What the Fax module is

Fax lets you send PDFs to any Canadian or US fax number from your browser, and (when you opt in) receive inbound faxes through one shared platform number. There is no dedicated fax line per tenant — every tenant routes through the same number, and a routing code printed on every cover sheet tells the platform which tenant an incoming fax belongs to. The module is metered: you pay 1 Store credit per 10 transmitted pages, rounded up, and only on successful delivery. Failed faxes are never charged. There is no monthly fax fee — the only Fax-related cost is the credits you spend on sends and the time you spend reading what comes back.

Behind the scenes the platform talks to Telnyx Programmable Fax, a US-based provider, for both directions. Cover sheets are auto-generated and merged in front of your PDF before transmission, with a routing QR code that lets the recipient fax you back through the same shared platform number. The Fax module is open to every tenant on every tier (Basic and Premium); the only practical limit is your Store credit balance at send time.

Your Tenant Number (TN)

Every tenant on the platform carries a permanent, human-readable identifier called a Tenant Number. Two visible forms share the same digits: 'TN<digits>' for a graduated tenant (one that has ever activated paid Premium or accepted a complimentary grant), and 'TEMP<digits>' for a trial tenant that has not yet graduated. The digits are assigned once at signup and never change; only the prefix flips, one-way, the first time the tenant becomes real. For example a tenant might start life as 'TEMP100127' during the Premium trial, then permanently become 'TN100127' the moment a paid subscription starts.

The Tenant Number is the routing key for inbound fax. It appears on every cover sheet you send, both as a human-readable code in the 'RETURN REFERENCE' box and inside the routing QR. When someone faxes you back through the shared platform number, the platform reads the code (or scans the QR) to figure out which tenant should receive the inbound. Without a valid Tenant Number on the cover, the platform cannot tell where the inbound belongs and the fax will quarantine.

Note: TEMP tenants cannot receive inbound faxes. Receiving requires a graduated tenant, because the consent latches and the standing Incoming Faxes room are only provisioned once the tenant becomes real. You can still send while on a TEMP code; the recipient's reply will quarantine until you graduate, and the SaaS admin will route it to you manually.

Subscription tier and pricing

Fax is available on every tier — both Basic and Premium tenants see the Fax sidebar entry from day one. The module is metered, not subscribed. You pay 1 Store credit per 10 transmitted pages, rounded up. A 1-page fax costs 1 credit, a 3-page fax costs 1 credit, an 11-page fax costs 2 credits, a 21-page fax costs 3 credits. Settlement happens only after the provider confirms delivery; faxes that fail to transmit (busy line, no answer, wrong number) are not charged at all, and the wallet stays untouched.

Credits are bought through Store at the standard pay-as-you-go top-up tiers. Inbound faxes are free — you only pay for what you send. There is no recurring fee, no minimum monthly volume, no per-page line item separate from the credit math above.

One-time consent before your first send

Before your first fax goes out, the compose page presents a versioned disclosure modal you must acknowledge. The modal discloses three things: the platform routes through Telnyx, a US-based provider, so the message data crosses the border in transit; the billing posture is 1 credit per 10 pages rounded up and charged on successful delivery only; and the consent text is versioned so if the platform ever updates the disclosure, the modal re-appears automatically the next time you open compose. The acknowledgement is stamped on your company row alongside the version string the platform showed you at the time.

The receive side has its own separate consent. Turning on inbound fax requires acknowledging a second disclosure that explicitly covers SaaS-admin access to quarantined faxes: when an inbound fax cannot be routed automatically (no QR code, no Tenant Number on the cover, an old TEMP code, etc.), the bytes are encrypted at rest and surfaced to platform operators in the quarantine review queue so they can route the fax to you manually. The receive consent is distinct from the send consent on purpose — accepting one does not accept the other.

What destinations are accepted

The destination input accepts a Canadian or US fax number in any common format — '+1 (416) 555-1234', '416-555-1234', '4165551234', '+14165551234'. The compose UI normalises every input to the E.164 form '+1XXXXXXXXXX' and tags the country (Canada or US) based on the area code; the cover sheet displays the pretty form. International numbers outside the North American Numbering Plan are rejected with a clear error — the v1 module supports +1 NANP only, both to keep provider costs predictable and to keep the dial routing simple.

