---
title: "Trust centre: what to publish and how to run one"
canonical: https://www.grcmana.io/vault/grc-engineering/trust-centre
published: 2026-10-21
updated: 2026-10-21
author: "Harry West"
framework: "GRC Engineering"
control: "Guide Trust centre: what to publish and how to run one"
journeyStage: intermediate
---

# Trust centre: what to publish and how to run one

## Key takeaways

A trust centre is where a supplier publishes its security, privacy and compliance posture and evidence, so buyers can do due diligence without an email chain. It should publish certificates, policy summaries, subprocessors, data residency and a security contact, and gate reports and pen test summaries behind an NDA. Every item needs a named owner and a refresh trigger.

- **Certificates are not enough** — PRA SS2/21 paragraph 8.9 says firms in material outsourcing should not assume a supplier's certificate or report is sufficient evidence just because it exists, and expects up-to-date, regularly reviewed information.
- **Data locations** — DORA Article 30(2)(b) requires ICT contracts to state where data is processed and stored, and the supplier to notify the financial entity in advance of any planned change.
- **Subprocessor changes** — Under UK GDPR Article 28(2), a processor with general written authorisation must tell the controller about intended additions or replacements of processors, so it can object.
- **Material developments** — FCA SYSC 8.1.8R(6) requires a common platform firm to ensure its service provider discloses any development that may materially affect its ability to carry out the outsourced functions.

The bank's third-party risk team wants your ISO 27001 certificate, a penetration test summary and your subprocessor list before procurement will move. Your head of sales forwards the email to whoever answered the last one, and the deal waits while three people hunt for the latest versions. A trust centre ends that hunt.

This guide is for founders, CTOs, heads of security and heads of sales at UK B2B tech firms that sell into banks, insurers and other regulated buyers, and have just passed ISO 27001 or SOC 2. It covers what to publish, what to gate behind an NDA, who owns each item, how often to refresh it, and what regulated buyers' due diligence actually asks for.

## What is a trust centre?

A trust centre is a public page, often with a gated area, where a supplier publishes its security, privacy and compliance posture and evidence, so customers can do due diligence without an email chain. It holds certifications, policies, reports under NDA, subprocessors, status and a security contact, and works only if every item has an owner and a refresh date.

You will also see it called a trust center, a trust portal or a security trust center. The job is the same: one place a buyer can go to check your claims for themselves.

People often mistake a trust centre for two other things. It is not a marketing page, because every statement on it should point to evidence a buyer can check. And it is not a substitute for the certification itself. An ISO 27001 certificate comes from an accredited certification body after an audit, which our guide to the [ISO 27001 certification process](https://www.grcmana.io/vault/iso-27001/certification-process) walks through. The trust centre only presents that result.

A trust centre with no owner is an archive that looks like a promise.

## What should a trust centre publish, and what should you gate?

A trust centre should publish what any buyer can see without risk to you: certificates, policy summaries, your subprocessor list, data residency and a security contact. It should gate detailed evidence, such as a SOC 2 report or pen test summary, behind an NDA or request. Anything that would help an attacker more than a buyer stays off it entirely.

We recommend this split. Each row has a named owner and a refresh trigger, because a stale item does more harm than a missing one.

| Item | Public or gated | Owner | Refresh cadence |
| --- | --- | --- | --- |
| Certificates (ISO 27001, Cyber Essentials and others) | Public | Head of security or compliance lead | On each certification decision, surveillance audit or renewal |
| Statement of Applicability summary | Gated | Compliance lead | When the SoA changes, and at least once a year |
| SOC 2 report | Gated, under NDA | Compliance lead | On each new report, with a bridge letter in the gap |
| Penetration test summary | Gated, under NDA | Head of security | After each test and retest |
| Key policies (information security, access control, supplier security) | Summary public, full text gated | Policy owner | After each policy review |
| Subprocessor list | Public | Data protection lead | Before each addition or replacement takes effect |
| Data residency | Public | CTO or head of engineering | When a hosting region changes |
| Incident and breach notification approach | Public | Head of security | After each incident review or contract change |
| Business continuity summary | Gated | Operations or resilience lead | After each continuity test |
| Security contact | Public | Head of security | Check quarterly that the address is monitored |

Some things never go on a trust centre, public or gated:

- **Unremediated vulnerability detail,** such as the findings section of a pen test report before the fixes are in.
- **Network diagrams and internal hostnames,** which map your estate for an attacker.
- **Customer names or incident details** that customers have not agreed to share.
- **Claims with no evidence behind them,** such as "bank-grade security" or a framework you are only working towards, shown as if it were held.

