Carfax gets its data from thousands of sources.
They are also very up front about what is not covered in their reports, namely any information that hasn’t been reported to them:
—
We guarantee we will have information about the most severe accidents, ones for which the states or provinces have issued a branded title. We also have the largest publicly accessible database of less severe accidents which we have compiled from thousands of sources.
However, we do not have all accidents as many have never been reported, or may only have been reported to a source to which CARFAX does not have access. We recommend that any car be inspected by a qualified mechanic prior to purchase to make sure the vehicle is functioning properly and check for signs of unreported damage.
—
So, it’s good you’re asking how Carfax works. And the answer is: only as well as they have information reported.
The only guarantee they offer is that if the vehicle you buy was somehow damaged so badly at some point that it was branded as “Salvage (excluding Salvage brands issued due to Theft), Junk, Rebuilt, Reconstructed, Dismantled, Fire, Flood, Hail, Exceeds Mechanical Limits, Not Actual Mileage or Manufacturer/Lemon Buyback” and that information was not in their report, then they’ll buy it back from you.
Other than that, take the advice of my esteemed jellies above (and Carfax) and ensure that you have any used vehicle inspected prior to purchase.