How to set up a trust center

The page takes days. The decisions behind it, what you publish, what you gate and who approves, are what make it work. Do them in this order.

Last reviewed 2026-09-30Written by Jacob Masse, TrazTech Inc.

To set up a trust centre, gather the security material you already have, write a short controls summary from it, decide which documents are public and which sit behind an NDA, write down who approves requests, publish it on a subdomain, and put its upkeep on a calendar. A company with a current SOC 2 or ISO 27001 report can do this in two to four weeks. Without a report it takes about as long, and the page says honestly where you are.

Step 1: What do we need to gather first?

Everything a reviewer has asked you for in the past year, in one folder. The fastest source is your last three completed questionnaires: they show which questions buyers actually ask and what you answered.

0 of 0 done · Reset

• Current SOC 2 report or ISO 27001 certificate and Statement of Applicability, with period and expiry dates
• Bridge letter, if your report period ended more than a few months ago
• Latest penetration test letter of attestation or executive summary
• Policy set with version and approval dates
• Subprocessor list with purpose and data location for each
• Cloud regions for production data and backups
• Your last three completed security questionnaires
• An NDA template your legal counsel is happy to use for security documents

Step 2: How do we write the controls summary?

Write one or two factual sentences under each heading a questionnaire uses: access control, encryption, logging and monitoring, vulnerability management, secure development, backups and recovery, incident response, vendor management, people security and physical security. Each statement should be checkable. "All production access requires SSO with enforced multi-factor authentication, reviewed quarterly" is a statement. "We follow industry best practices" is not.

Step 3: What should be public and what should be gated?

Publish anything that answers a reviewer without helping an attacker: certifications held, the controls summary, subprocessors, data locations, the privacy policy and a vulnerability disclosure contact. Gate anything detailed: the SOC 2 report, penetration test output, full policies and completed questionnaires. What to publish goes item by item, and the publish or gate checker sorts your own list.

Step 4: Who approves document requests?

Write three rules before launch and the request flow runs itself. Existing customers get gated documents after accepting the NDA. Prospects with an open opportunity in your CRM get them after the NDA and a sales owner's confirmation. Everyone else waits for a named approver. Document request workflows covers the edge cases, such as competitors and researchers.

Step 5: Where should it live?

Use a subdomain such as trust.yourcompany.com so reviewers recognise it as official. The page itself can be on your own site with a request form, inside a compliance platform you already pay for, on a standalone trust platform, or hosted by a managed provider. The platform comparison and the cost page help you choose.

Step 6: How do we launch it?

Link it from your website footer, your sales email signature and every proposal. Send sales a one-line answer to "can you send your SOC 2" that points to the page. Tell your three most active prospects directly. Reviewers who find it on their own are the goal, but the first month depends on your team using it.

Step 7: How do we keep it current?

Review the whole page quarterly, and update immediately when a report period ends, a certificate renews, a policy changes version or a subprocessor is added. A stale page costs more trust than no page. Keeping it current sets out the calendar.

Common questions