By Jeff Streelman, Vice President of Information Security, SpendMend
When I joined SpendMend, I was drawn to one simple but powerful idea: trust is earned through transparency.
After three decades in information security and risk management, I’ve seen how financial and healthcare organizations depend on trusted partners, not only for performance and innovation, but for protection. Every day, hospitals entrust us with sensitive data that supports financial integrity and patient care. That’s a responsibility we take seriously.
At SpendMend, security isn’t a department. It’s a shared culture. And our new Trust Center is where that culture becomes visible.
Why We Built the Trust Center
The Trust Center was designed to give our clients and partners a clear view into how we safeguard their information. It’s not a marketing page—it’s a living record of our security posture, certifications, and practices.
Within the Trust Center, anyone can explore the frameworks, policies, and controls that govern our operations from encryption and hosting details to independent testing and staff training. We built it because we believe that transparency strengthens relationships, and accountability drives improvement.
The Framework Behind Our Security Program
Our entire security strategy is guided by the HITRUST i1 certification, which validates that our controls align with industry-recognized standards for data protection and privacy. HITRUST provides the structure. The following pillars represent how we put that framework into practice.
- Penetration Testing
All SpendMend applications undergo annual penetration testing by independent third-party experts. These engagements provide objective assessments of our systems and help us identify and remediate vulnerabilities before they can be exploited. It’s a proactive, continuous-improvement process because security isn’t static.
- Application Development and Hosting
Our development teams follow a secure software development lifecycle (SDLC) that includes code reviews, dependency management, and vulnerability scanning. We host our systems in U.S.-based, enterprise-grade cloud environments, Microsoft Azure, and Amazon Web Services (AWS), where data is encrypted using industry leading standards (TLS 1.2+ in transit and AES-256 at rest). These standards ensure confidentiality, integrity, and availability at every level.
- Policies
SpendMend maintains a comprehensive set of cybersecurity policies covering data management, access management, and incident response. Each policy is reviewed annually and updated. Every employee must read and attest to these policies every year, reinforcing accountability and compliance across the organization.
- Privacy Policy
Protecting personal and client information is central to our mission. We comply with regulations such as Health Information Portability and Accountability Act (HIPAA) and the California Consumer Privacy Act (CCPA), applying the principles of lawfulness, fairness, and transparency. Sensitive data including Protected Health Information (PHI) is reviewed and redacted where appropriate to ensure privacy and compliance.
- Security Training
A strong security posture begins with an informed team. Every SpendMend employee completes annual security training, participates in phishing simulations, and receives monthly awareness updates. This ongoing education empowers our people to recognize and respond to threats effectively.
More Than Compliance: A Culture of Trust
Our approach to cybersecurity goes far beyond meeting regulatory checkboxes. It’s about fostering a mindset of continuous improvement and shared responsibility. From leadership to engineering, every team member plays an active role in protecting our systems and our clients.
The Trust Center is more than a reference, it’s proof of how we operate: open, diligent, and accountable.
Earning Trust Every Day
Security is never finished. The landscape evolves, and so must we. At SpendMend, we’ll continue refining our defenses, validating our controls, and investing in the people and processes that make security part of our DNA.
I invite you to explore our Trust Center and see our commitment in action: spendmend.com/trust-center
Because at SpendMend, trust isn’t assumed… it’s built, proven, and protected.