Use a PDF security packet if you have few buyers and little changes. Move to a trust center when the same requests arrive every week, or when your subprocessors and audit status change often. The right choice depends on volume and freshness, not on how modern it looks.
The two approaches
A PDF packet is a bundle sent by email: a short security overview, a summary of controls, perhaps a standard questionnaire. It is simple and fully under your control.
A trust center is a web page with the same content, plus a gated area for sensitive documents and a request flow.
Comparison
| Factor | PDF packet | Trust center |
|---|---|---|
| Setup effort | Hours | Days to weeks |
| Staying current | Manual, copies drift | One place to update |
| Access control | Email and NDA by hand | Request flow, access list |
| Buyer experience | Waits for reply | Self serve for public items |
| Tracking | Inbox search | Who accessed what |
| Cost | Staff time | Tool or build cost plus time |
Where the PDF wins
- Early stage, a handful of deals a quarter.
- You want to tailor the message to each buyer.
- Nothing changes month to month.
The danger is drift. Six versions of the packet circulate, and one still lists a subprocessor you dropped. Add a date and version to the cover page and keep one master copy.
Where the trust center wins
- You answer the same questions repeatedly.
- You need to show document access, for example who downloaded the audit report.
- Buyers expect to find answers without contacting you.
- Several people maintain the content.
A staged path
- Start with one master PDF with a version and date.
- Put the public parts on a web page, even a plain one.
- Add a gated folder with a request address.
- Adopt a tool only when volume justifies it.
Common mistakes with either
- Listing audits as done when they are in progress.
- Sharing sensitive reports without an NDA record.
- No owner for updates.
- Overstating coverage with framework logos.
Our guide on what a trust center should contain gives a content checklist that works for both.
Quick check
Is a trust center required for SOC 2?
No. It is a sharing convenience. An audit does not require you to publish anything.
Can a small startup skip the trust center?
Yes. A dated, accurate packet and a named contact are enough until request volume grows.
Last reviewed: 19 October 2026.
