By Alexey Spasskiy · Published June 8, 2025 · 10 min read
Quick answer: Data residency is the physical location (the country, and often the region) where your data is stored and processed. For a fax, that means wherever your fax service keeps the document, its backups and its receipts, plus whatever holds the copy at the recipient's end. mFax stores faxes and documents encrypted on servers in the United States, and on mFax Business PHI is stored and processed in the US under a signed BAA.
Sooner or later a vendor questionnaire asks it: where exactly is our data stored? Cloud software makes documents feel placeless, yet every file sits on a disk in a building in some country. That address is what data residency describes, and for most software the answer fits in one line of a contract.
Fax needs a few more lines, because a fax doesn't stay in one place. It is uploaded, converted, stored, dialed across the phone network and printed or saved at the other end. This guide covers what data residency means, how it differs from data sovereignty and data localization, which rules really require data to stay in a country (fewer than most people expect), and where a faxed document lives at each step. It ends with the questions to put to any fax provider, and with mFax's own answers.
What Is Data Residency?
Data residency is the geographic location where data is stored and processed: the country, and often the region or data center, of the servers that hold it. The term covers more than the main copy. Backups, replicas, logs and the machines that convert or analyze a file all have locations too, and a complete residency answer includes them.
Residency starts as a plain fact: your files are in Virginia, Frankfurt or Sydney. It becomes a requirement when something says they must stay there:
- A law or regulation. Usually a narrow one, written for a sector or a type of data: government data, tax data, a national health record system.
- A contract. A hospital, an insurer or a government agency can write a storage location into its vendor agreement or its business associate agreement.
- Internal policy. Many organizations set their own rule, such as keeping client files in the clients' country, to make audits and risk reviews simpler.
For fax, the question often arrives by the second route: a customer's security questionnaire asks where documents are stored, and the answer has to be in writing.
Data Residency vs. Data Sovereignty vs. Data Localization
Residency is where the data is. Sovereignty is whose laws apply to it. Localization is a rule that it must stay in a country. The three terms get used interchangeably, but they answer different questions:
| Data residency | Data sovereignty | Data localization | |
|---|---|---|---|
| The question | Where is the data stored and processed? | Whose laws and courts can reach the data? | Must the data legally stay in the country? |
| What decides it | The provider's infrastructure, and your choice of provider | Where the data sits and the legal home of the company that controls it | A specific statute or regulation |
| Example | "Faxes are stored on servers in the United States" | A US court order to a provider for data it controls abroad | China's PIPL requires certain organizations to store personal information collected in China inside China |
The middle column is where buyers get caught out, because residency doesn't settle sovereignty by itself. Under the US CLOUD Act, a provider served with US legal process must produce data within its "possession, custody, or control, regardless of whether" that data is located inside or outside the United States (18 U.S.C. § 2713). The company's legal home, not only the server's address, decides whose courts can compel it.
So a full answer has two halves: which country the servers are in, and which country's law governs the company running them. Ask for both.
Data Residency Requirements: Which Laws Actually Set Them?
Fewer than most people assume. The big privacy frameworks mostly regulate how data is protected and when it may leave a country, not where it must sit. The strict residency rules tend to cover narrow categories: government data, federal tax information, one national health record system, large volumes of personal data in a few countries.
| Rule | Who it binds | What it says about location |
|---|---|---|
| HIPAA (US) | Covered entities and their business associates | No storage-location rule. A cloud provider may store ePHI outside the US if a BAA is in place and the HIPAA Rules are otherwise met; the location belongs in the risk analysis (HHS cloud guidance, question 9) |
| GDPR (EU/EEA) | Organizations processing EU personal data | No EU-only storage rule. Transfers out of the EEA need an adequacy decision (Canada's commercial sector and US companies in the EU-US Data Privacy Framework have one) or safeguards such as the Commission's standard contractual clauses |
| PIPEDA (Canada) | Private-sector organizations | Doesn't prohibit sending personal information abroad for processing; the organization stays accountable and must secure "a comparable level of protection" by contract (OPC guidelines) |
| DFARS 252.239-7010 (US) | Contractors providing cloud services to the Department of Defense | Government data not on DoD premises stays in the United States or outlying areas unless the contracting officer approves another location (clause text) |
| IRS Publication 1075 (US) | Government agencies and their contractors that receive federal tax information (FTI) | FTI must not be received, processed, stored, accessed or transmitted by IT systems located offshore (Pub. 1075, Rev. 11-2021, §2.C.7) |
| PIPL, Article 40 (China) | Critical information infrastructure operators, and organizations handling personal information above state-set volumes | Personal information collected and produced in China is stored in China; taking it abroad needs a state security assessment (translation) |
| My Health Records Act 2012 (Australia) | Operators of the national My Health Record system | Section 77: "Requirement not to hold or take records outside Australia" (legislation) |
Three things stand out for anyone who faxes:
- HIPAA does not require US storage. It requires a BAA with any vendor that stores PHI, and a risk analysis that accounts for where that vendor keeps it. A vendor that keeps PHI in the US makes that analysis shorter; it isn't what the law demands.
