What should an enterprise software startup put on its trust center page?

Illustrative situation: a 30-person startup sells procurement analytics to a freight company. The buyer’s vendor-risk team sends a 240-question spreadsheet and asks for a SOC 2 report. The startup’s SOC 2 Type 2 audit period is half over, so no Type 2 report exists yet. A salesperson has already written “we are SOC 2 compliant” in an email. The deal then sits in security review for three weeks while an engineer answers questions one by one. The scene is invented. It shows the gap this guide covers: the security evidence exists in pieces, and nobody has built the page that hands it over.

Humbleteam, a digital product design agency, publishes this guide. It covers what to publish, what to gate, how to word certifications still in progress and who keeps each item current, with an ownership worksheet and an invented worked example. Vendor and rule behavior is described as of November 2, 2026 and can change. This is not legal or audit advice: your lawyer and your auditor decide what you may claim and share.

What is a trust center, and how do established vendors run one?

Vanta, which hosts trust centers for other companies, defines one as a public or access-controlled page where a company shows its security and compliance posture, partly to cut down manual questionnaire answers.

Two live examples show the pattern. Linear runs its trust center on Vanta. Anyone can read an overview, a list of controls, the subprocessors and a dated feed of updates with a “Subscribe to updates” button. Every document on the resources page carries a lock and a “Request access” button. They include the ISO 27001 certificate, a SOC 2 Type II report dated November 2025, a SOC 2 bridge letter dated October 2026, penetration test summaries, policies, CAIQ Lite responses and an insurance certificate. Atlassian runs a customer trust portal on Conveyor, another platform. When read, it showed 6 documents, 169 FAQs, dated security announcements and “Request Access” on each SOC report.

Large vendors gate reports too. Microsoft’s SOC 2 page says that, in line with AICPA requirements, you need a subscription or a free trial account to download its SOC 1 and SOC 2 reports.

What goes public, what gets gated, and what stays on request?

Our suggestion is three tiers.

Public is anything a buyer needs to decide whether to start a review. That covers the products in scope, hosting regions, the compliance status of each framework in one honest line, the subprocessor list, the data processing agreement, the status page and a security contact. Linear links its DPA from a public update.

Gated means a buyer requests access and usually signs an NDA. This tier holds the SOC 2 report, penetration test summaries, policies and filled-in questionnaires. Vanta’s NDA setup names a SOC 2 report and a filled-out questionnaire as typical gated documents. Admins approve or deny each request, and the visitor accepts the NDA before viewing. The NDA applies only when access has to be requested, so a fully public trust center enforces none. Vanta also offers an NDA bypass for trusted domains.

On request covers what needs a conversation: a custom questionnaire, a healthcare business associate agreement, an architecture call. Linear’s security page routes BAA requests to a sales contact form rather than the trust center.

A SOC 3 report can sit in the public tier. The AICPA describes SOC 3 as covering the same five areas as SOC 2 with less detail, which makes it a general use report that can be freely distributed.

SOC 2 or ISO 27001: what does a product person need to know?

A SOC 2 report is an independent CPA firm’s examination of your controls against the AICPA’s Trust Services Criteria for security, availability, processing integrity, confidentiality and privacy, as Atlassian’s SOC 2 page summarizes. Microsoft describes a Type 2 report as evaluating whether controls were designed appropriately, were in operation on a specified date and were operating effectively over a specified period. It adds that Type 1 examinations do not look back over a period of performance, and that its own Type 2 reports usually arrive a few months after the period ends. So expect a gap between starting the audit and holding a report.

The criteria may change. The AICPA published exposure drafts of proposed 2027 Trust Services Criteria on October 26, 2026, open for comment until January 15, 2027. The same page says the AICPA is looking into anonymous allegations about one compliance vendor that offers SOC services, and asks service organizations to evaluate SOC services thoroughly. Choose the audit firm with care.

ISO/IEC 27001 is a requirements standard for an information security management system. The current edition is from 2022. A certificate comes from a certification body, not from ISO. ISO’s certification page says it does not certify anyone or issue certificates, and it does not permit its logo to be used with certification. Buyers can check accredited certificates in the IAF CertSearch database.

Which framework a buyer wants depends on that buyer’s own policy, and no source read for this guide settles it by market. Ask your first three enterprise prospects which one their policy names before you pay for both.

How do you describe a certification that is still in progress?

Write what exists, with dates, and nothing more. Our suggested wording:

• “SOC 2 Type 1 report dated June 30, 2027, available on request under NDA.”
• “SOC 2 Type 2 audit period running July 1 to December 31, 2027. Report expected after the period closes.”
• “ISO/IEC 27001: not started. Planned for 2028.”

Avoid “SOC 2 compliant” before a report exists, a badge for a framework you have not been audited against, and “ISO certified” in any form. ISO does not certify, so name the standard and the certification body.

Bridge letters, which cover the time between reports, need the same honesty. Microsoft calls its bridge letters self-attestations, not reports based on an auditor’s examination. It issues them quarterly while the current period is still open. Label yours as a letter from your company, so no buyer mistakes it for an auditor’s opinion.

What should the subprocessor list and DPA say?

