Support
How can we help?
Step-by-step guides for every part of Trusterio, and straight answers to what people ask most.
Guides
Getting started
- Getting startedFrom your first sign-in to your first business: name your company, start the subscription, create the business, and what to do first.Read the guide
- Your team and their rolesInvite colleagues to a business, choose what each may do, and give a company role to who runs the company.Read the guide
Your compliance
- Frameworks and controlsSay which frameworks apply, decide requirement by requirement, and see what makes a control count towards your score.Read the guide
- Evidence, checks and findingsAttach evidence, schedule the checks your connections run, record the ones a person does, and work the findings until a reading shows them fixed.Read the guide
- Risks, policies and peopleKeep a risk register that counts only real reductions, publish policies people accept, and keep your people list and their training current.Read the guide
- Questionnaires and AI AssistImport a customer’s questionnaire, draft answers from your own records, approve them, and send it back in the format it came in.Read the guide
- The Trust CenterPublish your security page, on our address or your own domain, and release documents to the people who ask for them.Read the guide
Connections
- Connect AWSOne CloudFormation stack in your account, read-only, with no access key: Trusterio reads IAM, storage, compute, logging and detection.Read the guide
- Connect AzureOne command in Azure Cloud Shell gives Trusterio Reader on your subscription and read access to your directory, with no secret to keep.Read the guide
- Connect Google CloudOne command in Cloud Shell gives a read-only service account on a project, with no key to keep.Read the guide
- Connect Microsoft Entra IDAn app registration with three read permissions lets Trusterio read accounts, MFA, conditional access and admin roles.Read the guide
- Connect Google WorkspaceA service account with two read-only scopes: Trusterio checks two-step enforcement and audit logging, and lists five settings for you to check in the Admin console.Read the guide
- Connect GitHubA fine-grained, read-only token for your GitHub organisation: Trusterio checks branch protection, reviews, 2FA and security alerts.Read the guide
- Connect OktaAn API token made by a read-only administrator: Trusterio checks MFA and password policies, session lifetime, and accounts that should be gone.Read the guide
- Connect Microsoft IntuneAn app registration with read permissions on your managed devices: encryption, OS version, PINs and compliance policies.Read the guide
- Connect Jamf ProAn API client with two read privileges: Trusterio checks FileVault, firewall, Gatekeeper, SIP, OS version and check-ins.Read the guide
- Connect Kandji (Iru)An API token with two permissions: Trusterio checks the agent, check-ins, FileVault, OS version and missing devices.Read the guide
- Connect your HR systemPersonio, HiBob or BambooHR: Trusterio reads who works there, from when and until when, so joiners and leavers are checked against every account.Read the guide
- Connect JiraSend a remediation task to Jira as an issue, and have its status read back. Trusterio creates issues when you ask, and changes nothing else.Read the guide
- Connect SlackPost Trusterio’s notices to the channels you choose. Trusterio posts, and reads nothing from your Slack.Read the guide
- Connect your AILet an AI app such as Claude read your compliance records and draft work in one business, with your rights and no more.Read the guide
Account and security
- Billing€500 a month for the first business and €250 for each one added, billed yearly. Invoices, adding and closing a business, exports.Read the guide
- Security: two-step sign-in, single sign-on and support accessTurn on an authenticator, require one for everybody, sign in through your identity provider, and see when our support looks at your account.Read the guide
What does Trusterio do?
Trusterio is a compliance platform for European companies. It connects to the systems you already run, collects evidence from them continuously, tracks your controls against ISO 27001, ISO 42001, SOC 2, GDPR, NIS2, DORA and the EU AI Act, and publishes a Trust Center where your customers can review your security and request your documents.
What is a Trust Center?
A Trust Center is a public page where a company publishes its security, privacy and compliance information — certifications, policies, subprocessors, and the documents a prospective customer asks for during a security review. It replaces the spreadsheet-and-email cycle that a procurement review usually becomes.
Where is our data stored?
In the European Union: Trusterio runs on EU infrastructure, and its subprocessor list names each company and country. For your own Trust Center, a data residency statement that your connected systems contradict cannot be published — the check runs in the database, not in a form.
Which frameworks does it cover?
ISO 27001, ISO 42001, SOC 2, GDPR, NIS2, DORA and the EU AI Act. Controls map to requirements across frameworks, so evidence collected once counts everywhere it applies.
How is evidence collected?
Through read-only connections to the systems you already use — AWS, Azure, Google Cloud, Entra ID, Google Workspace, GitHub, Okta, Intune, Jamf, Kandji, and Personio, HiBob or BambooHR. Trusterio reads them and never changes anything in them. Jira and Slack are different: they carry work out rather than evidence in, so Trusterio creates an issue in Jira for each fix you send there, and posts the notices you choose to Slack.
Does Trusterio use our data to train models?
No. Trusterio AI Assist drafts from your own records — policies, questionnaire answers, and your privacy policy and DPA among them — and every questionnaire answer is checked against its sources before anybody sees it; a drafted policy lists the promises no control backs. To write a draft, the text it needs is sent to a model hosted in the EU; for a privacy policy or DPA that includes the contact details the document must name. The AI Assist page in your business says exactly what each draft sends and where it goes. We do not train models on your data.
