Trust Center
Stop answering the same nine questions
What goes on it
Everything a reviewer asks for, already there
Subprocessors, data categories and standards come from the records inside Trusterio rather than from a copy somebody pasted in. New items go live only when you publish them; a published control or standard keeps its own name and description in step with the record.
- Standards
- The standards you choose to show, ISO 27001, SOC 2 and the rest, each with its badge and what it covers. Certificates stay yours to share on request.
- Policies
- The PDF of an approved policy version, shared publicly or on request.
- Subprocessors
- Who they are, what they process, where they are, and the transfer mechanism.
- What you hold
- The categories of personal data you process and — just as usefully — the ones you do not.
- Documents
- Public ones to download, sensitive ones behind a request.
- A changelog
- Derived from what was published, including what was taken down.
Gated documents
The pentest report, without the email thread
Some documents should not sit on a public page. Those sit behind a request: a named person at a named company asks, you approve or decline, and a PDF they get carries their email address.
- One click to approveWith an expiry, so access is not permanent by accident.
- Watermarked per recipientTheir email address, the date and the document’s title on every page of each PDF they download. Other files are delivered as they are.
- Every download recordedYou can see who downloaded what, and when — which is the question your auditor asks.
- Scanned before it movesEvery upload goes through a virus scan before it is servable.
What is enforced
A Trust Center is only worth the checks behind it
Anybody can put a page of reassuring claims on the internet. These are the rules that make this one mean something, and all of them run inside the database rather than in a screen that could be bypassed.
Nothing appears without a publication
Nothing new is public until somebody publishes it, and every publication is a record with a version, and an author whenever a person made it.
A contradicted claim is refused
Publish “all data stays in the EU” while a connected account has resources running outside it, and the publish fails. Not a warning — a refusal.
What it said in March is still answerable
Publications are versioned, so a question about what the page claimed last quarter has an answer.
One price. The whole thing.
€500 a month for one business, billed yearly, excluding VAT. Tell us about your company, and we set your account up with you, personally. Your data is stored in the EU.