered or delivered by a particular time. The Service shows the delivery result for each fax; Customer is responsible for checking it and for using another method when a document is urgent. The Service is not an emergency communication system.

3. Protected Health Information

The Business Associate Agreement in Exhibit A ("BAA") is part of these Terms and is accepted together with them. It governs all Protected Health Information that Customer sends, receives or stores through the Service, on every plan. If the BAA and the rest of these Terms conflict, the BAA controls with respect to Protected Health Information.

4. Accounts and security

Customer is responsible for everything done under its account. Customer will keep its users' details accurate, require each person to use their own sign-in, keep credentials, recovery codes and API keys confidential, remove users who no longer need access, and tell Provider promptly at support@xstackhost.com if it suspects unauthorized access. Provider may require two-step verification.

5. Acceptable use

Customer will not use the Service to:

• send unsolicited advertisements or any fax that violates the Telephone Consumer Protection Act, the Junk Fax Prevention Act or similar laws;
• send anything unlawful, fraudulent, harassing or infringing;
• send faxes without accurate sender identification where the law requires it;
• interfere with the Service, probe it for weaknesses without written permission, or get around its limits; or
• resell the Service without Provider's written agreement.

Provider may suspend an account that it reasonably believes is breaking this section or putting the Service or other customers at risk, and will tell Customer when it does.

6. Plans, fees and payment

Paid plans are billed monthly in advance in US dollars and renew each month until cancelled. Each plan includes a monthly allowance of pages; pages sent and pages received both count, and unused pages do not carry over. Pages beyond the allowance are charged per page at the rate shown on the pricing page and added to the next invoice. The pay-as-you-go plan has no allowance: every page is charged at the per-page rate shown on the pricing page (pages sent to numbers outside the United States and Canada at the international rate), and each fax number is charged a monthly fee, all billed monthly. Prices exclude taxes, which are added where they apply.

Customer authorizes Provider's payment processor to charge its payment method for these amounts. Customer can change or cancel its plan at any time from the Billing page; cancellation takes effect at the end of the paid month, and fees already paid are not refunded except where the law requires. If a payment fails, Provider may limit the account to its included allowance or suspend sending until it is paid. Provider may change prices with at least 30 days' notice, effective from the next billing month.

7. Fax numbers

Fax numbers are assigned to Customer for use with the Service while the account is active. Provider may reclaim a number when the account ends or has been unpaid for 30 days. Where the carrier allows it, Provider will cooperate with a request to port a number in or out.

8. Customer's documents

Customer keeps all rights in the documents it sends and receives and the files it stores in the Service. Provider uses them only to provide the Service and as the BAA allows. Documents are deleted automatically at the end of the retention period Customer sets in its settings, and can be deleted sooner by an administrator; deleted documents cannot be recovered. If Customer switches on zero retention, documents are not kept at all as described in the settings, and a received fax that is not downloaded within the stated time is deleted unread. The Service is not an archive, and Customer is responsible for keeping its own copy of anything it must retain.

9. Integrations and the API

If Customer connects a third-party service, such as a messaging workspace or an AI assistant, or uses the API, Customer decides what is sent there. A document that Customer or its users choose to send to a third-party service leaves the Service and is then governed by Customer's agreement with that third party, not by these Terms. Customer is responsible for having a business associate agreement with that third party where HIPAA requires one.

10. Confidentiality

Each party will protect the other's non-public information with reasonable care and use it only for the purposes of these Terms. For Protected Health Information, the BAA applies instead of this section.

11. Disclaimers

Provider will provide the Service with reasonable skill and care. Beyond that and the commitments in the BAA, the Service is provided "as is", and Provider disclaims all implied warranties, including merchantability, fitness for a particular purpose and non-infringement, to the extent the law allows. Using the Service does not by itself make Customer compliant with HIPAA; that also depends on Customer's own policies, training and use.

12. Limitation of liability

To the extent the law allows, neither party is liable to the other for indirect, incidental, special, consequential or punitive damages, or for lost profits or revenue. Each party's total liability arising out of these Terms is limited to the fees Customer paid for the Service in the 12 months before the event giving rise to the claim. These limits do not apply to Customer's obligation to pay fees, to a party's fraud or willful misconduct, or to liability that cannot be limited by law.

13. Indemnity

Customer will defend and indemnify Provider against third-party claims arising from the content of faxes Customer sends, from the numbers Customer sends them to, or from Customer's breach of section 5. Provider will defend and indemnify Customer against third-party claims that the Service itself infringes that party's intellectual property rights.

14. Term and termination

These Terms apply from sign-up until the account is closed. Customer may close its account at any time. Provider may close an account on 30 days' notice, or sooner for non-payment or a material breach that is not cured within 30 days of notice. When an account closes, Customer's documents are returned or destroyed as the BAA describes. Sections 6 (for amounts already owed), 10, 11, 12, 13 and 16 continue after termination.

15. Changes

Provider may update these Terms. It will post the new version here with a new version date and give account owners at least 30 days' notice of any change that reduces Customer's rights, unless a shorter period is needed to comply with the law. Continuing to use the Service after the change takes effect is acceptance of it.

16. General

These Terms, the pricing page and the BAA are the whole agreement between the parties about the Service. If part of these Terms cannot be enforced, the rest remains in effect. Neither party may assign these Terms without the other's consent, except to a successor to its business that accepts them in writing. Notices to Customer go to the account owner's email address; notices to Provider go to support@xstackhost.com.

Exhibit A: Business Associate Agreement

Version 2026-10-09.2. Also available on its own at /baa.

A1. Parties, purpose and definitions

This Business Associate Agreement ("BAA") is between the customer organization that creates an account ("Customer") and DocuFax ("Provider"). It applies whenever Customer uses DocuFax (the "Service") to create, receive, maintain or transmit Protected Health Information ("PHI").

