Trust centre: what to publish and how to run one

The bank's third-party risk team wants your ISO 27001 certificate, a penetration test summary and your subprocessor list before procurement will move. Your head of sales forwards the email to whoever answered the last one, and the deal waits while three people hunt for the latest versions. A trust centre ends that hunt.

This guide is for founders, CTOs, heads of security and heads of sales at UK B2B tech firms that sell into banks, insurers and other regulated buyers, and have just passed ISO 27001 or SOC 2. It covers what to publish, what to gate behind an NDA, who owns each item, how often to refresh it, and what regulated buyers' due diligence actually asks for.

What is a trust centre?

A trust centre is a public page, often with a gated area, where a supplier publishes its security, privacy and compliance posture and evidence, so customers can do due diligence without an email chain. It holds certifications, policies, reports under NDA, subprocessors, status and a security contact, and works only if every item has an owner and a refresh date.

You will also see it called a trust center, a trust portal or a security trust center. The job is the same: one place a buyer can go to check your claims for themselves.

People often mistake a trust centre for two other things. It is not a marketing page, because every statement on it should point to evidence a buyer can check. And it is not a substitute for the certification itself. An ISO 27001 certificate comes from an accredited certification body after an audit, which our guide to the ISO 27001 certification process walks through. The trust centre only presents that result.

A trust centre with no owner is an archive that looks like a promise.

What should a trust centre publish, and what should you gate?

A trust centre should publish what any buyer can see without risk to you: certificates, policy summaries, your subprocessor list, data residency and a security contact. It should gate detailed evidence, such as a SOC 2 report or pen test summary, behind an NDA or request. Anything that would help an attacker more than a buyer stays off it entirely.

We recommend this split. Each row has a named owner and a refresh trigger, because a stale item does more harm than a missing one.

Some things never go on a trust centre, public or gated:

• Unremediated vulnerability detail, such as the findings section of a pen test report before the fixes are in.
• Network diagrams and internal hostnames, which map your estate for an attacker.
• Customer names or incident details that customers have not agreed to share.
• Claims with no evidence behind them, such as "bank-grade security" or a framework you are only working towards, shown as if it were held.

The Statement of Applicability is the ISO 27001 document that lists which Annex A controls apply and why. Our guide to ISO 27001 documents covers what it contains. A one-page summary is usually enough for a buyer; the full SoA can be shared on request.

The SOC 2 report is the item buyers read most closely. Our guide to the SOC 2 report explains what a reviewer looks for in it, which tells you what to have ready before you open the gate.

What do regulated buyers look for in a trust centre?

Regulated buyers look for evidence that answers their own regulator's outsourcing rules. In the UK that means FCA SYSC 8 for FCA-regulated firms and PRA SS2/21 for banks and insurers. EU financial entities apply DORA Articles 28 to 30. Each asks for due diligence on security controls, certified standards, subcontractors, data location and continuity.

The buyer is not being difficult. Their supervisor expects them to be able to show how they checked you.

FCA SYSC 8. SYSC 8.1 sets the outsourcing rules for common platform firms, and other FCA firms take its core outsourcing rule into account as guidance. SYSC 8.1.8R requires the firm to check that a service provider has the ability and capacity to perform the service reliably, and to review its performance on an ongoing basis. It also requires the provider to disclose any development that may materially affect that ability, to protect confidential information, and to keep a tested disaster recovery plan where the service needs one.

PRA SS2/21. The PRA's supervisory statement on outsourcing and third party risk management applies to UK banks, building societies, PRA-designated investment firms and Solvency II insurers. For material outsourcing, its due diligence covers the provider's ICT controls and security and its sub-outsourced providers. It asks whether the provider can demonstrate certified adherence to recognised standards and supply certificates and documentation on request (paragraphs 5.19 and 5.20).

For material outsourcing, SS2/21 also warns buyers not to assume that the mere existence of a certificate or report is enough (paragraph 8.9). It expects certificates and reports to contain up-to-date information that is reviewed regularly, and it encourages online, real-time reporting tools where available. This guide reflects the November 2024 version, in force at the time of writing; a revised version takes effect on 18 March 2027.

DORA. The Digital Operational Resilience Act has applied to EU financial entities since 17 January 2025, so it reaches you through any EU bank or insurer you serve. Article 28 requires them to undertake due diligence before contracting and to use only providers that comply with appropriate information security standards. Article 29 makes them weigh subcontracting chains, and Article 30 sets the contract terms.

Data residency matters for a specific reason. DORA Article 30(2)(b) requires the contract to name the regions or countries where data is processed and stored, and to oblige you to notify the financial entity in advance if you plan to change them. Your trust centre should show the same locations your contracts do.

Subprocessors carry a second duty. Under UK GDPR Article 28, a processor working under a general written authorisation must tell the controller about intended additions or replacements of other processors, so the controller can object. A dated subprocessor list with a change notice serves both the data protection duty and the outsourcing rules.

