Framework status, not a slide
SOC 2, ISO/IEC 27001, GDPR, HIPAA and the rest read from continuous control monitoring. A period that has ended says so on its own, and a control that drifted stops claiming it passes.
read from live monitoring
Trust Center
Your security review, answered before it starts.
A public page that reads from continuous control monitoring — framework status, policies, subprocessors, and audit reports released on your approval. Publishing one is a database row: no DNS record, no certificate step, no propagation wait.
trust.safeguard.sh*.trust.safeguard.shtrust.your-own-domain.com
◉ continuous watchevery control in a monitored orbit
Why it matters
A security review is four questions in a trench coat
Which frameworks do you hold, what are your policies, who touches our data, and can we read the report. A trust center answers all four before anyone opens a spreadsheet.
Policies and vendors, current
Versioned policies and the subprocessors that touch customer data, each with its purpose and processing location. They change when the platform changes, not when someone remembers the page exists.
versioned · dated
Reports released on approval
The SOC 2 and pentest reports are never linked publicly. A requester asks, you approve, and one named party gets the file — which carries the sha256 of the exact bytes they received.
gated · hash-verified
Found before the call
The page is indexable, so a prospect searching your name lands on your posture instead of a contact form. The questionnaire that used to open the conversation is already answered.
public · indexable
The mechanism
Every control, sealed with its hash
Controls report continuously onto one measured timeline. The period seals into a document that carries its own SHA-256 — and then it leaves twice: the public slice openly and always, the gated copy only after you approve it, to one named requester.
◈ the evidence chain · every control, sealed with its hashthe gated copy travels only after you approve
01
Choose what is public
Each section — posture, frameworks, policies, subprocessors, certifications — carries its own visibility. The API applies it server-side and returns a whitelist, so a field you did not publish cannot reach the page even by mistake.
02
It is live immediately
There is no per-customer DNS record to create. A wildcard already points every <you>.trust.safeguard.sh at the trust app and the wildcard certificate already covers it, so publishing is a database row — no propagation wait, no certificate step.
03
Your own domain, when you want it
Point trust.your-domain.com at us and the page answers on it, with a certificate issued on demand once the hostname is authorised. The page is yours: your logo, your accent, your name in the masthead.
Our trust center
We publish ours on the same page you would
Everything below is read live from this endpoint by the same components that render a customer's page. If it is wrong here, it is wrong there.
SOC 2 Type II
In Progress
ISO/IEC 27001:2022
Aligned
GDPR
Compliant
FedRAMP HIGH
Architecture Aligned
STQC readiness
Readiness
Penetration test summary
Available on request
SOC 2 Type II report (on completion, under NDA)
Available on request
ISO/IEC 27001:2022 statement of applicability
Available on request
Control documentation
Available on request
Looking for a company?
Trust pages live on their own address
Whoever landed here followed a half-remembered link. There is no directory to search — ask the company for their trust center link, or check the security section of their website.
A company’s page is at company.trust.safeguard.sh unless they publish it on their own domain. We do not list customers here — who holds a trust center is theirs to disclose, not ours.
A page per company
Published at company.trust.safeguard.sh, or on the company's own domain such as trust.example.com.
Current, not a snapshot
A read-only projection of live control monitoring. An audit period that has ended says so on its own.
Reports stay gated
SOC 2 and pentest reports are released to a named requester after approval, never linked publicly.
Answer it once. Keep answering it automatically.
Publishing your trust center is a row in the compliance platform you already run. The page keeps itself current from there.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.