Questions to ask a trust center provider
Ask every provider the same questions in writing. Three answers to the same list are comparable; three sales calls are not.
Put these twelve questions in writing to every trust centre platform or managed provider you consider, including TrazTech, which operates this site. A good provider answers each specifically. Vague answers on data location, export and who approves answers are the ones to walk away from.
Data and hosting
- Where are our documents and the viewer logs hosted?
- A good answer names the cloud provider and region. For a Canadian company, ask whether a Canadian region is available.
- Who at your company can see our gated documents?
- Named roles, with access logged. "Anyone on support" is not an answer.
- Will you sign our DPA and appear on our subprocessor list?
- Yes, without negotiation. A provider hosting your documents is a subprocessor.
- What independent assurance do you hold?
- A current SOC 2 or ISO 27001 of their own, available under NDA.
What a good answer sounds like
Evidence that passes. Region names, role names and their own report.
Common mistakes. Accepting "enterprise-grade security" as an answer.
In Canada. Your customers may ask where the trust centre itself is hosted, because it holds their NDA records.
How the service runs
- Who approves an answer before a buyer sees it?
- You, for anything new. Pre-approved answers only from your library.
- What response times do you commit to?
- A stated first-response target for questions and requests, in writing.
- Whose NDA is used?
- Yours, so the agreement is between your company and the requester.
- What does the monthly report contain?
- Requests, releases, questions, response times and accounts evaluating you.
What a good answer sounds like
Evidence that passes. A sample monthly report and a written response target.
Common mistakes. A provider using its own NDA for your documents.
Typical timing. Onboarding of two to four weeks with content in hand.
Commercial terms
- How is it priced, and what makes the price change?
- A clear basis: review volume, documents, seats or questionnaires. In CAD, or state the currency.
- Are questionnaires included?
- A straight answer. Often an add-on, priced per questionnaire or as a volume.
- What do we get back if we leave?
- Content, answer library, documents and access logs, exported in a usable format.
- What happens if you are acquired or retire the product?
- Contract terms covering notice and export. Relevant in a market with recent acquisitions.
What a good answer sounds like
Evidence that passes. Export and termination terms in the contract, not a promise on a call.
Common mistakes. Comparing a platform licence with a managed service quote as if they were the same thing.
Common questions
Should we ask a trust centre provider for references?
Yes, with permission, from a customer of similar size and buyer type. Ask the reference how quickly requests are released.