Publish or gate: sort your documents
Tick what you have. Each document comes back sorted, with a one-line reason.
Deciding what goes on the public page and what sits behind an NDA is the decision that shapes a trust centre. Tick the documents you have and this sorts them. What to publish explains the reasoning in full.
On its way
Check your inbox shortly. If you would rather talk it through, book a time.
The rule behind the sorting
Publish what answers a reviewer without helping an attacker. Gate what is detailed or restricted in use. Keep internal anything that maps your systems in a way no reviewer needs. When in doubt, gate it: a reviewer will accept an NDA, and you can always publish more later.
Common questions
Why is the full penetration test report kept internal?
It describes how your system can be attacked, even after fixes. A letter of attestation from the tester proves testing happened without exposing findings.