The validator catches typos before the send: too few digits, too many digits, an area code that is not a valid NANP assignment, or an explicit '+44' / '+49' prefix all surface inline on the compose page. The same check runs again server-side at submit time as the authoritative validator. Country is inferred from the area code against the CRTC's Canadian assignments; any +1 number whose area code is not in the Canadian list is treated as US for billing purposes.

Page and rate caps

Two caps protect both you and the platform from runaway costs. The per-fax cap is 50 pages total (cover sheet + source PDF combined). The per-tenant rolling 24-hour cap is 10 faxes per day. Both caps are pre-flight gates: a 60-page source PDF is rejected before the send route even runs, and the 11th fax attempt in a 24-hour window is refused with a clear error pointing at the cap. The caps reset on a rolling basis, not at midnight UTC — if you send 10 faxes Monday afternoon, the 11th slot frees up Tuesday afternoon at the same hour each prior fax was sent.

Note: If you legitimately need to send more than 50 pages or more than 10 faxes in a day, the caps are abuse brakes, not policy ceilings. Contact platform support and we can review your case — typically the conversation surfaces a different module (Transfer Room for bulk document delivery, for example) that is the right tool for the volume.

Sending a fax

Sidebar → Fax opens the compose page. The flow is three steps: pick a PDF, fill the destination + cover sheet fields, click Send. The PDF uploads through a signed direct-upload URL (the bytes go browser → Supabase Storage, never through a Vercel function body), so files up to the per-fax page cap upload quickly without the 4.5 MB request limit getting in the way. As soon as the upload finishes, the compose page knows the page count and shows you the credit estimate so you can sanity-check before clicking Send.

1. Destination — the Canadian or US fax number, typed in any common format. The inline validator normalises and country-tags as you type.

2. Include cover sheet — defaults to on. When on, the platform auto-generates a one-page cover from the To / Subject / Note fields you fill in below and merges it in front of your PDF. When off, your PDF is sent as-is with no cover.

3. To / Subject / Note — free-text fields that print on the cover sheet. 'To' is the recipient name, 'Subject' is a brief description, 'Note' is a short message the recipient sees alongside the document. The note is not a place for sensitive information; treat it as the cover-page-of-a-paper-letter equivalent.

4. Send — the route validates the destination + caps + consent + wallet balance one more time, queues the fax with Telnyx, and returns a job id you can match against the Sent log.

What the auto-generated cover sheet contains

The auto-generated cover sheet is a one-page PDF that the platform builds at send time and merges as page 1 of the outbound document. It carries your company name and logo (if uploaded), the date stamped in long form (Monday, January 1, 2026 / lundi 1 janvier 2026 depending on the cover-sheet locale), the To name, the Subject, the Note, the destination fax number in pretty form, the total page count including itself (e.g. '4 (including this cover)'), and a maroon 'RETURN REFERENCE' box. The reference box carries two things: your Tenant Number printed as text (so any human reading the cover can copy it onto a reply), and the routing QR encoding the same identifier (so the platform can scan it on inbound).

Cover-sheet generation is pure-function and fails gracefully. If the QR generator throws (it should not, but defensively), the cover renders without the QR and the human-readable code in the maroon box still carries the routing information. The recipient can still fax you back by typing the Tenant Number onto their reply cover.

The routing QR code

The QR printed on every cover sheet is the most reliable way for an incoming fax to be auto-routed back to you. It is a 160-pixel square encoding a short payload that contains your Tenant Number; the QR uses a medium error-correction level so it survives the rough treatment a piece of paper gets going through two fax machines (your sender's and the platform's), where the modulation, the 1-bit thresholding, and the partial smudging would otherwise scramble a more delicate identifier. When the recipient eventually faxes you back, they typically re-transmit the cover sheet as page 1 of their reply; the platform's inbound pipeline reads the QR off page 1 in under a second and routes the reply straight into your standing Incoming Faxes room.

Note: If the recipient does not return your cover sheet on their reply (for example, they write a fresh cover by hand), the platform falls back to scanning page 1 with OCR and trying to find the Tenant Number in printed text. OCR works most of the time, but it is slower and less reliable than the QR. Recipients who you fax with often should be encouraged to either retain your cover sheet for replies, or to write your Tenant Number in plain text on their reply cover.