Can I connect our own AI assistant?
Yes. A member can connect an AI app such as Claude to one business over MCP, after approving it, and the app gets no more rights than that member has. It can read controls, risks, findings, policies and questionnaires; it can draft questionnaire answers, add evidence, add and update risks, and move a finding to open, in remediation or resolved. A drafted answer stays a draft until a person approves it. It cannot delete anything or touch members, billing or security settings, and every change it makes is recorded in the audit log under the member’s name, with the app it came through.
What does it cost?
€500 a month for the package, which covers one business, and €250 a month for each business you add. Both are billed yearly (€6,000 and €3,000 a year), and both exclude VAT.
Is there a free plan or a trial?
No. There is one package, and it is the whole product: nothing is held back for a higher tier, and nothing is given away on a lower one.
Can we pay monthly?
No. The subscription is yearly. The monthly figure is there so you can compare it with what you pay for other tools.
Do you charge per user?
No. People are unlimited on the package. Charging per seat in a compliance tool means half the company never logs in, which defeats the point of the tool.
What happens if I add a second company?
It is €250 a month, invoiced yearly (€3,000) from the day you add it, on a subscription of its own with its own renewal date, and you see what it will cost before you add it. Each business has its own controls, evidence, findings and Trust Center. The package allows up to three businesses; if you need more, contact us and we will raise it.
Do we get money back if we stop or close a business during the year?
No. The subscription is billed once a year, in advance, and the year already paid is not refunded. Each business you add is a subscription of its own, for a year from the day you add it, and one you close ends when that year ends.
What if we stop paying?
The subscription ends, and nobody can open the account or its Trust Center until it is renewed. Renew within 90 days and everything comes back as it was. After 90 days, all of its data is deleted.
What is the difference between a company and a business?
Your company is who subscribes and pays. A business is one business your company runs, with its own controls, evidence, policies, integrations and Trust Center. The package includes one business; each one added is priced separately.
How do I invite a colleague?
Open Members & roles, under Administration, and press Invite somebody. Choose their role; the invitation link works for seven days. People are unlimited on the package.
Somebody left. How do I take away their access?
Remove them from the business in Members & roles. If your HR system is connected, Trusterio also checks every connected system for the accounts a leaver still has, and keeps the task open until a later reading shows them gone.
How do I close our account?
An owner closes each business under Billing. Closing the last one closes the account; everything is deleted thirty days later, and until then you can still sign in, export and reopen it.
Can we require two-step sign-in for everybody?
Yes. An owner or administrator switches on Require two-factor authentication under Administration, Authentication. It applies at once, to sessions already open too, and whoever has no authenticator sets one up before continuing.
I lost my authenticator. What now?
Ask an administrator of your company to reset it under Administration, Authentication. There are no backup codes, so adding a second authenticator app while you can is worth doing.
Do you support single sign-on?
Yes, SAML 2.0. Once your email domain is verified and your identity provider is configured, everybody at that domain signs in through it, and password sessions are ended. The security guide gives the steps.
Can Trusterio staff see our data?
Only when supporting you: one company at a time, with a reason, for a limited time, and after signing in with their own second factor. Every visit is written in your audit log. To change anything, support has to ask, and an owner or administrator must allow it.
How do I report a vulnerability?
Write to security@trusterio.com.
Can we export everything?
Yes. An owner exports a business from Billing, Exports: one archive of every record and document, with a list of anything left out. It can be downloaded by whoever asked for it for fourteen days.
What happens to our data if we stop?
If the subscription ends, nobody can open the account until it is renewed. Renew within ninety days and everything is as it was; after that it is deleted. If you close the account yourself, it is deleted after thirty days.
Does Trusterio change anything in our systems?
No, except in the two connections that exist to write: Jira, where it creates an issue when you send a task there, and Slack, where it posts the notices you choose. Every other connection is read-only.
What does AI Assist send, and where?
The text a draft needs, from your own records, goes to a model hosted in the EU, in France, with training on the data switched off. On the AI Assist page in your business, the (i) next to the model shows exactly what each kind of draft sends.
Which AI apps can we connect?
Any app that speaks MCP and can sign in with OAuth, such as Claude. A member connects it to one business after approving it, and it acts with that member’s rights and no more. The guide Connect your AI explains the steps.
Can a connected AI app delete anything?
No. It can read, draft questionnaire answers, add evidence, add and update risks, and move findings between open, in remediation and resolved. It cannot delete, approve an answer, accept a finding, or touch members, billing or security settings. Every change it makes is in the audit log under the member’s name, with the app it came through.
Still stuck? Ask a person.
Help with Trusterio
Something not working or not clear, a question before you start, or billing. Say which business and which screen; we answer on Dutch working days.
hello@trusterio.comA security weakness
Found a vulnerability? Write to security@trusterio.com.
security@trusterio.com