A good trust center states your security posture in plain language, lists your audits and their status accurately, shows your subprocessors, and gives buyers a way to request gated documents. Publish what is true and current. Gate what is sensitive. Leave out anything you cannot back up.
Why it exists
Every security questionnaire repeats the same questions. A trust center is a page, or a small site, where those answers live once. Buyers read it first, and many questionnaires get shorter or disappear. Your security team stops retyping the same paragraph.
Publish openly
- Security overview. Encryption in transit and at rest, authentication options, logging and backup practices, in plain words.
- Compliance status. List each audit or attestation with its real status. If a SOC 2 Type 2 is in progress, say in progress. Never imply it is done. Names of audits are not certifications, so word each one carefully.
- Subprocessors. Name, purpose and location. See subprocessor lists.
- Data handling. Where data lives, how long it is kept, how deletion works.
- Vulnerability reporting. A way to report issues, ideally with a security.txt file.
- Contact. A real address for security questions.
Gate behind NDA or request
- Audit reports and penetration test summaries.
- Detailed architecture diagrams.
- Policies you consider internal, such as the full incident response plan.
- Completed standard questionnaires.
A request form that captures company name and use case helps you track who has what. Keep approval quick, or the gate becomes the very delay you wanted to remove.
Keep out
- Claims you cannot prove today.
- Customer names without permission.
- Logos of frameworks you have not been assessed against.
- Screenshots that expose internal tools or hostnames.
Keep it current
An outdated trust center is worse than none. Assign an owner and a review date. A quarterly check is enough for most teams. When a subprocessor changes or an audit completes, update the page the same week.
Proof beats prose
Where you can, link evidence: the audit period, the report date, the scope. Buyers read specifics as honesty and vague superlatives as filler.
A small team version
If you have no tooling, a single page with the six items above, a gated folder and a request email is a real trust center. Start there. Tools help later with access logging and automatic updates.
Quick check
Should the trust center show our SOC 2 report publicly?
Usually no. State its status publicly and share the report on request, often under NDA.
What if our audit is not finished?
Say it is in progress, with the type and expected timing if known. Do not describe it as complete.
Last reviewed: 19 October 2026.
