Start for free Start for free

Trust Center

A trust center is a vendor's page or portal for security, privacy and compliance information, such as SOC 2 reports, certificates, subprocessor lists and security policies. Some documents are public, and others need sign-up or an NDA.

What is a trust center?

A trust center is a page or portal where a vendor collects its security, privacy and compliance information in one place. Some vendors call it a trust portal or security portal.

You will often find audit reports such as a SOC 2 report, certificates such as ISO 27001, a subprocessor list, security policies, uptime history and answers to common security questions. Atlassian's Trust Center, for example, has sections on resilience, security, compliance and AI, plus a separate Trust Portal with detailed documents for vendor risk reviews.

Some items are public. Others sit behind a sign-up or a nondisclosure agreement (NDA), a contract that says you will keep the document private. To download Atlassian's SOC reports, you enter your email and agree to be bound by an NDA (Atlassian SOC 2 page). HubSpot publishes a SOC 3 report openly and offers its SOC 2 Type 2 report as a confidential document through its Trust Center (HubSpot security page).

What it looks like in a vendor's terms

A trust center is a website, not a clause. But your contract may point to it. A typical clause reads like this:

Vendor maintains the security measures described at its Trust Center, as updated from time to time. Vendor will not materially decrease the overall security of the Services during the Subscription Term.
  • "Described at its Trust Center": part of the security promise lives on a web page. This is incorporation by reference.
  • "As updated from time to time": the vendor can edit the page, and the new version is what counts.
  • "Will not materially decrease": a floor. The vendor can change details but should not make overall security worse.

Atlassian's customer agreement warrants that it "will not materially decrease the functionality or overall security" of its products during your subscription term (section 11.1).

A real change we caught

Venpo flagged a case in which Insightly's new AI connector is not covered by its SOC 2 report. A report in a trust center describes a set scope at a set time. New features may fall outside it, even when the badge on the page stays the same.

Why it matters to you

  • Your own security reviews. When your customers send you a security questionnaire, you often answer it using your vendors' trust center documents. If those documents change, your answers can go out of date.
  • Changes you do not see. A trust center page is not always part of your contract. If it is not, the vendor may not owe you any notice before it edits the page.
  • Evidence for audits. Auditors and enterprise buyers may ask what a vendor promised when you signed. A copy you saved at that time is much stronger than today's version of the page.
  • Coverage gaps. A SOC 2 badge does not tell you which products the report covers. Atlassian's SOC 2 page lists the products in scope (Atlassian), and that list is the part to read.

What to check

  • Download the current SOC 2 report, any bridge letter, ISO certificates and the subprocessor list. Save them with the date.
  • Check that the products you use are in the report's scope, and note the audit period.
  • Find out whether your contract refers to any trust center page. If it does, that page is part of what you agreed to.
  • Look for a way to subscribe to updates, such as subprocessor change emails, and sign up.
  • Check whether the vendor publishes a vulnerability disclosure policy and a security contact.
  • Re-download key documents at least once a year, or when a report expires.

Vulnerability Disclosure Policy

Read the full page on Vulnerability Disclosure Policy

A vulnerability disclosure policy (VDP) tells outside security researchers how to report a security hole they find in a vendor's product. It says what systems are in scope, which tests are not allowed, how to send a report and what the researcher can expect back.

A good VDP also promises not to pursue legal action against researchers who act in good faith. The US Cybersecurity and Infrastructure Security Agency (CISA) publishes a VDP template for federal agencies with these parts, including a commitment to acknowledge reports within 3 business days. There is also an international standard on the topic, ISO/IEC 29147.

A vendor may also publish a small file called security.txt at a fixed web address (/.well-known/security.txt) that lists a security contact. It is described in RFC 9116, published in April 2022.

For you as a customer, a VDP is a signal of maturity. It shows the vendor expects to receive bug reports and has a process to handle them. If a vendor removes its VDP or security contact, ask why.

How Venpo helps

Trust center pages and the documents around them can change without an email to you. Venpo monitors vendors' public legal and trust pages, including subprocessor lists and security pages, and emails you a plain-English alert when something changes. Each vendor gets a change history, so you can show what a page said and when.

Start for free

Frequently asked questions

Is a trust center legally binding?

Not by itself. A trust center page only binds the vendor if your contract refers to it or the promise also appears in a signed document like the DPA.

Why do I have to sign an NDA to get a SOC 2 report?

SOC 2 reports describe a vendor's internal controls in detail. Vendors often share them only with customers and prospects who agree to keep them private.

How often should I download documents from a vendor's trust center?

At least once a year, and again when a SOC 2 report period ends or you start a new security review. Keep the old copies too.

Related terms

Security and Compliance SOC 2 Report A SOC 2 report is the document a CPA firm issues after examining a vendor's controls. It holds the auditor's opinion, management's statement, a description of the system and, in a Type 2 report, the tests the auditor ran and what they found. Vendor Documents Subprocessor List A subprocessor list is a public page where a vendor names the other companies that handle your data for it, with what each one does, where it is, and what data it touches. It changes whenever the vendor adds or drops a provider. Vendor Documents Security Addendum A security addendum is the part of a contract that lists the security controls a vendor promises to keep, such as encryption, access control and incident response. Unlike a security marketing page, it is a binding promise. Security and Compliance Security Questionnaire A security questionnaire is a list of questions a buyer sends a vendor about how it protects systems and data: access, encryption, testing, incidents and subprocessors. The answers describe the vendor on the day they were written. Vendor Management Vendor Risk Assessment A vendor risk assessment is a check of how much risk a vendor brings, based on the data it gets, how much you depend on it and what its documents promise. You do it before you sign and again when something important changes. Security and Compliance Bridge Letter A bridge letter is a short letter from a vendor's management covering the gap between the end of its last SOC report period and today. It says no material control changes are known, but no auditor has checked it.

Sources

Last reviewed