Security and Trust

Your Controls Deserve More Than a Badge

Start with your Microsoft identity and your SharePoint documents. Then review the evidence, responsibilities and deployment scope behind the service.

SOC 2 completedSites.Selected scopeDocuments stay in your tenant
Where a Fax LivesIllustration
Fax networktransmission providerSharePoint Faxmetadata onlyno fax archiveYour Microsoft 365 tenantoriginal documents · retention · access
Identity
Microsoft Entra groups
App access
Sites.Selected
Storage
Your SharePoint
Corporate Assurance
SOC 2 Completed

A company-level statement, not a separate SharePoint Fax Type II report. Request the report and review its scope for your procurement process. Visit the Trust Center ↗

The Access Model

Six Things to Check in Your Review

0 / 6reviewed as you scroll
01

Customer-Owned Document Storage

SharePoint is the durable home for original fax documents, workflow records and routing policy. Your Microsoft tenant stays central to document access and retention configuration.

storage: your tenant
02

Group-Aware Authorization

Microsoft Entra security groups map to department libraries. A dedicated Fax Administrators group supports oversight. Commercial account access alone grants no right to read fax documents.

authz: Entra groups
03

Verified Library Permissions

Library verification detects missing group grants, unexpected access and folder inheritance drift. Site Owners remain in place; your IT manages the actual SharePoint permissions.

drift: detected + flagged
04

Scoped Microsoft Application Access

The Microsoft connection uses Sites.Selected application access to the approved site, plus delegated permissions for signed-in workflows. Your administrator reviews and approves these.

scope: Sites.Selected
05

Operational Accountability

Signature verification protects provider callbacks. Send reconciliation addresses ambiguous outcomes before resubmission. Workflow and audit history stay with your records in SharePoint.

callbacks: signature-verified
06

A Defined Processing Boundary

The service retains approved operational metadata, not a second durable fax archive. Transmission providers and transient processing still participate in delivery. Review the full deployment and provider scope with us.

retained: metadata only
Healthcare Deployments

HIPAA-Aligned Safeguards
A BAA Before PHI

We are completing the SharePoint Fax HIPAA readiness process. The company trust program describes HIPAA-aligned deployments with a signed BAA; a customer's production use must be reviewed and agreed separately.

HIPAA is not a product certification. We do not represent an unsigned customer BAA as already executed.

Before Any PHI0 / 4
Execute the applicable BAA before sending protected health information
Confirm provider agreements and covered services for the fax processing chain
Configure Microsoft access, retention and operating procedures for your obligations
Keep optional AI processing off unless separately reviewed and approved
Let's Move Fax Forward

Your Next Fax Belongs in SharePoint

Let's build a workspace around your organization.