The Compliance Brief for trust center owners
Every Tuesday, the stories from the past week that change what a buyer's security team asks you, and what to put on your trust center before they do.
Every vendor breach and every settlement with remediation terms ends up as a new line in somebody's security questionnaire. The Compliance Brief tracks them as they happen, so the answer is on your trust center before the question reaches your inbox.
Below are the stories from recent issues that bear on security reviews and vendor diligence, each with the short version and a link to the full take.
Free weekly email
Get the next issue on Tuesday
Join the list and the next issue arrives Tuesday morning. Or read a few below first.
Free. One email every Tuesday from Jacob Masse, and nothing else: signing up here does not add you to any other sequence. One click unsubscribes.
Latest on security reviews, vendor diligence and trust
- Ottawa is looking at how a breach was disclosed, not only how it happened
Canada's federal privacy regulator opened an investigation into IDScan following a data breach. - Your AI agents are logging in as humans and SOC 2 cannot tell
A vendor-authored piece argues that AI agents often operate through human credentials, so actions taken by an agent look identical to actions taken by the person whose credentials it borrowed. - Revolut handed over customer data to someone pretending to be a government
Revolut confirmed that an unauthorized party obtained customer information by submitting a fraudulent data request from a legitimate government email domain. - Trezor's supplier breach keeps growing, and it was never Trezor's system
Trezor says a breach at its supplier ShipMonk is considerably worse than first reported, now affecting around 81,000 customers. - Revolut gave customer data to someone posing as a government agency
Revolut disclosed a breach after sharing customer data with a threat actor impersonating a government agency. - Delaware amends its privacy and breach notification laws
On September 2, 2026, Delaware's governor signed HB 380 and HB 381. - Thomson Reuters court software breached in March, disclosed in September
Thomson Reuters disclosed that an unauthorized party obtained files from C-Track, the court case management platform sold by its West Publishing unit, in March 2026. - McKesson tells the SEC it was hit through third-party applications
McKesson disclosed a cybersecurity incident in which attackers got into third-party applications and stole data, with the intrusion detected on August 25, 2026.
Every issue on TrustCenter
- Issue 8: Ottawa is looking at how a breach was disclosed, not only how it happened
- Issue 7: Revolut handed over customer data to someone pretending to be a government
- Issue 6: Trezor's supplier breach keeps growing, and it was never Trezor's system
- Issue 5: Thomson Reuters court software breached in March, disclosed in September
- Issue 4: McKesson breach came through third-party applications
- Issue 3: SickKids gets hit through somebody else's software
- Issue 1: LexisNexis pulled products offline over a third-party vendor incident
Every issue in full, including the stories outside security reviews, vendor diligence and trust, is in the archive on traztech.ca. Issues with nothing on security reviews, vendor diligence and trust are listed there and not here.
Questions
How often does The Compliance Brief arrive?
Once a week, on Tuesday morning. Each issue covers the past week in five stories or so, with what happened and a short take on what it means for Canadian companies answering customer security reviews.
What does it cost?
Nothing. It is written by Jacob Masse, Principal at TrazTech Inc., which operates TrustCenter. There is no paid tier.
Will signing up here send me anything else?
No. The form on this page adds you to The Compliance Brief and nothing else. Downloading a checklist elsewhere on the site is a separate signup, and it says what it sends before you give an address.
How do I stop it?
Every issue ends with a one-click unsubscribe link, and it is honoured immediately. Replying to any issue also reaches Jacob directly.
Free weekly email
Get it every Tuesday
One email a week on security reviews, vendor diligence and trust. Free, and one click to leave.
Free. One email every Tuesday from Jacob Masse, and nothing else: signing up here does not add you to any other sequence. One click unsubscribes.