The Statement of Applicability is the ISO 27001 document that lists which Annex A controls apply and why. Our guide to [ISO 27001 documents](https://www.grcmana.io/vault/iso-27001/documents) covers what it contains. A one-page summary is usually enough for a buyer; the full SoA can be shared on request.

The SOC 2 report is the item buyers read most closely. Our guide to the [SOC 2 report](https://www.grcmana.io/vault/soc-2/report) explains what a reviewer looks for in it, which tells you what to have ready before you open the gate.

## What do regulated buyers look for in a trust centre?

Regulated buyers look for evidence that answers their own regulator's outsourcing rules. In the UK that means FCA SYSC 8 for FCA-regulated firms and PRA SS2/21 for banks and insurers. EU financial entities apply DORA Articles 28 to 30. Each asks for due diligence on security controls, certified standards, subcontractors, data location and continuity.

The buyer is not being difficult. Their supervisor expects them to be able to show how they checked you.

**FCA SYSC 8.** [SYSC 8.1](https://www.handbook.fca.org.uk/handbook/SYSC/8/1.html) sets the outsourcing rules for common platform firms, and other FCA firms take its core outsourcing rule into account as guidance. SYSC 8.1.8R requires the firm to check that a service provider has the ability and capacity to perform the service reliably, and to review its performance on an ongoing basis. It also requires the provider to disclose any development that may materially affect that ability, to protect confidential information, and to keep a tested disaster recovery plan where the service needs one.

**PRA SS2/21.** The PRA's [supervisory statement on outsourcing and third party risk management](https://www.bankofengland.co.uk/prudential-regulation/publication/2021/march/outsourcing-and-third-party-risk-management-ss) applies to UK banks, building societies, PRA-designated investment firms and Solvency II insurers. For material outsourcing, its due diligence covers the provider's ICT controls and security and its sub-outsourced providers. It asks whether the provider can demonstrate certified adherence to recognised standards and supply certificates and documentation on request (paragraphs 5.19 and 5.20).

For material outsourcing, SS2/21 also warns buyers not to assume that the mere existence of a certificate or report is enough (paragraph 8.9). It expects certificates and reports to contain up-to-date information that is reviewed regularly, and it encourages online, real-time reporting tools where available. This guide reflects the November 2024 version, in force at the time of writing; a revised version takes effect on 18 March 2027.

**DORA.** The [Digital Operational Resilience Act](https://eur-lex.europa.eu/eli/reg/2022/2554/oj) has applied to EU financial entities since 17 January 2025, so it reaches you through any EU bank or insurer you serve. Article 28 requires them to undertake due diligence before contracting and to use only providers that comply with appropriate information security standards. Article 29 makes them weigh subcontracting chains, and Article 30 sets the contract terms.

| What the buyer must check | Where the rule sits | Trust centre item that answers it |
| --- | --- | --- |
| Certified adherence to recognised standards | SS2/21 para 5.20; DORA Art 28(5) | Certificates, SoA summary |
| Up-to-date assurance reports | SS2/21 para 8.9 and Table 8 | SOC 2 report under NDA, with dates |
| Subcontractors and changes to them | SS2/21 paras 5.19 and 9.9; DORA Art 29(2) and 30(2)(a) | Subprocessor list with a change notice |
| Where data is processed and stored | DORA Art 30(2)(b) | Data residency |
| Incident assistance and disclosure | SYSC 8.1.8R(6); DORA Art 30(2)(f) | Incident and breach notification approach |
| Tested continuity plans | SYSC 8.1.8R(11); DORA Art 30(3)(c) | Business continuity summary |

Data residency matters for a specific reason. DORA Article 30(2)(b) requires the contract to name the regions or countries where data is processed and stored, and to oblige you to notify the financial entity in advance if you plan to change them. Your trust centre should show the same locations your contracts do.

