The Cloud Security Alliance describes its free STAR Registry as a public place where providers list their security and privacy controls, and says publishing there can reduce the number of customer questionnaires. The same logic is behind a trust center: answer once, publicly, then point buyers to the page.
What's affected
Small software companies that get the same security request every week. A trust center is a public or gated page that holds the facts buyers keep asking for.
What to do now
Publish these seven things, in this order:
- A one-paragraph security overview in plain language.
- Your hosting provider, regions and subprocessors.
- A short list of controls you actually run: SSO and MFA, encryption in transit and at rest, backups, logging.
- Your policy list, with the documents available on request.
- Any reports you hold, such as a SOC 2 report or an ISO 27001 certificate, with the dates. Share full reports behind an NDA.
- A security contact and a vulnerability reporting address, for example a security.txt file at /.well-known/security.txt.
- A status page link.
Leave out anything you cannot prove today. Do not list a framework you are only planning.
How to avoid this trap
- Do not copy another company's page. Buyers cross-check.
- Assign an owner and a review date. A page showing 2024 dates in 2026 looks worse than none.
- Gate full reports and pen test summaries. Public pages should hold facts, not evidence.
Try it yourself
Write the seven items above for your own company in one document, then compare it with a questionnaire you answered last month. Every question that page answers is a question you can skip next time.
Click through it at your own pace, or open it full screen.
Quick check
Which documents belong behind an NDA rather than on the public page?
Full audit reports, penetration test reports and detailed architecture documents. Publish summaries and dates publicly.
