Company, hosting and data
Who we are. Torva is operated by Torva LLC, formed in Indiana. General questions: hello@torvasecurity.com. Security reports: security@torvasecurity.com.
Hosting. The Torva service and its database run on a dedicated virtual server at OVHcloud’s US-East data center in Virginia, with daily backups.
Encryption and secrets. Every connection to Torva, from your browser and from scanning agents, uses HTTPS (TLS). Passwords are stored only as one-way hashes (bcrypt). Two-factor authenticator secrets are encrypted (AES-256-GCM) and recovery codes are hashed. Scanning-agent credentials and enrollment codes are stored only as hashes.
What Torva stores. Technical findings about the networks and websites you authorize: addresses, device names, open ports, software versions, certificate details and scan history, plus your notes, sign-offs and compliance answers.
Patient information (PHI). Torva checks network services and stores technical findings about them. It never connects to your electronic health record, never reads files or email, and never signs in to your devices, so it doesn’t create, receive, maintain or transmit protected health information. Torva isn’t designed to act as a HIPAA business associate, and a business associate agreement generally isn’t needed for this kind of service; your compliance lead makes the final call, and we’re glad to put this in writing for vendor reviews. Please keep patient information out of notes, documents and uploads in the compliance workspace.
How long we keep it. Full detail for each site’s 30 most recent internal (Core) scans and each host’s 24 most recent external (Edge) scans; older scans become small summaries for progress history (Edge summaries are deleted after 18 months). Fix re-check results are kept for 14 days and threat alerts for one year. Sign-offs and compliance records are kept with your account. See the Privacy Policy for details, deletion and export.
Account and report protection
Passwords use bcrypt hashing. Authenticated reports are scoped to their account. Dashboard and agent connections use HTTPS in production. Payment card entry is handled by Stripe. Read our privacy policy for data handling and deletion requests.
Authorized, bounded checks
Paid Edge scans require DNS verification of the domain and explicit selection of additional hosts. The free check makes limited requests for public DNS, certificate and header information. Edge blocks private and special-use destination addresses, including redirected destinations.
Core scans approved private IPv4 ranges from a customer-installed agent. Subscription checks authorize scan batches. No inbound firewall opening is required; local controls bind to loopback and require a local control token. Coverage and limits are documented.
Core software updates
The Core agent verifies an Ed25519 signature on every update against the key installed with the agent, checks package integrity and limits update files to application code. Updates wait for idle time; Windows then stops the Torva Core service, applies the update and starts it again, and the previous version is restored automatically if the update fails to start. The Windows installer is not yet publisher-signed.
Mobile app and notifications
Torva can be installed on a phone or computer as an app. The service worker does not cache scan findings, device lists or reports for offline use. It loads them from your account and shows an offline page without a connection. Guided reviews can temporarily keep unsaved answers in browser session storage, as described in the Privacy Policy. Notifications only say what needs attention, such as “Main Office: 1 still present”, never addresses, software versions or vulnerability IDs, and may include site names. Review your device’s lock-screen notification settings. Turn notifications off for any device in Account.
Network range changes
The Torva Core agent scans only private ranges approved for its site. A range or exclusion change requested from the dashboard takes effect only after the account owner confirms it from an emailed link, which expires in 24 hours and works once. Administrators on the scanning computer can change ranges there directly, which notifies the owner by email, or lock ranges so dashboard changes are refused.
What Core sends to your devices
Discovery: a ping and a connection attempt to a few common ports, to find out which addresses are in use. Scan: connection attempts to a fixed list of common ports, a TLS handshake where a service offers one, a request for a web page’s headers, and for Windows machines the opening message of a sign-in handshake, to read the Windows version. Core never sends usernames or passwords, never completes a sign-in, and never changes anything on a device. Fix scripts you download from an issue are run by you, on your own PC, with credentials you enter there; Torva never sees them. Scans are paced to stay gentle, run only in your scan window, and skip or only lightly check the sensitive equipment you mark.
Recognizing scan traffic
Torva Edge scans come from 40.160.38.187 (IPv4). Use it to recognize Torva in firewall and monitoring logs, or to stop your intrusion prevention from blocking a scan partway through.
Don’t open firewall ports for this address. Edge should see exactly what the rest of the internet sees; allowing it extra access would make the results wrong and give that address access nothing else has. Torva Core doesn’t use this address: its agent runs inside your network and connects outbound only.
If the scanner address changes, we update this page and email customers before the change. Don’t trust traffic just because its User-Agent says Torva; check the source address.
Report a security issue
Email security@torvasecurity.com with a description and safe reproduction steps. Do not include customer credentials or sensitive scan data in an initial email. Our contact is also listed in security.txt.