If Customer is a Covered Entity, Provider acts as its Business Associate. If Customer is itself a Business Associate of a Covered Entity, Provider acts as Customer's subcontractor Business Associate, and this BAA applies in the same way. "HIPAA" means the Health Insurance Portability and Accountability Act of 1996, the HITECH Act, and the Privacy, Security and Breach Notification Rules at 45 CFR Parts 160 and 164. Capitalized terms not defined here have the meanings given in HIPAA.

A2. Permitted uses and disclosures

Provider may use and disclose PHI only:

• to provide the Service to Customer, including transmitting faxes to the numbers Customer's users enter and delivering received faxes to Customer's account;
• as Customer directs through the Service, for example by sending a document to a connected integration that Customer has switched on;
• for Provider's own proper management and administration and to carry out its legal responsibilities, as permitted by 45 CFR 164.504(e)(4); and
• as Required by Law.

Provider will not use or disclose PHI in any way that would violate Subpart E of 45 CFR Part 164 if done by Customer, will limit its uses and disclosures to the minimum necessary, and will not sell PHI, use it for marketing, or use it to build profiles of individuals. Provider does not de-identify PHI or aggregate it across customers.

A3. Safeguards

Provider will use appropriate administrative, physical and technical safeguards, and will comply with Subpart C of 45 CFR Part 164 with respect to electronic PHI, to prevent any use or disclosure of PHI other than as this BAA allows. The safeguards in the Service include encryption of stored documents with a separate key for each customer organization, encryption in transit to and from the web application, unique user identification, two-step verification, automatic logoff, role-based access, an audit trail that cannot be edited, and automatic deletion of documents after the retention period Customer sets.

Fax transmission over the public telephone network is not encrypted. That is a property of fax itself and not something Provider can change.

A4. Reporting incidents and breaches

Provider will report to Customer, without unreasonable delay and no later than 30 days after discovery:

• any use or disclosure of PHI that this BAA does not permit;
• any Security Incident that results in unauthorized access to, or use, disclosure, modification or destruction of, PHI; and
• any Breach of Unsecured PHI.

A report of a Breach will include, to the extent known, the information required by 45 CFR 164.410(c): the individuals affected, what happened and when, the types of PHI involved, and what Provider is doing in response. Provider will supplement the report as it learns more and will take reasonable steps to mitigate any harmful effect.

This section is itself notice that unsuccessful Security Incidents happen routinely, such as port scans, failed sign-in attempts and blocked requests. No further report of these will be made as long as no PHI was accessed, used or disclosed.

A5. Subcontractors

Provider will ensure that every subcontractor that creates, receives, maintains or transmits PHI on Provider's behalf agrees in writing to restrictions and conditions at least as protective as those in this BAA. A third-party service that Customer chooses to connect to its account is not a subcontractor of Provider, and Customer is responsible for its own agreement with that service.

A6. Individual rights

The Service does not hold a Designated Record Set for Customer; it holds copies of the faxes Customer sends and receives. Within 15 days of a written request, Provider will:

• make PHI it maintains available to Customer so that Customer can respond to a request for access under 45 CFR 164.524;
• make PHI available for amendment, and incorporate amendments Customer directs, under 45 CFR 164.526; and
• give Customer the information it needs to provide an accounting of disclosures under 45 CFR 164.528. The audit trail in the Service records each transmission, view, download and deletion.

If an individual contacts Provider directly about their PHI, Provider will refer the request to Customer and will not respond to the individual itself unless Required by Law.

A7. Other obligations of Provider

To the extent Provider carries out any obligation of Customer under Subpart E of 45 CFR Part 164, Provider will comply with the requirements that apply to Customer in performing that obligation. Provider will make its internal practices, books and records relating to PHI available to the Secretary of Health and Human Services for the purpose of determining compliance with HIPAA.

A8. Customer responsibilities

Customer is responsible for:

• the accuracy of the destination fax numbers its users enter, and for confirming that a recipient is entitled to receive what is sent;
• managing its users and their roles, removing users who leave, and safeguarding sign-in credentials, recovery codes and API keys;
• the retention period it sets, and for keeping its own copy of any document it must retain for longer;
• any document it downloads, exports or sends to a connected integration, once that document has left the Service;
• having any consent, authorization or notice required for the PHI it sends; and
• not asking Provider to use or disclose PHI in a way that would violate HIPAA if Customer did it.

Customer will tell Provider about any restriction, change in or revocation of an individual's permission, or limitation in its notice of privacy practices, to the extent it affects Provider's use or disclosure of PHI.

A9. Term and termination

This BAA takes effect when Customer accepts it and stays in effect for as long as Customer has an account. If either party learns of a material breach of this BAA by the other, it may give written notice and, if the breach is not cured within 30 days, terminate the account. Either party may terminate immediately if cure is not possible.

When the account ends, Provider will return or destroy all PHI it maintains for Customer within 30 days and keep no copies, other than in backups that are overwritten on their normal cycle and in the audit trail, which records events and not document contents. Where return or destruction is not feasible, the protections of this BAA continue to apply to that PHI and Provider will limit any further use or disclosure to the purposes that make return or destruction infeasible.

A10. General

If this BAA conflicts with the Terms of Service or any other agreement between the parties, this BAA controls with respect to PHI. Any ambiguity is resolved in favor of a meaning that permits both parties to comply with HIPAA. If HIPAA changes in a way that makes this BAA insufficient, the parties will amend it to conform, and Provider may do so by publishing an updated version and notifying Customer. Nothing in this BAA gives rights to anyone other than the parties. Sections A4 and A9 continue to apply after termination for as long as Provider holds any of Customer's PHI.