Use three fixed labels on a security page: available (in production and evidenced), early access (limited availability, stated limits), and planned (not built, with a date range only if you will keep it). Define each label once on the page, date every entry, and never place a planned item in the same list as shipped ones.
Why labels matter
Security pages tend to blend what exists with what is intended. A reviewer reading "we support X" assumes today. If X is a roadmap item, the page has made a claim the product cannot meet, and a customer who relied on it may feel misled. Labels remove the ambiguity without removing the ambition.
The three labels
| Label | Meaning | Evidence expected |
|---|---|---|
| Available | In production for customers, works as described | Documentation, test or log evidence |
| Early access | Offered to some customers, limits known | Documented limits and who can join |
| Planned | Not yet built or released | A dated plan, owner, and no promise of an outcome |
Print this table on the page, or link to it, so readers know what each label means.
Wording that works
- Available: "Single sign-on is available for all plans. See setup guide."
- Early access: "Feature X is in early access for selected customers. It does not yet support Y. Ask us to join."
- Planned: "We plan to add Z in the first half of next year. Plans can change, and we will update this page when they do."
Keep planned items short, and avoid tense that sounds like completion. Words like "will soon," "fully supports," and "coming" with no date invite disappointment.
What to keep out
Do not list a planned control inside a table of controls with a tick mark. Do not describe an audit that is underway as if it were finished. A SOC 2 report is issued by an independent CPA firm, and AICPA describes the SOC suite as assurance reports CPAs may provide. If yours is not issued, say it is in progress, or leave it out.
Keep labels honest over time
- Add an owner for each labeled item.
- Review all labels with each release.
- When early access becomes available, change the label and date together.
- When a plan slips, update it publicly rather than waiting for someone to notice.
- When a planned item is dropped, remove it.
A small dated changelog at the bottom of the page lets repeat visitors see what moved.
Align everything else
The labels should match your docs, your sales deck, and your questionnaire answers. If the page says early access and a slide says available, a buyer will find the mismatch. A shared claims record makes this easy to check. See the related post on who should own the trust page.
Where Safeguard fits
Safeguard labels its own capabilities by maturity in internal references and keeps public statements to those that are generally available. Its compliance and evidence automation helps teams keep evidence for claims. Try a free scan at gold.safeguard.sh/scan.
Quick check
Is it bad to show a roadmap on a security page?
No, if it is clearly labeled as planned, dated, and kept separate from shipped items.
Should I give target dates for planned items?
Only if you will keep them current. A stale date is worse than a general window or no date.
Sources
Last reviewed: 19 October 2026.
