Know what you are sharing
- Certificates. Such as an ISO 27001 certificate. Usually safe to share widely; check its scope and expiry first.
- Attestation reports. Such as a SOC 2 report. Detailed descriptions of your controls, normally shared only under a non-disclosure agreement.
- Penetration-test summaries. Share a summary letter rather than the full findings, which describe how to attack you.
Share the current version, every time
The most common mistake is sending an expired report from an old email thread. Keep one current copy, record its period and expiry, and replace it the day the new one arrives. Customers notice dates.
Keep a record of who received what
When a report goes to a customer, record who asked, who approved sharing it, and under what terms. If a report needs to be withdrawn — because it was superseded or a finding changed — you then know exactly who holds a copy.
Common questions
- Do we need a certificate to sell to regulated firms?
- Not always. Many firms accept a well-evidenced self-assessment for smaller engagements and ask for independent assurance as the relationship grows.
- Can we share a report with a customer’s auditor?
- Usually yes, under the same confidentiality terms. Record it like any other disclosure.
RegulaTrust keeps your compliance programme, evidence and approved policies in one place with a tamper-evident audit trail, and lets you show customers the frameworks you assess yourself against through your trust centre. Your certificates and reports sit alongside the controls they evidence.
Get early accessGeneral information, not legal advice. Check the obligations that apply to your firm with a qualified adviser.