Conducting an annual penetration test is a critical demonstration of our commitment to security. It provides an objective, expert assessment of the company’s systems, applications, and defenses, and uncovers vulnerabilities before malicious actors can exploit them. By engaging independent testers, the organization ensures transparency, avoids blind spots, and reinforces a culture of continuous improvement. This proactive approach not only strengthens internal defenses but also builds trust with customers, partners, and auditors who expect evidence of rigorous and repeatable security practices.

Our applications are hosted in either Microsoft Azure or Amazon Web Services, leveraging its enterprise-grade infrastructure to support both multitenant and single-tenant environments as needed. All data is stored exclusively within the United States and is encrypted using industry-standard protocols, including AES-256 encryption at rest and TLS 1.2+ in transit. We provide access controls through Single Sign-On (SSO), Multi-Factor Authentication (MFA), and Role-Based Access Control (RBAC) to ensure that only authorized personnel can access SpendMend applications. Our team is trained regularly on security best practices, and all employees undergo background checks as part of our hiring process. In the event of a security incident, we maintain a formal incident response plan to ensure timely identification, containment, and resolution, further demonstrating our commitment to protecting our clients' data and maintaining operational resilience.

For more information about our applications, please visit our Trust Center Resources page.

Cybersecurity policies are critical for compliance with regulations such as HIPAA, which mandate technical, physical, and administrative safeguards to secure client data. These policies provide clear standards and procedures for staff, reducing the risk of data breaches and unauthorized access to client data.

Regular staff training, as mandated by these policies, helps build a security-aware culture and reduces human error, which is a common entry point for cyber threats. Ultimately, maintaining comprehensive cybersecurity policies is fundamental to protecting patient privacy, upholding legal and ethical responsibilities, and preserving the operational and reputational integrity of SpendMend.

All data within our applications is encrypted both in transit and at rest, ensuring confidentiality and integrity. For sensitive information such as Protected Health Information (PHI), we have implemented review and redaction processes to remove patient data. Our adherence to the HITRUST i1 certification further reinforces this commitment, aligning our controls with industry-recognized standards for data protection and privacy. In addition, we’ve published a comprehensive Privacy Statement that outlines our practices and affirms our compliance with regulations such as the California Consumer Privacy Act (CCPA), ensuring transparency and accountability in how we collect, use, and protect personal data.

Regarding safeguards for personal data and individual privacy, we are committed to complying with the core principles of lawfulness, fairness, and transparency in data processing. We limit data collection to what is necessary for legitimate business purposes, ensure data is accurate and up to date, and retain it only for as long as needed. We implement measures to protect personal data, including encryption and access controls, and we support data subjects' rights such as access, rectification, erasure, and objection. Legitimate subject data requests can be requested by sending an email to privacy@spendmend.com.

All employees are required to complete security training annually, in addition to standard HR compliance training and role-specific security instruction tailored to their job responsibilities. To reinforce this foundation, we also conduct regular phishing simulation exercises and distribute monthly security awareness messages to keep key threats, and best practices top of mind. Additionally, each employee must review and formally attest to SpendMend’s security policies on an annual basis. This multi-layered approach demonstrates our commitment to building and maintaining a resilient security environment, ensuring that every team member plays an active role in protecting our systems, data, and clients.

SpendMend publishes content drawn from healthcare industry data and the firsthand expertise of our team. While all published content is authored, edited, and approved by qualified SpendMend professionals who are solely responsible for its final form and substance, AI-assisted tools may be used during the research and drafting of such content. SpendMend makes no guarantee that published content is free from error, and readers should independently verify information before relying on it for decision-making.