Trust center

A public page where a company shows how it protects customer data: its security controls, compliance status, documents, subprocessors and security contacts.

A trust center is the page a company sends when a customer's security team starts a vendor review. It answers the common questions up front, so the review starts from answers rather than a blank questionnaire.

Most trust centers show security controls in plain language, compliance status such as SOC 2 or ISO 27001, policies to download, reports behind an access request, a subprocessor list, and routes for reporting a vulnerability or making a privacy request. They are also called security pages, trust portals or security portals.

What a reviewer wants to see

• Claims that are specific and dated, not marketing
• A way to request the reports that aren't public
• Evidence the page is maintained, such as a last reviewed date