Publish what helps a buyer qualify you and carries no attack value: policy summaries, your subprocessor list, and the attestations you actually hold. Gate what could help an attacker or that your auditor restricts: full audit reports, penetration test detail, architecture diagrams and SBOMs. Use a short request flow for the gated set.
The decision rule
Ask two questions of each document. Would a stranger gain anything useful for an attack by reading it? Does the issuer, such as an auditor, limit who may receive it? If either answer is yes, gate it.
Decision table
| Document | Public or gated | Why |
|---|---|---|
| Security overview page | Public | Helps buyers self-qualify |
| Policy summaries | Public | Low risk, high reuse |
| Subprocessor list | Public | Customers often have a contractual right to see it |
| Disclosure policy and contact | Public | It should be easy to find |
| Attestation or certificate you hold | Public (the fact) | Say what it covers and its date |
| Full audit report | Gated | Report use is usually restricted |
| Penetration test summary | Gated or summary public | Detail aids attackers |
| Architecture diagram | Gated | Reveals structure |
| SBOM | Gated or on request | See publish your SBOM publicly or share on request |
| Completed questionnaire | Gated | May contain customer or internal detail |
Design the gate
Keep it light. A request form that asks for company, role and purpose, an automated NDA click-through, and time-limited access links cover most cases. Log who accessed what and when; that log doubles as evidence of controlled distribution.
Avoid sending PDFs by email once the trust center works. Attachments get forwarded, and you lose the ability to revoke or update them.
Keep it current
An expired report on a trust page is worse than none. Put a date on each document and a review owner. See what a trust center should contain and security page: claims you can prove.
Mistakes
Publishing a certificate logo without scope or date. Gating everything, which pushes buyers to email requests and negates the point of a trust center. Making the NDA flow so heavy that sales bypasses it.
Start small
If you have no trust center yet, begin with the public set and a request form for everything else. You can add documents as buyers ask for them. Track which gated documents are requested most; those are candidates for a short public summary that answers the common question without exposing detail.
Quick check
Can a customer share a gated report with their auditor?
That depends on your NDA terms and the report's restrictions. State it clearly in the NDA.
How fast should access requests be approved?
Set an internal target and meet it. Automatic approval for known domains is common for low-risk documents.
Safeguard includes compliance and evidence automation that can feed the documents you share, and a free scan at gold.safeguard.sh/scan.
Last reviewed: 19 October 2026.