What happens after you click Send

Click Send and the job moves through four states. Queued — the row exists in the database, the cover sheet has been merged with your PDF, the merged file has been handed to Telnyx, and Telnyx has accepted the job and returned a provider job id. Sending — Telnyx is actively dialling the destination number and negotiating with the receiving fax machine. Delivered — every page transmitted successfully and the receiving machine signalled acknowledgement; this is the only state that triggers billing. Failed — something went wrong; the failure reason is captured on the row (busy, no answer, wrong number format, recipient hung up, etc.) and no credits are charged.

Status updates from Telnyx arrive through a webhook that the platform polls and reconciles. Most faxes settle within one to three minutes; a fax to a slow-responding line or a long-document fax can take longer. The Sent log shows the current status of every fax you have ever sent; refresh the page to pull the latest state. If a fax sits in 'sending' for more than ten minutes, that usually means the destination is busy or unresponsive and Telnyx is still retrying — it will eventually settle to delivered or failed without manual intervention.

The Sent log

Sidebar → Fax → Sent faxes opens the Sent log. Each row shows: when you sent it, the destination (the last four digits in plain text, the rest redacted so the log is safe to share-screen), the country, the page count (estimated if the fax is still queued, transmitted if delivered), the status with a colored badge, the number of points charged (only set on delivered faxes), and the timestamp the fax settled into its terminal state. Failed faxes show a short failure reason underneath the status badge so you can see at a glance whether to retry, re-check the destination, or escalate.

All timestamps render in your company's timezone — set on Settings → Company. The redacted-destination convention is intentional: the page is often used in shared workspaces or with screen-sharing, and the cover sheet you saved already carries the full number for your own records.

Receiving inbound faxes

Inbound fax is opt-in. By default your tenant cannot receive — the shared platform number rejects any fax targeted at you because no consent has been recorded. To start receiving, open Sidebar → Fax → Fax settings, accept the receive-side consent disclosure, and click Turn on receiving. The action stamps a receive-enabled timestamp on your company row; from that moment forward, anything faxed to the shared platform number that carries your Tenant Number on its cover (via QR or printed text) routes into your standing Incoming Faxes room.

Note: The receive consent re-prompts whenever the platform updates the disclosure text (a version string is stamped alongside the timestamp). Re-acknowledging takes two clicks; in the meantime, inbound faxes targeted at your Tenant Number quarantine until you acknowledge the new version. The disclosure is short on purpose — you should be able to read it in under a minute.

How an inbound fax is routed to you

When a fax arrives at the shared platform number, the inbound pipeline runs three steps. First, it rasterises page 1 of the received PDF and scans it for a routing QR code; if the QR decodes cleanly, the extractor returns your Tenant Number with high confidence (0.9) and the routing layer takes the QR path. Second, if no QR is found, the same page-1 image is passed to an optical-character-recognition pass that looks for printed 'TN<digits>' or 'TEMP<digits>' text; OCR is slower (around two to three seconds on a typical fax) and less reliable than the QR (around 0.7 confidence), but it rescues most faxes where the cover was hand-rewritten or the QR was smudged beyond recovery. Third, the routing layer takes the extracted Tenant Number, looks up your tenant, confirms you have graduated and have receive enabled, and provisions or finds your standing Incoming Faxes room. The whole sequence happens in well under ten seconds end-to-end.

If any step fails — no QR detected and OCR finds no Tenant Number, a Tenant Number that does not match any tenant, a match that points at a TEMP tenant, a match that points at a tenant who has not enabled receive — the platform never silently drops the fax. The bytes are encrypted at rest and the fax enters the quarantine queue for SaaS-admin review.

The standing Incoming Faxes room

Inbound faxes do not live inside the Fax module. Once routed, they are deposited into a special standing Transfer Room called 'Incoming Faxes' that the platform lazily creates the first time a fax is routed to you. The room is ad-hoc (not tied to a Service Agreement), tenant-only on the participant side (you and your invited teammates; no client-side participant), and persists indefinitely. Every routed fax shows up as a tenant-to-client transfer-style entry on the Sent tab of that room, with the fax PDF attached and a short text note recording the inbound timestamp and the routing method (QR or OCR).

