A security page should only say things you can prove today, with the scope and the date attached. "We encrypt customer data at rest with AES-256 in our production database" is checkable. "Military-grade security" is not. Every claim you cannot back with evidence is a liability, not marketing.
Why wording matters more than design
Buyers, auditors and journalists read a security page literally. When an incident happens, the page becomes Exhibit A. A sentence like "your data is always safe with us" reads very differently after a breach than before it.
The fix is not to say less. It is to say things that stay true.
Three tests for every sentence
Run each sentence through these tests before it ships.
- Can someone check it? A named control, a document, a report or a setting. If the only proof is "trust us", cut it.
- Is the scope clear? "We encrypt data" is vague. Which data, where, and in transit or at rest?
- Will it still be true in six months? If a claim depends on a tool nobody owns, it will rot.
Phrases to replace
| Instead of | Write |
|---|---|
| Unhackable, bulletproof | We run regular testing and fix findings by severity. State the cadence you actually keep. |
| Bank-level or military-grade encryption | Name the protocol and where it applies, for example TLS for traffic between clients and our servers |
| Fully compliant | Name the framework and the exact status, such as "audit in progress" or the report period |
| We take security seriously | Delete it. Show a control instead. |
| Zero vulnerabilities | Describe how you find, rank and fix them |
If a framework status is in progress, say so plainly. Never write that an attestation or certification is complete when it is not.
Add dates and owners
A claim with no date looks stale even when it is fine. Put a "last reviewed" date at the bottom and a named owner in your internal tracker. Review the page on a set schedule, and also after any change to hosting, subprocessors or authentication.
Keep a claims register
Keep a simple internal table: claim, evidence link, owner, next review date. When sales, marketing or a questionnaire answer wants a new claim, the register tells you whether you already have proof. It also makes the next customer review faster, because the evidence is already collected.
Where Safeguard fits
If part of your evidence collection is manual, Safeguard offers compliance and evidence automation so that claims on the page map to current artifacts. You can also run a free scan at https://gold.safeguard.sh/scan to see what an outsider sees in your dependencies.
Quick check
Is it fine to list security badges on the page?
Only if each badge maps to something you actually hold, and the page says what it covers and for which period. A badge with no context invites questions you may not want.
Should the page promise a response time for reports?
Only one you can keep. Promise acknowledgement, not a fix date.
Last reviewed: 19 October 2026.
