What is a trust center?

A trust center (also called a trust portal or security portal) is a page where a vendor publishes the security information buyers usually ask for. Public parts are open to anyone; sensitive documents, such as an audit report, usually sit behind a request form or an NDA click-through.

What's usually in one

• certifications and audit reports (SOC 2, ISO 27001)
• security and privacy policies, or summaries of them
• the subprocessor list
• answers to common security questions, and sometimes a completed standard questionnaire such as a CAIQ
• status, incident and contact information

An example

PostHog's handbook points buyers to its trust center: "Use our Trust Center powered by SafeBase to self-serve reports, policies, and certifications" (PostHog). SafeBase is one of several products for building trust centers; Conveyor's pricing page, for example, includes a free trust center plan.

Trust centers and questionnaires

A trust center can head off some questionnaires and shorten others ("see our trust center for our SOC 2 report"). It rarely removes them entirely: many buyers' procurement processes still require their own questionnaire, filled in their own file. The two should agree, so update both when your answers change.

You don't need a trust center to answer questionnaires well. For an early company, a short, honest security page and a set of written policies you can share under NDA do most of the same job.