Trust Center
A trust center is a public page — typically trust.yourcompany.com — where prospects and customers self-serve your security posture: certifications and reports, sub-processor list, policies summaries, uptime, and a request flow for NDA-gated documents like the full SOC 2 report. Every major compliance platform now sells one, which tells you the category became table stakes.
Why it earns its keep
It moves security review earlier and makes it cheaper. Buyers’ security teams check the trust page before the first call; a good one pre-answers the majority of a questionnaire before it’s sent, and a SOC 3 posted publicly lets prospects verify the Type II exists without an NDA dance. Sales cycles shorten measurably when the security conversation starts at “here’s everything” instead of “let me check.”
What a credible one contains
Current certifications and report availability (with dates — stale badges are anti-signals), the sub-processor list with its change- notification mechanism, data residency and encryption posture, and a document-request flow that actually responds. The failure mode is decorative trust pages: badges without dates, policies without substance, a request button that emails a void.
The maintenance rule
A trust center is a living artifact — it goes stale the day a sub-processor changes or a report period lapses. Wire it to the same evidence pool that feeds your audits and it maintains itself; maintain it by hand and it quietly rots into a liability that security reviewers screenshot.
Security Questionnaire — Security questionnaires are buyers' vendor-risk interrogations — CAIQ, SIG, or bespoke spreadsheets. The teams that answer fast win deals faster.
SOC 3 — A SOC 3 is the public, general-use version of a SOC 2 Type II report — same audit, no confidential detail, freely publishable on your website.
Sub-processor — A sub-processor is any third party your company uses to process customer personal data — your cloud host, email provider, analytics. You must disclose them.