.png&w=3840&q=75&dpl=dpl_Ba6pf7ueYcNioUvDkWkKkJsULeG7)
What is a trust center?
Direct answer
A trust center is a page where a company shows its security and compliance posture to customers and prospects: certifications, policies, controls, hosting and subprocessors. Public items are open to anyone, while sensitive documents sit behind an access request and often an NDA.
Its job is to answer buyers’ security questions before they send a questionnaire, and to speed up the ones they still send.
What a trust center usually shows
- Certifications and frameworks, such as ISO 27001 or a SOC 2 report.
- A register of security controls and their status.
- Policies and other documents, with their version and date.
- Hosting providers and subprocessors, which buyers and privacy laws often ask about.
- Security metrics a company chooses to share.
- A contact for security questions.
No law requires a trust center. It is a sales and assurance tool: buyers under NIS2, DORA or the GDPR still have to assess their suppliers, and a trust center gives them the evidence in one place.
Open and gated content
Most trust centers have two tiers. The open tier is readable by anyone and lists what the company is happy to publish, often with the titles of confidential documents shown as locked. The gated tier opens after a visitor requests access and the company approves, usually with an NDA signed first. A good trust center records who was granted access, when it expires and what was viewed or downloaded.
Trust center or security questionnaire?
Both, usually. A trust center answers the common questions once, for everyone. Questionnaires keep coming, because each buyer has its own list. The two work best from the same library of approved facts, so the page and the answers say the same thing. See how to answer a security questionnaire.
The Trust Center in Acuna GRC
In Acuna GRC, the Trust Center is first about answering the questionnaires prospects send, from one Exposure Library of what you choose to disclose. The same library feeds a public page with an open tier and a gated tier. Every exposed item is Not public, Gated or Public, nothing is shown until someone has placed it in the library, and a granted visitor can sign your NDA before the gated page opens. Every view and download on the gated tier is recorded. See the Trust Center.
How Acuna GRC handles it
- Module
Trust Center
Answer RFPs and security questionnaires from an approved answers library and an exposure library, and share a public trust page with gated documents.
- Solution
SOC 2
Keep SOC 2 evidence for the whole period as work happens, reuse your ISO 27001 controls, feed controls from your tools and share the report under NDA.
- Solution
ISO 27001
Adopt ISO 27001, give every control an owner, run your risks and policies, and keep the records an auditor asks for, with measures shared across frameworks.
Frequently asked
Should a trust center be public?
Partly. Publish what helps buyers and carries no risk, such as certifications and subprocessors, and keep detailed reports and policies gated behind an access request.
Does a trust center replace security questionnaires?
Rarely. It reduces the number of questions and speeds up review, but many buyers still send their own questionnaire.
What belongs behind the NDA?
Usually audit reports such as a SOC 2 report, penetration test summaries and internal policies. The certificate itself and the list of subprocessors are often public.
See how Acuna GRC runs this.
Tell us your frameworks and your team. We show you how Acuna GRC runs the program.
Hosted in Switzerland, the EU or the US