When your customers are controllers of personal data and you process it for them, GDPR Article 28 applies. Article 28(3) requires a contract, which is what a DPA is, setting out what is processed, why and for how long. Under Article 28(2), a processor may engage subprocessors with the controller’s specific or general written authorization. Under a general authorization, the processor must tell the controller about intended additions or replacements, giving the controller a chance to object. Article 28(4) passes the same data protection obligations down to each subprocessor.

That is why the subprocessor list and its change notices belong in the public tier. Atlassian’s subprocessor page shows an effective date, an email sign-up for new additions, and a row per subprocessor. Each row names the products, purpose, categories of personal data, processing locations and security measures. Linear announces additions as dated posts in its trust center feed. One May 2026 post said Linear was moving the list from its DPA to the trust center and asked readers to subscribe.

Our suggestion: give each subprocessor the same columns, state the notice period your DPA promises at the top of the page, and post every change as a dated entry before it takes effect.

Where do the status page and incident history fit?

Link the status page from the trust center, so availability questions already have an answer. In Atlassian’s Statuspage, teams define components such as the API, the app and the admin tool. They can backfill past incidents when they move from another tool. Viewers subscribe by email, SMS or Slack. In our view, a history of dated incidents with plain explanations tells a reviewer more than an uptime percentage with nothing behind it.

Atlassian’s portal posts dated notes on vulnerabilities, saying whether customers need to act. Publish a reporting route too. RFC 9116 defines a security.txt file under the /.well-known/ path. The file needs a contact field and an expiry date, and the RFC recommends keeping the expiry under a year away so the file never goes stale.

How do pre-filled questionnaires shorten security review?

Shared Assessments says its SIG questionnaire began so that a vendor could complete it once and share it many times. The 2023 SIG Lite has 126 questions for basic due diligence or less critical vendors. SIG Core has 855 questions for vendors handling highly sensitive data. The Cloud Security Alliance’s CAIQ v4.1 is a set of yes or no questions on controls in IaaS, PaaS and SaaS services. It is the document a provider submits for a Level 1 listing in CSA’s STAR Registry, where buyers can search listed organizations.

Fill in one of them before the first big deal. Put it in the gated tier, as Linear does with its CAIQ Lite responses, and turn the questions buyers ask most into public FAQs, as Atlassian’s portal does. The buyer’s own spreadsheet will still arrive, but most answers can then be copied.

Who owns each item, and when does it change?

Every item needs one owner and one event that forces an update. Linear dates each document in its title, and its controls section showed an “Updated 4 minutes ago” stamp when read. In a startup, the owner is often a founder wearing a compliance hat. Write the name down anyway.

Admin features buyers check, such as single sign-on, belong in the overview as availability lines. How the setup screens work is a separate design job, covered in our SSO and SCIM setup guide.

Illustrative worked example: a procurement analytics startup and a freight buyer

Everything here is invented. Tallyrock is a fictional procurement analytics startup. Northmere Freight is a fictional buyer. The people are Priya Lunde, Tallyrock’s co-founder and compliance lead, and Rui Castell, Northmere’s vendor-risk analyst.

Tallyrock holds a SOC 2 Type 1 report dated June 30. Its Type 2 period runs from July 1 to December 31. It has not started ISO 27001. Priya Lunde launches the trust center with public status lines in the wording above, nine subprocessors in Atlassian-style columns, a public DPA with a 30-day notice period, and a link to the status page with four months of history. Gated documents are the Type 1 report, a penetration test summary from May, four policies and a completed SIG Lite.

Rui Castell requests access, accepts the clickwrap NDA and downloads the Type 1 report and the SIG Lite. Northmere’s own questionnaire has 240 questions. Priya Lunde answers 190 of them from the SIG Lite and the FAQs in two days and flags 50 for engineering. Rui Castell asks why there is no Type 2 report. The status line already gives the period dates, so the answer is one sentence. Northmere approves Tallyrock with a condition: deliver the Type 2 report within 90 days of the period end.

In October Tallyrock adds an AI transcription vendor. Priya Lunde posts the change 30 days ahead, and Northmere’s subscribed analyst sees it without asking.

Where do these defaults stop working?

The examples are mature vendors with full compliance teams, and the sources are vendor documentation, standards bodies and one regulation. None of them measures whether a trust center shortens deals. Regulated buyers add their own layers, such as health data agreements, and those are outside this guide. Article 28 applies where the GDPR applies; US state privacy laws may ask for different disclosures. Some buyers refuse vendor NDAs, insist on their own questionnaire or require an on-premise deployment that changes the evidence set. A trust center platform is optional: in our view, a page on your own site with a request form works if someone keeps it current.

What can you produce now?

Five things, before the next questionnaire arrives:

1. A one-line status per framework, with dates, in the honest wording above.
2. The ownership worksheet filled in with real names.
3. A subprocessor list with consistent columns and a stated notice period.
4. One pre-filled standard questionnaire, CAIQ or SIG Lite, kept gated.
5. A public page that links the status history, the DPA and a security contact.

If a pilot is already running, link the trust center from the pilot’s security and admin page described in our proof-of-concept pilot guide. If outside designers will work on these surfaces, our comparison of UX/UI agencies that design complex B2B SaaS platforms shows which studios publish work on screens like these.