Give the trust page one named owner, usually in security or compliance, plus a second approver for claims, usually the person who owns the underlying control. Marketing edits wording, legal reviews risky phrases, and nobody publishes a claim without an evidence link. Add a review date to every section.
Why shared ownership fails
A trust page touches security, legal, sales, and marketing. When all four own it, none does. The usual symptoms are an audit status that is two quarters old, a subprocessor list that no longer matches reality, and a sentence added by sales that engineering never saw.
The fix is not a committee. It is a single owner with clear inputs from the others.
A simple role model
| Role | Does | Does not |
|---|---|---|
| Page owner | Keeps the page accurate, runs reviews, answers feedback | Invent claims |
| Control owner | Confirms each claim about their control is true today | Edit page layout |
| Legal reviewer | Checks wording on certifications, data, and commitments | Rewrite for style |
| Marketing editor | Fixes clarity and tone | Change meaning |
| Sales | Reports what buyers ask | Add claims directly |
Keep the list short. A section like encryption has a control owner in engineering. A section like subprocessors has one in procurement or privacy.
The claim record
For each factual line, keep a record next to the page source:
- the exact sentence
- the evidence (policy, report, screenshot of settings, log)
- the control owner
- the last date someone confirmed it
- the next review date
Sort the record by next review date and the page maintains itself. A claim with no evidence goes to the owner to fix or remove.
Words that need extra care
Terms about audits and certifications carry specific meanings. The AICPA describes SOC as a suite of service offerings CPAs may provide, resulting in assurance reports. A company does not hold a SOC "certification." If your audit is in progress, say it is in progress. Never write that a report is complete until the auditor has issued it. Have the legal reviewer look at any sentence containing audit, certified, compliant, or guaranteed.
Review rhythm
Set a rhythm that matches how fast the underlying facts change.
- Contact, reporting policy, and security.txt expiry: quarterly.
- Subprocessors and data locations: when they change, plus a quarterly check.
- Audit and attestation status: when a report is issued or a period closes.
- SBOM and advisory index: with every release.
RFC 9116, the security.txt standard, warns that stale information can be worse than none and tells organizations to keep contact details current. The same advice applies to the whole page.
Where Safeguard fits
Safeguard's compliance and evidence automation helps teams keep control evidence in one place, which makes a claim record easier to maintain. Try a free scan at gold.safeguard.sh/scan.
Quick check
Should marketing own the trust page?
Marketing can edit wording, but the page owner should sit with security or compliance because the content is about controls, and the owner has to know whether claims are true.
How often should a trust page be reviewed?
Match each section to how often its facts change. A fixed quarterly review plus event triggers, such as a new subprocessor or audit result, works for most teams.
Sources
- System and Organization Controls: SOC Suite of Services, AICPA and CIMA
- RFC 9116: A File Format to Aid in Security Vulnerability Disclosure
Last reviewed: 19 October 2026.