Sidebar → Fax → Received faxes is a discovery shortcut that redirects you straight to the Incoming Faxes room once it exists. Until the first fax arrives, the page shows a friendly empty state confirming whether receiving is on. Once the room exists, every fax that arrives also fires a new-transfer notification email to your tenant address so you do not have to keep refreshing — the platform tells you when something new lands.

Note: Reusing Transfer Room for inbound fax means the full Transfer Room feature set applies — file encryption at rest, Drive auto-copy if you have Drive connected, the audit ledger, per-participant notification controls, the optional Information Card. The inbound-fax workflow inherits years of Transfer Room polish for free.

Sharing your Tenant Number with senders

For someone to fax you successfully, two things have to happen: they have to dial the shared platform number, and their fax has to carry your Tenant Number somewhere the inbound pipeline can find it. The easiest path by far is for them to keep a cover sheet you previously sent them and re-transmit it as page 1 of their reply — the routing QR on that cover handles everything. The Fax settings page shows you the shared platform number and your Tenant Number side by side, with copy buttons so you can paste them into an email or instructions document to hand off.

When you are asking someone to fax you cold (no prior cover sheet to reuse), give them three pieces of information: the shared platform fax number, your Tenant Number in 'TN<digits>' form, and a short instruction telling them to write the Tenant Number on the cover page of their fax in plain text. The OCR fallback handles plain-text Tenant Numbers reliably as long as the print is reasonably crisp and the cover page makes it past the fax-machine threshold.

When an inbound fax is quarantined

The platform's posture on inbound routing is locked: never silently drop, never deliver on a fuzzy match. If the inbound pipeline cannot establish, with high confidence, which tenant a fax belongs to, the fax is quarantined for SaaS-admin review instead of being delivered to a tenant who might not own it. Quarantined faxes are encrypted at rest in a dedicated bucket and surfaced to the platform's quarantine review queue. The SaaS admin can then either assign the fax to the correct tenant manually (in which case the tenant gets a routed-from-quarantine entry in their Incoming Faxes room and a notification email), or mark the fax as unrecoverable and purge it after the retention window.

From your side as a tenant, you do not see quarantined faxes directly — the platform admin queue is not exposed to tenants. What you see is the eventual outcome: either a quarantine-routed entry shows up in your Incoming Faxes room with a brief note from the admin explaining the routing decision, or you receive nothing (the quarantine could not be matched to any tenant; the person who tried to fax you should be contacted out-of-band to retry).

The six quarantine reasons

When the platform admin opens a quarantined fax, they see one of six discriminated reasons that explain why automatic routing failed. The reasons exist as a single source of truth so the admin can act quickly without re-investigating each case:

• no_tn_extracted — neither the QR scan nor the OCR pass found any usable Tenant Number on page 1. The cover sheet was probably either not yours or was too damaged in transmission to read. The admin contacts the sender (if visible on the fax) or routes manually if the content suggests an obvious tenant.

• extraction_failed_internally — the extractor itself crashed (a rare infrastructure failure: the rasteriser failed, the OCR worker failed to initialise, etc.). Admin distinguishes this from no_tn_extracted at a glance and pages the platform engineering team if it repeats.

• tn_format_invalid — a Tenant Number was extracted but did not parse cleanly into 'TN<digits>' or 'TEMP<digits>'. Usually a smudged OCR reading. Admin checks neighbouring rows to see if a recent legitimate fax with a similar number suggests the right tenant.

• tn_not_found — the extracted Tenant Number parsed cleanly but does not match any tenant in the database. Usually a typo on the sender's cover sheet, a faked or guessed number, or a fax intended for a tenant that has since closed its account.

• tenant_not_graduated — the Tenant Number matched a real tenant, but the tenant is still on a TEMP code (no paid activation yet). Inbound is blocked for TEMP tenants by design. Admin contacts the tenant out-of-band to alert them that graduating Premium would unlock inbound delivery, then either purges or holds the fax pending the operator's call.

• tenant_receive_not_enabled — the Tenant Number matched a graduated tenant who has not turned on receiving. Admin contacts the tenant; once they enable receive, the admin can re-route the held fax into their Incoming Faxes room.

A seventh historical value (tenant_not_eligible) appears on legacy rows from before the platform's general-availability flip; the routing layer no longer emits it. The admin queue still renders it correctly for any pre-existing rows in case a long-stale quarantined fax surfaces in a backlog review.