- The strictest US rules cover government work. IRS Publication 1075 even has a section on fax (§3.3.3): an agency that allows federal tax information in faxes needs a written fax policy, and "if digital fax servers are used, they should be hardened like other servers containing FTI."
- Provinces and contracts can be stricter than national law. The OPC guidelines expressly leave out public-sector bodies and provincial private-sector laws, so a Canadian hospital or agency should check its own province's statute. And if a customer's contract says "US only", that clause is your requirement, whatever the statute says.
Where Does a Fax Actually Live?
A faxed document exists in up to five places, and you control only some of them. This is where fax differs from ordinary cloud storage: it isn't one file in one data center but a series of copies along a route.
Your device
The original lives where you scanned, signed or saved it: a phone, a laptop, a shared drive, the office copier. If all you need is to sign or fill in a form before faxing, use a tool that doesn't upload it. mFax's free PDF editor opens, edits and saves the PDF in your own browser, so the file never travels to mFax or anyone else.
Your fax provider's servers
Upload a document to an online fax service and it is converted into fax pages and stored, usually for as long as it sits in your sent history. Received faxes land here too, as PDFs. This is the location a provider's data residency statement describes, and the one you choose by choosing the provider.
Backups, logs and receipts
Copies made for resilience have their own addresses. Some providers keep live data in one region and backups in another; Fax.Plus, for example, lets Enterprise admins choose the two separately. Delivery receipts, logs and notification emails are data too, so ask what each contains and where it is kept.
The phone network
The transmission itself is a phone call from a telecom carrier to the receiving machine. A carrier that only carries the call is what HHS calls a conduit: a "transmission-only" service whose storage is "temporary" and "incident to such transmission." A fax service that keeps your faxes is not a conduit. It is a business associate, and it needs a BAA.
The recipient's end
Once the receiving machine confirms the pages, that copy follows the recipient's setup, not yours. It may print on a fax machine, sit on the hard drive of an office copier (the FTC notes that those drives store data about the documents they copy, print, scan, fax or email), arrive in the recipient's own online fax account, or be forwarded to an inbox.
Residency is per copy, not per fax
A provider's residency statement covers steps 2 and 3. Step 1 is your office, step 4 is transient, and step 5 belongs to whoever you sent it to. That is why dialing the right number matters as much as choosing the right provider, and why the cover sheet should never carry the sensitive details itself.
One more border to keep in mind: a fax to another country is a call to that country. The pages cross the border when they are sent, whatever your provider's storage location.
Does HIPAA Require US Data Residency?
No, but a medical practice still has to answer the residency question for its auditor. It usually arrives as "does our fax service have to keep PHI in the US?", and the follow-ups are what a review will check:
- A BAA with the fax service. It stores PHI, so it is a business associate. The carrier that carries the call is a conduit and doesn't need one; the service that keeps your sent and received faxes does. Here is what a BAA for fax covers.
- Encryption doesn't change that. HHS says a cloud provider that stores encrypted ePHI is still a business associate, even if it doesn't hold the decryption key.
- Location goes into the risk analysis. HHS warns that keeping ePHI overseas "may increase the risks and vulnerabilities to the information" and can complicate enforcing privacy protections, and it expects covered entities to weigh that.
- Contracts can ask for more. Health systems and payers can write a storage country into a vendor agreement. If yours names one, check that the provider both stores and processes PHI there, and that it will say so in writing.
Encryption in transit and at rest is the other half of the same review; our guide to fax encryption explains what TLS and AES-256 do and how to check a provider for them. The full checklist, from access controls to cover sheets, is in the HIPAA-compliant fax guide.