The NCSC's supply chain security guidance sets out 12 principles, in four stages from understanding the risks to continuous improvement, to help an organisation establish control and oversight of its supply chain. If your buyer runs ISO 27001, your trust centre also feeds their supplier controls under ISO 27001 Annex A 5.19.

How do you control access to the gated area?

Control access to the gated area of a trust centre with a short, recorded flow: the buyer requests access, accepts or signs an NDA, a named person approves the request, and the access expires after a set period. Every document should carry its date. Revoke access when a deal closes, stalls or the contact leaves.

We recommend these steps:

1. Request. The buyer gives a name, a work email and the company they represent. Reject personal email addresses.
2. NDA. Use a click-through NDA for routine documents, and your mutual NDA where one is already signed.
3. Approval. A named person in sales or security approves each request. Check the company is a real prospect or customer.
4. Expiry. Set access to expire, for example after 30 to 90 days, and re-approve on request.
5. Record. Keep a log of who saw which document and when. It answers the question "who has our pen test summary?" in seconds.

Watermark gated documents with the viewer's name and date where your hosting option allows it.

How do you run a trust centre so it stays accurate?

Run a trust centre as a controlled document set: each item has a named owner, a scheduled review and a list of events that force an update. We recommend a quarterly review of the whole page and immediate updates when a certificate, report, subprocessor or hosting region changes. Answers on it must match your questionnaire answers.

The review cadence is the easy part. The change triggers are where trust centres go stale. We recommend treating each of these as a same-week update:

• A new or renewed certificate, or a certificate that lapses.
• A new SOC 2 report, or the end of a report period, when a SOC 2 bridge letter covers the gap.
• A subprocessor added, replaced or removed, published before the change takes effect.
• A hosting region or data location change.
• A significant incident, once the review is complete and customers have been told.
• A policy rewrite that changes what a summary says.

Put the trust centre in your ISMS as a controlled document, with the owner and review date recorded the same way as your policies. The internal audit can then check it like any other control.

Keep one source of truth for answers. If your trust centre says data stays in the UK and a questionnaire answer says EU, the buyer will trust neither.

Your trust centre should never say more than your last audit did.

Where should you host a trust centre?

You can host a trust centre as a static page on your own domain, as a section of your existing website, or on a dedicated trust-centre platform. A static page or website section is cheap and fully under your control. A dedicated platform adds the gated area, NDA workflow and access logs, at a subscription cost.

Whichever you choose, host it on a subdomain you control, such as trust.yourdomain, so the address survives a change of tool. The hosting option matters less than the ownership model behind it.

How does this model apply to GRCMANA's trust centre?

GRCMANA runs its own trust centre at trust.grcmana.io and holds ISO 9001, ISO 27001, ISO 42001 and Cyber Essentials certification. Applied to that certificate set, the table above gives four certificate rows, each with its own owner and refresh trigger, and each answering a different buyer question:

• ISO 27001 answers the question SS2/21 and DORA both ask: does the supplier hold a recognised information security standard?
• Cyber Essentials answers whether the baseline technical controls of the UK government-backed scheme are in place.
• ISO 42001 answers the AI management question, for buyers who ask how a supplier governs its use of AI.
• ISO 9001 answers the quality management question, which matters to buyers who assess delivery as well as security.

IAF CertSearch is a database of accredited management system certifications, so a buyer can often check an ISO certificate against a register rather than take a PDF on trust. Cyber Essentials certificates are not checked there: the NCSC points buyers to its delivery partner IASME, whose website lists all current certificates. Link each certificate on your trust centre to the place a buyer can verify it.

How does a trust centre reduce security questionnaires?

A trust centre reduces security questionnaires by answering the common questions before they are asked and by giving you one link to send instead of a document pack. Buyers still send questionnaires, but many answers become a reference to a published, dated item, and the remaining questions are the ones specific to the deal.

Those deal-specific questions cover how your service will handle this buyer's data and the contract terms their regulator requires, such as the DORA Article 30 provisions above. They still need a person, working from the same evidence the trust centre shows.

What are the common mistakes with a trust centre?

The common mistakes with a trust centre are stale certificates and reports, over-sharing detail that helps attackers, and claims the evidence does not support. Each one undermines the page's only purpose, which is to let a buyer check your posture for themselves, and a regulated buyer's due diligence will find all three.

• Stale certificates. An expired certificate on display tells a buyer nobody is watching. Tie every certificate row to its expiry date.
• Old reports with no dates. SS2/21 expects up-to-date information. Show the period each report covers.
• Over-sharing. A full pen test report where a dated summary would do, or gated items left in the public area because the gate was never built.
• Claims the evidence does not support. "SOC 2 compliant" or "SOC 2 certified" with no report behind it. SOC 2 is an attestation, not a certification, so name the report and the period it covers.
• A silent subprocessor list. A list that changes without notice can fall foul of UK GDPR Article 28 and fails the buyer's sub-outsourcing checks.
• No security contact. A trust centre with no monitored address gives a buyer nowhere to ask, and a researcher nowhere to report.

Frequently asked questions