Support Library

Trust Centers: What to Publish and Why

A trust center is a public page that answers the security questions every customer, auditor and procurement team asks: which standards you meet, who handles their data, how to report a vulnerability and whether the service is up. Publishing it saves weeks of questionnaires and shows you take security seriously.

Author
CategoryWebsite Security
Length5 minute read
UpdatedNovember 1, 2026

The short answer

Publish one page, linked from your homepage footer as “Security” or “Trust”, that lists your attestations, links your subprocessor list, vulnerability disclosure policy and status page, and offers security documentation (openly or on request under NDA). Add a security.txt file that points to it.

What a buyer looks for

How a trust center shortens a customer security review compared with answering questionnaires by email Top, nothing published: a prospective customer’s security team cannot find any security information, sends a long questionnaire, waits weeks for answers, and the deal stalls. Bottom, trust center: the team finds attestations, the subprocessor list, the disclosure policy and documents in one place, requests the SOC 2 report under NDA, and approves the vendor quickly. Nothing published Buyer’s review Searches the site Nothing found No security page Questionnaire sent Hundreds of questions Deal stalls Weeks of back-and-forth Slow, repetitive reviews Looks less mature than rivals Trust center published Buyer’s review Finds /trust Answers in one place SOC 2, ISO 27001 Report requested Under NDA Vendor approved Days, not weeks Fewer questionnaires Clear sign of a mature program How a trust center shortens a customer security review compared with answering questionnaires by email Top, nothing published: a prospective customer’s security team cannot find any security information, sends a long questionnaire, waits weeks for answers, and the deal stalls. Bottom, trust center: the team finds attestations, the subprocessor list, the disclosure policy and documents in one place, requests the SOC 2 report under NDA, and approves the vendor quickly. Nothing published Buyer’s review Searches the site Nothing found No security page Questionnaire sent Hundreds of questions Deal stalls Weeks of back-and-forth Slow, repetitive reviews Looks less mature than rivals Trust center published Buyer’s review Finds /trust Answers in one place SOC 2, ISO 27001 Report requested Under NDA Vendor approved Days, not weeks Fewer questionnaires Clear sign of a mature program
Trust center platforms such as SafeBase, Vanta, Drata, Conveyor and Whistic host the page and gate private documents behind an NDA.

How DNS Panopticon detects it

Security Posture looks for a trust center or security page linked from the homepage, at trust.<domain>, /trust or /security, or hosted on a trust center platform, then reads it for each item below. Each missing item costs points on the Trust Center card. Pages that load their content with JavaScript cannot always be read; items not found elsewhere are then reported as unknown rather than missing.

FindingSeverityWhen it appears
No trust center or security page found25 pointsNothing linked from the homepage and nothing at the usual addresses.
No compliance attestations named20 pointsNo SOC 2, ISO/IEC 27001, PCI DSS, FedRAMP or similar is named.
No vulnerability disclosure policy found15 pointsNo policy telling researchers how to report flaws, including a Policy line in security.txt.
No subprocessor list found10 pointsNo list of the third parties that handle customer data.
No status page found10 pointsNothing links to a status page and status.<domain> is not on a status page service.
No security documentation found10 pointsNo whitepaper, policies, penetration test summary, DPA or questionnaire answers (CAIQ, SIG, HECVAT).
… couldn’t be readNot gradedThe page or item exists but its text could not be read.

The security.txt part of this card is explained in security.txt.

How to check it yourself

Command or pageWhat to look for
curl -sI https://trust.example.comWhether a trust subdomain answers.
curl -sI https://example.com/securityThe same for a /security or /trust path.
curl -s https://example.com/.well-known/security.txtContact and Policy lines, which should point to your disclosure policy.

Then read the page as a customer would: can you find each item in the table above within a minute?

What to publish

ItemWhat it isWhy buyers ask
AttestationsSOC 2 Type II, ISO/IEC 27001, PCI DSS, HIPAA, FedRAMP and similar, with the audit period or certificate.Independent proof that controls exist and work.
SubprocessorsEvery third party that processes customer data, what it does and where, with a way to subscribe to changes.GDPR Article 28 and most data processing agreements require it.
Vulnerability disclosure policyHow to report a flaw, what is in scope, and a promise not to take legal action against good-faith researchers.CISA, ISO/IEC 29147 and the EU Cyber Resilience Act expect one.
Status pageLive service status and incident history, usually at status.<domain>.Shows how outages are handled and communicated.
Security documentationWhitepaper, policy summaries, penetration test summary, DPA, CAIQ, SIG or HECVAT answers.Answers most questionnaire questions in advance.

Why it matters

  • Sales speed. Security reviews are a common reason enterprise and public sector deals stall. Ready answers shorten them.
  • Researchers know where to go. A disclosure policy turns a found vulnerability into a report, not a public post.
  • Regulation. Subprocessor transparency and vulnerability handling are becoming legal expectations, not just good practice.

How to build one

  1. Start simple: a /security page with the items above is enough. A platform is optional.
  2. Link it from the footer of every page, and from security.txt with a Policy line.
  3. Write the disclosure policy from an established template such as CISA’s or disclose.io’s, and name a monitored contact.
  4. Publish the subprocessor list and offer email notice of changes.
  5. Set up a status page on a separate service, so it stays up when your platform is down.
  6. Gate sensitive reports, such as the full SOC 2 report, behind a request form or NDA, but say that they exist.
  7. Keep dates current. An expired certificate or a two-year-old pen test summary does more harm than good.

FAQ

We are too small for SOC 2. Is a trust center still worth it?

Yes. A clear security page with your practices, subprocessors, disclosure policy and status page answers many questions without an audit, and the attestations finding is only one part of the card.

Our trust center is on SafeBase and the finding says it couldn’t be read.

Hosted platforms often load content with JavaScript, which DNS Panopticon cannot run. Those items are reported as unknown and cost nothing. Linking the main items, such as the subprocessor list and policy, as plain pages makes them readable.

Does DNS Panopticon check our SOC 2 report?

No. It only checks that an attestation is named. Customers should ask for the report and check its scope and period.

Sources and further reading

Related support articles

security.txtPrivacy Policy RequirementsPublished Data Breaches of Your Site