How Fax Services Handle Data Residency
Fax providers take one of four approaches, and the right one depends on where your requirement points.
| Model | How it works | Fits when | Examples (as read on 2026-10-26) |
|---|---|---|---|
| One country | Faxes are stored in one country's data centers | Your requirement names that country | mFax: faxes and documents on servers in the US; on Business, PHI stored and processed in the US |
| Region by customer | The provider runs separate regional data centers and serves each customer from its own region | You need storage in your own region, and the provider serves it | InterFAX: US customers from a Virginia-based data center, EU customers from an AWS-based data center in the EU |
| Selectable regions | An admin picks where data is stored, sometimes separately for live data and backups | You need a specific non-US country, or different regions for different entities | Fax.Plus: 40+ data residency locations on its Enterprise plan |
| On-premises | A fax server you run in your own building or private cloud | Policy forbids third-party storage, or you already run the hardware and lines | Self-hosted fax servers |
Region selection usually sits in enterprise tiers: Fax.Plus offers data residency on its Enterprise plan only. On-premises keeps every stored copy on infrastructure you control, but it brings back the hardware, the phone lines and the maintenance that cloud fax took away.
Where Does mFax Store Your Faxes?
mFax stores faxes and documents encrypted on servers in the United States. That is the answer in mFax's support center, and it covers personal accounts and Business workspaces alike. In detail:
| Question | mFax's answer |
|---|---|
| Where are faxes stored? | On servers in the United States. On mFax Business, PHI is stored and processed in the US |
| How is it protected? | TLS on every connection between your device and mFax (TLS 1.2+ on Business and the API), and encrypted storage, with AES-256 at rest on Business |
| Who can open it? | Only you on a personal account. On a Business workspace, its members, each signing in with their own login; the owner manages invitations, the fax line and the BAA |
| How long is it kept? | Sent and received faxes stay in your history until you delete them. There is no automatic expiry |
| What happens when you delete? | Deleted faxes and documents can't be recovered, and deleting the account removes everything at once |
| Are your documents used for anything else? | No. mFax doesn't sell personal data and doesn't use your documents to train AI models |
| Is there a BAA? | Yes, on every Business plan at no extra cost. The owner signs it under Settings › Business Associate Agreement › Review & sign |
What mFax doesn't offer is a choice of region. There is no EU, Canadian or Australian storage option. mFax issues local fax numbers in the US and Canada, but faxes on a Canadian number are stored on the same US servers. If a statute or a contract requires storage inside Canada, the EU or Australia, choose a provider with that region; mFax isn't built for it.
Account and billing details are a separate question: purchases made in the App Store or Google Play are handled by Apple and Google, and the privacy policy covers the rest of your account data.
Need PHI kept in the US, with the paperwork to show it? mFax Business gives your practice a team fax line, a signed BAA, PHI stored and processed in the US, and a login for everyone on staff, on the web, phone and desktop apps. Plans start from about $9/mo, and you build your own from the seats and pages you need.
Questions to Ask a Fax Provider About Data Residency
Copy these into your vendor questionnaire. A provider that answers all eight in writing has thought about residency; one that answers "the cloud" hasn't.
- Where are faxes stored? Country and region, for sent and received faxes alike.
- Where are they processed? Turning a Word file into fax pages can happen somewhere other than storage.
- Where are the backups? And do they follow the same rule as the live data?
- Which subcontractors touch the documents, and where are they? Cloud hosting, file conversion, email delivery.
- Which country's law governs the company? Its legal home decides whose courts can compel it.
- How long are faxes kept, and can you delete them for good? Data that no longer exists has no residency to worry about.
- Will it sign a BAA, and does the BAA or contract name the storage country? If location matters, it belongs in the contract, not only on a web page.
- Which copies leave the system? Fax-to-email forwarding and notification emails put copies in a mail system with an address of its own.
Keep Every Copy Where You Can Point to It
Data residency comes down to answering "where is it?" for every copy of a document. For fax, that means picking a provider whose storage location matches your rules, getting that location in writing, and remembering that the recipient's copy follows the recipient's setup.
If your answer needs to be "in the United States", mFax Business stores and processes PHI in the US, includes a signed BAA on every plan, and works in the browser and in apps for the phones and computers your team already uses. Plans start from about $9/mo: set your seats and pages with the live calculator and see the price before you commit.