Subprocessors carry a second duty. Under [UK GDPR Article 28](https://www.legislation.gov.uk/eur/2016/679/article/28), a processor working under a general written authorisation must tell the controller about intended additions or replacements of other processors, so the controller can object. A dated subprocessor list with a change notice serves both the data protection duty and the outsourcing rules.

The [NCSC's supply chain security guidance](https://www.ncsc.gov.uk/collection/supply-chain-security) sets out 12 principles, in four stages from understanding the risks to continuous improvement, to help an organisation establish control and oversight of its supply chain. If your buyer runs ISO 27001, your trust centre also feeds their supplier controls under [ISO 27001 Annex A 5.19](https://www.grcmana.io/vault/iso-27001/annex-a-5-19-information-security-in-supplier-relationships).

## How do you control access to the gated area?

Control access to the gated area of a trust centre with a short, recorded flow: the buyer requests access, accepts or signs an NDA, a named person approves the request, and the access expires after a set period. Every document should carry its date. Revoke access when a deal closes, stalls or the contact leaves.

We recommend these steps:

1. **Request.** The buyer gives a name, a work email and the company they represent. Reject personal email addresses.
2. **NDA.** Use a click-through NDA for routine documents, and your mutual NDA where one is already signed.
3. **Approval.** A named person in sales or security approves each request. Check the company is a real prospect or customer.
4. **Expiry.** Set access to expire, for example after 30 to 90 days, and re-approve on request.
5. **Record.** Keep a log of who saw which document and when. It answers the question "who has our pen test summary?" in seconds.

Watermark gated documents with the viewer's name and date where your hosting option allows it.

## How do you run a trust centre so it stays accurate?

Run a trust centre as a controlled document set: each item has a named owner, a scheduled review and a list of events that force an update. We recommend a quarterly review of the whole page and immediate updates when a certificate, report, subprocessor or hosting region changes. Answers on it must match your questionnaire answers.

The review cadence is the easy part. The change triggers are where trust centres go stale. We recommend treating each of these as a same-week update:

- **A new or renewed certificate,** or a certificate that lapses.
- **A new SOC 2 report,** or the end of a report period, when a [SOC 2 bridge letter](https://www.grcmana.io/vault/soc-2/bridge-letter) covers the gap.
- **A subprocessor added, replaced or removed,** published before the change takes effect.
- **A hosting region or data location change.**
- **A significant incident,** once the review is complete and customers have been told.
- **A policy rewrite** that changes what a summary says.

Put the trust centre in your ISMS as a controlled document, with the owner and review date recorded the same way as your policies. The internal audit can then check it like any other control.

Keep one source of truth for answers. If your trust centre says data stays in the UK and a questionnaire answer says EU, the buyer will trust neither.

Your trust centre should never say more than your last audit did.

## Where should you host a trust centre?

You can host a trust centre as a static page on your own domain, as a section of your existing website, or on a dedicated trust-centre platform. A static page or website section is cheap and fully under your control. A dedicated platform adds the gated area, NDA workflow and access logs, at a subscription cost.

| Option | Suits | Gated area | Main trade-off |
| --- | --- | --- | --- |
| Static page on a subdomain | Firms with one or two certificates and few requests | Manual: email the documents after an NDA | Cheap and simple, but access control and logs live in email |
| Section of your website | Firms that want the trust centre inside the main site | Needs a form, an NDA step and file sharing | Uses your existing CMS, but someone must build and maintain the gate |
| Dedicated trust-centre platform | Firms with frequent requests and several frameworks | Built in, with NDA, approval and expiry | Saves effort on the gated flow, but adds a subscription and a supplier to assess |

Whichever you choose, host it on a subdomain you control, such as trust.yourdomain, so the address survives a change of tool. The hosting option matters less than the ownership model behind it.

