What a good trust centre shows
- Frameworks you assess yourself against. For example ISO 27001, DORA, GDPR or NIS2 — stated as a self-assessment unless an independent auditor has certified you.
- Policies in force. The title, version and approval date of the policies your management has approved. The text itself can stay private.
- Where data is held. The region your customers’ data lives in, which many buyers must check for their own obligations.
- Subprocessors. The third parties that process personal data on your behalf, with what they do and where.
- A contact for security questions. A named route for the questions a public page cannot answer.
Why firms publish one
Security and compliance reviews are slow because the same questions arrive from every customer, partner and bank, each in its own format. Publishing the common answers once lets the reviewer start from what you have already shown, and spend their questions on what is specific to them.
It also keeps answers consistent. When the page is built from the records you already maintain — your approved policies, your supplier register — it cannot drift from what your team actually does.
What a trust centre must not do
It must not overstate. Listing a framework you assess yourself against is not the same as holding a certificate, and a reviewer who finds the difference will trust everything else on the page less. Say “self-assessment” where that is what it is, and show readiness scores only if you are prepared to defend them.
Common questions
- Is a trust centre public?
- The page itself usually is. Sensitive material such as full audit reports or penetration-test results is shared privately, typically under a non-disclosure agreement.
- Who maintains it?
- Usually the compliance, security or risk team. Sales and account teams use it most, because it shortens the reviews they are waiting on.
In RegulaTrust the trust centre is built from your own records: frameworks you subscribe to, policies whose current version is approved, and suppliers marked as processing personal data. Nothing appears unless you choose it, every change is recorded in your audit trail, and the page states plainly that framework listings are a self-assessment.
Get early accessGeneral information, not legal advice. Check the obligations that apply to your firm with a qualified adviser.