Security & compliance
Finance-grade controls. Healthcare-grade privacy.
Treso handles money and patient balances, so it is built to the standards of both: every action audited and attributable, every dollar on a balanced ledger, and patient identity kept in a vault that the rest of the system can only point to.
Controls
What is in place
The controls below are enforced in the product today and visible in the compliance module of every practice.
Identity and access
MFA policy by role, idle timeout, IP allowlists (Enterprise), invite-domain restrictions, SSO/SCIM for groups. Sessions are short-lived and bound to the realm (practice, patient, ops).
Roles with limits
Owner, location manager, front desk, billing, provider, controller and CPA roles carry a location scope and an approval limit. Money movement is checked against both, every time.
Append-only audit
Every action is written to a hash-chained audit log per practice, including Treso staff 'view as' sessions, which are read-only and PHI-masked. The chain can be verified at any time.
PHI vault
Names, dates of birth and contact details live in an encrypted vault with per-practice keys. Everything else references a token. Reads require a reason and are logged; unusual patterns are flagged.
Messaging with consent
Texts and emails go out only through a service that checks consent and quiet hours. Messages carry amounts and links, never diagnoses.
Agents under supervision
Agents act within the same approval limits as people, leave a PHI-free trace, can be dry-run, and can be switched off per agent and per practice by Treso's own team.
Agreements
A BAA on every plan
Treso signs a business associate agreement in-app during onboarding; new versions supersede old ones and the signed copy stays with your agreements. The subprocessor list is published on the trust center and kept current.
Banking, card issuing and payment processing are provided by regulated partners under their own agreements; Treso does not hold deposits itself and does not store full card numbers.
- Encryption
- TLS in transit · AES-256 at rest · per-practice PHI keys
- Hosting
- US regions · managed Postgres · daily backups
- Access
- MFA for all staff · hardware keys for ops · view-as audited
- Agreements
- BAA v3 · DPA · partner bank terms
- Reviews
- Quarterly access reviews with evidence
- Contact
- security@treso.com
Questions
Security questions
Where is data hosted?
In US cloud regions on managed infrastructure with encrypted storage and daily backups. Details and the current subprocessor list are on the trust center.
Is Treso SOC 2 certified?
Treso is pre-launch. The controls above are designed to the SOC 2 and HIPAA Security Rule requirements, and a third-party audit is planned ahead of general availability. We will publish the report on the trust center.
How do I report a vulnerability?
Email security@treso.com. We acknowledge reports within two business days and keep you informed until the issue is resolved.
Can our practice publish its own trust page?
Yes. The compliance module lets a practice publish a page with its own contact, enforced policies and agreements, at a link you can share with payers and vendors.
Pre-launch
Join the practices shaping Treso before launch.
Tell us what the financial side of your practice looks like today. Early practices get a hand with setup, and a say in what ships next.