How Torva works
Two parts, one list of what to fix, and the evidence for your HIPAA risk analysis.
Built for medical and dental practices without a security team, and the IT providers who support them.
In both plans
Every day, Torva Edge checks what the internet can see of your practice: your website’s HTTPS and certificates, security headers, email authentication (SPF, DKIM and DMARC), open ports, and public software with known vulnerabilities. You verify your domain once with a DNS record, and the first report is ready minutes later.
In the Complete plan
Torva Core is one small agent on an always-on Windows PC. It checks the network ranges you approve for outdated software, weak encryption, risky remote access and computers past their end of support, with exact Windows versions. It only looks: it never signs in to devices or changes anything, it connects outbound only, and sensitive equipment such as imaging and lab systems gets a light check or no contact at all.
Edge and Core feed one list. Issues being actively exploited in real attacks come first, then the rest by severity. Each issue has plain-English steps and the affected devices, and you can send it to your IT provider in one click. For common Windows fixes there’s a ready-to-run script. When something is fixed, the next scan confirms it; if you accept a risk, you sign it off with a reason and a review date.
In the Complete plan, scan results become dated evidence for your risk analysis: assets fill in automatically, findings become suggested risks, and each HIPAA safeguard shows what the evidence says. You answer the safeguards a scan can’t see, with guided questions, import last year’s HHS SRA Tool assessment if you have one, and finalize a dated, signed PDF. An Executive summary gives leadership the picture in two minutes. Torva doesn’t certify compliance; it gives you the evidence and the record.
You get an email when something important changes: a new exposure to an actively exploited vulnerability, a grade that drops, a new open port, or a scanner that stops checking in. Each alert says what changed and links to the report.
Edge · outside only
$30/month
Daily outside checks of one domain, the fix list and alerts.
Start with Website & EmailEdge + Core · outside and inside
$75/month
Everything in Website & Email, plus Core with 60 devices, HIPAA evidence and the Executive summary. Never more than $375/month for the plan and devices.
Start with CompleteCompare plans and pricing · Managing several practices? See Torva Partner
New customers get a 14-day free trial. Your first website report is ready minutes after you verify your domain.