By Mehdi HassanWhat is a trust center page?
A trust center page is a public hub where a company shows its security, privacy and compliance posture: certifications, policies, subprocessors and how to request audit reports. It exists so a prospect's security team can answer most of their review questions without emailing your sales rep for documents.
For B2B companies, and especially security vendors, the trust center is part of the sales process. A clear one shortens security reviews and removes a common stall in deals. A thin one, or one that's obviously out of date, raises questions about everything else you claim. It sits alongside your other trust pages, and it's one of the core sections we cover in cybersecurity website design.
What should a trust center include?
A trust center should include the documents and facts a security reviewer needs, ordered by how often they need them. Certifications and report access come first, then data handling, then policies and contacts.
Section | What goes in it | Priority |
|---|---|---|
Certifications and attestations | SOC 2 type and period, ISO 27001, others such as HIPAA alignment or PCI where real | Above the fold |
Report requests | A button to request the SOC 2 report or pen test summary, usually behind an NDA | Above the fold |
Data handling | Where data is stored, encryption at rest and in transit, retention and deletion | High |
Subprocessors | A current list with purpose and location, plus how customers are notified of changes | High |
Security policies | Access control, incident response, business continuity, summarised publicly | Medium |
Vulnerability disclosure | How to report a vulnerability, scope, safe-harbour language, contact | Medium |
Status and incidents | Link to your status page and how you communicate incidents | Medium |
Contact and updates | Security contact, last-updated date, a way to subscribe to changes | Always visible |
Only list certifications you actually hold, with the exact type. Our guide on how to display SOC 2 and ISO 27001 covers the wording for Type I versus Type II and how to phrase work that's still in progress.
How should a security trust page be laid out?
A security trust page should be laid out for scanning: the reviewer arrives with a checklist and wants to tick items off fast. Lead with the facts they look for most, and push everything else into clear, labelled sections below.
Header with the essentials
Certification badges or labels with their exact names, the report request button and a last-updated date, all visible without scrolling.
A short overview
Two or three sentences on your security approach in plain language. No marketing adjectives.
Sectioned detail
Data handling, infrastructure, access, application security, privacy and compliance, each as a short block with a link to the full policy or document.
Subprocessor list
A table or embedded list that's easy to search and states when it was last changed.
Disclosure and contact
How to report a vulnerability and how to reach your security team, at the bottom of every view.
Should you use a trust center vendor or build a custom page?
Use a trust center vendor if you need gated document sharing, NDA workflows and access tracking, and build a custom page if you want full control over design and content. Many companies combine them: a custom, on-brand public page with the vendor handling gated documents behind it.
Approach | Best for | Trade-off |
|---|---|---|
Trust center platform only | Teams that want speed and automated access requests | Looks like every other company's trust page; limited design control |
Custom page only | Early-stage teams with few documents to share | You build NDA and request workflows yourself, or handle them by email |
Custom page plus platform | Growth-stage B2B and security vendors | Two systems to keep in sync, but the best experience |
Many compliance automation tools include a trust center module that pulls in your control status. That's useful for freshness, since the data updates automatically. The downside is sameness: when every vendor's trust page uses the same template, yours looks generic. A custom public page in your brand, linking into the platform for gated files, gives you both.
Subdomain or subfolder?
Trust centers commonly live at trust.yourcompany.com, especially when a platform hosts them, because the subdomain can point to the vendor. A subfolder such as yourcompany.com/trust keeps everything on your main site and is simpler to design consistently.
Either works. What matters is that it's easy to find from your footer, your security page and your sales emails, and that buyers can tell it's genuinely yours. If you use a subdomain hosted by a vendor, match the branding closely so it doesn't feel like a different company.
How do you keep a trust center current?
Keep a trust center current by assigning an owner, putting a review on the calendar and showing a last-updated date that you actually respect. Freshness is the part trust pages most easily neglect, and reviewers notice: an expired audit period or a subprocessor list that predates a known vendor change undermines everything else.
- Name an owner, usually in security or compliance, with marketing supporting the design.
- Review on a schedule, and after any event that changes the facts: a new audit report, a new subprocessor, a policy update or an incident.
- Show the date per section where possible, not just at the top of the page.
- Keep content in a CMS so the owner can edit it without a developer, or use a platform that syncs automatically.
What can you learn from good trust center examples?
Good trust center examples share a few habits: they're specific, they're dated and they make document access easy. The weaker ones bury certifications under marketing copy or list policies with no way to read them.
- Certifications shown by exact name and scope, not a cluster of badges.
- A single, obvious button to request reports.
- Plain-language summaries with links to full documents.
- Subprocessor lists with a change-notification option.
- A disclosure policy that welcomes researchers rather than threatening them.
AI companies face extra questions about training data and model providers; our guide to the AI trust center page covers those. HR software adds employee-data concerns, covered in HR software trust and compliance pages. For the full set of pages a B2B site needs, see trust pages every B2B website needs, and for live security sites that handle trust well, see our cybersecurity website examples.