Resolving a quarantined fax

If you are expecting a fax that has not arrived in your Incoming Faxes room, three things to check on your end first. One: confirm receiving is actually on. Open Sidebar → Fax → Fax settings; the page shows a clear green badge when receiving is enabled and a maroon Turn-on button otherwise. If a consent version was recently bumped, the badge will read as needing re-acknowledgement; the modal is two clicks. Two: confirm the sender knows your Tenant Number in its current form. If you recently graduated from TEMP to TN, every sender who memorised the TEMP code needs to update to the TN form — the prefixes are not interchangeable on the cover sheet (the extracted code routes only against your current state). Three: confirm the sender used the shared platform fax number, not a number from a previous provider or a competitor's platform.

If all three are right and the fax is still missing, contact platform support and provide three details: the approximate time the sender said they sent the fax, the sender's fax number if known, and your current Tenant Number. The platform admin can then search the quarantine queue around that timestamp; if a matching quarantined fax exists, the admin reassigns it to your tenant and you get the fax in your Incoming Faxes room within minutes, with a brief admin note explaining the original quarantine reason (most often a smudged cover sheet that confused OCR). If no matching quarantined fax exists, the fax probably did not reach the platform at all and the sender should retry.

Important: The platform does not auto-assign a quarantined fax based on its content (sender name, subject text, content matches). Every reassignment is a deliberate admin action with a recorded reason. This deliberate friction is the price of the never-deliver-on-a-fuzzy-match guarantee: legitimately mis-routed faxes get to you a few minutes slower than they otherwise might, but a fax you do receive is unambiguously meant for you.

Interactions with other modules

Fax overlaps cleanly with three other modules. Store is the wallet — every credit you spend on a fax comes from your Store balance, and every reasonable fax volume corresponds to a small monthly top-up. Transfer Room is where inbound faxes actually live — the Incoming Faxes room is just a special-purpose ad-hoc Transfer Room with the same encryption, audit ledger, Drive sync, and notification controls as any other ad-hoc room. Secure PDF Tools is the natural pair for editing what you receive — if a faxed letter needs to be split, merged with a response, redacted, or have OCR run on it to make the text searchable, the Secure PDF Tools module handles all of it client-side without sending the document anywhere.

Fax has no Premium-only sub-feature. Both Basic and Premium tenants get the full module from day one. The only constraint that differentiates tiers is whatever Premium-gated workflow you choose to use alongside fax — for example, signing a faxed-in document via the Sign PDFs sub-tool of Secure PDF Tools, or attaching a fax to a Service Agreement matter through Active File Review. The Fax module itself is universally available.

Troubleshooting

• Send blocked by 'consent required' — your tenant has not acknowledged the current send-consent version (either because it is your first send, or the consent text was recently updated). The modal is two clicks; the page reopens compose ready to send the moment you acknowledge.

• Send blocked by 'insufficient credit' — your Store wallet does not have enough credits to cover the estimated cost. Open Sidebar → Store → top up at any tier, then return to compose. The compose page shows your wallet balance at all times so you can sanity-check before clicking Send.

• Send blocked by 'destination not supported' — the number is outside Canada or the United States. The v1 module is +1 NANP only. There is no override; the validator runs both client-side and server-side.

• Fax sits in 'sending' for more than ten minutes — the destination is usually busy or unresponsive and Telnyx is retrying. The provider has its own internal retry policy that runs for around 30 to 45 minutes before declaring the fax failed. No action needed; refresh the Sent log occasionally and the status will eventually settle.

• Inbound fax expected but did not arrive — check Fax settings (receiving on? consent version current?), confirm the sender used the current Tenant Number form (TN vs TEMP), and confirm they used the shared platform number. If everything checks out and the fax is still missing, contact platform support with the approximate send time + sender's fax number; the admin can search the quarantine queue and reassign manually.

• Tenant Number changed prefix from TEMP to TN unexpectedly — this is the normal one-way graduation: the moment paid Premium activates (or a complimentary grant is accepted), your prefix flips once and never goes back. The digits stay the same; every cover sheet you send from this point forward carries TN, and any old TEMP-marked cover sheets in the wild still route correctly because the routing layer accepts both forms.