## How does this model apply to GRCMANA's trust centre?

GRCMANA runs its own trust centre at [trust.grcmana.io](https://trust.grcmana.io/) and holds ISO 9001, ISO 27001, ISO 42001 and Cyber Essentials certification. Applied to that certificate set, the table above gives four certificate rows, each with its own owner and refresh trigger, and each answering a different buyer question:

- **ISO 27001** answers the question SS2/21 and DORA both ask: does the supplier hold a recognised information security standard?
- **Cyber Essentials** answers whether the baseline technical controls of the UK government-backed scheme are in place.
- **ISO 42001** answers the AI management question, for buyers who ask how a supplier governs its use of AI.
- **ISO 9001** answers the quality management question, which matters to buyers who assess delivery as well as security.

[IAF CertSearch](https://www.iafcertsearch.org/) is a database of accredited management system certifications, so a buyer can often check an ISO certificate against a register rather than take a PDF on trust. Cyber Essentials certificates are not checked there: the [NCSC](https://www.ncsc.gov.uk/cyberessentials/overview) points buyers to its delivery partner IASME, whose website lists all current certificates. Link each certificate on your trust centre to the place a buyer can verify it.

## How does a trust centre reduce security questionnaires?

A trust centre reduces security questionnaires by answering the common questions before they are asked and by giving you one link to send instead of a document pack. Buyers still send questionnaires, but many answers become a reference to a published, dated item, and the remaining questions are the ones specific to the deal.

Those deal-specific questions cover how your service will handle this buyer's data and the contract terms their regulator requires, such as the DORA Article 30 provisions above. They still need a person, working from the same evidence the trust centre shows.

## What are the common mistakes with a trust centre?

The common mistakes with a trust centre are stale certificates and reports, over-sharing detail that helps attackers, and claims the evidence does not support. Each one undermines the page's only purpose, which is to let a buyer check your posture for themselves, and a regulated buyer's due diligence will find all three.

- **Stale certificates.** An expired certificate on display tells a buyer nobody is watching. Tie every certificate row to its expiry date.
- **Old reports with no dates.** SS2/21 expects up-to-date information. Show the period each report covers.
- **Over-sharing.** A full pen test report where a dated summary would do, or gated items left in the public area because the gate was never built.
- **Claims the evidence does not support.** "SOC 2 compliant" or "SOC 2 certified" with no report behind it. SOC 2 is an attestation, not a certification, so name the report and the period it covers.
- **A silent subprocessor list.** A list that changes without notice can fall foul of UK GDPR Article 28 and fails the buyer's sub-outsourcing checks.
- **No security contact.** A trust centre with no monitored address gives a buyer nowhere to ask, and a researcher nowhere to report.

## Frequently asked questions

### What is the difference between a trust centre and a security page?

A security page describes your approach in your own words. A trust centre adds the evidence behind it: certificates, dated reports under NDA, a subprocessor list and a named owner for each item. Many firms start with a security page and add the evidence as their certifications arrive.

### When should a small firm set up a trust centre?

We recommend setting one up as soon as you hold your first certification, such as Cyber Essentials or ISO 27001, and buyers start asking for evidence. Before that, a short security page with a contact address is enough. Add rows as each certificate or report arrives.

### Should a trust centre be public or behind a login?

Both, but never a login in front of everything. The public part should load without one, so a buyer's analyst can record its address in their supplier file and come back to check what changed. A login wall on the whole page turns every check into an access request, which is the email chain a trust centre exists to end.

### Does a trust centre replace an NDA?

No. The gated area still needs an NDA, either a click-through for routine documents or your signed mutual NDA. The trust centre makes the NDA step faster and records it, but the legal protection comes from the agreement, not the page.

### Who should own the trust centre?

One named person, usually the head of security or the compliance lead, should own the page as a whole. Individual items can have their own owners, such as the data protection lead for subprocessors, but one person signs off the quarterly review.