What makes a good Trust Center
A Trust Center answers the questions that procurement and security teams ask again and again, before they are asked. Which frameworks do you follow, and is there a certificate or attestation? Who is the contact for security questions? How is data encrypted, where is it hosted, how do you handle incidents? Which subprocessors are involved?
A Trust Center is good when it answers these questions specifically and up to date. General statements about how highly you value security help nobody. Short, verifiable information works better: which areas are covered, which documents exist, when they were last updated.
Being up to date is the most important point. A page with an expired certificate does more harm than no page at all. In Sightadel, the content comes from the system you work in anyway. Frameworks, evidence and subprocessors are maintained there, and updates appear on the page with a date.
Finally, it has to be easy to find. Add the address to your website, your proposals and your email signature. Sales can mention it early in the conversation and not only when the questionnaire arrives.
What to publish and what not to
Everything you approve in the Trust Center is public. That is the purpose of the page and at the same time its most important limit. Check every document before approving it for information that could help attackers: internal system names, IP addresses, network diagrams, names and direct dial numbers of administrators, details of the security products in use.
Well suited are certificates, a summary of your information security policy, an overview of your technical and organisational measures at a general level and the list of subprocessors. Answers to frequently asked questions also fit, for example on hosting, encryption or handling security incidents.
Full audit reports, internal policies in full, penetration test results and emergency plans do not belong on the public page. You provide these documents to individual customers on request, if in doubt only after a non-disclosure agreement.
View the page while signed out before publishing and after every change. Only then do you see what a visitor really sees. Each document is approved individually. What should stay internal stays internal.
How the Trust Center shortens questionnaires
Customer security questionnaires are often long, and most questions repeat from one customer to the next. Hosting location, encryption, access control, backups, incident handling, staff training, subprocessors: the answers hardly change.
The Trust Center catches these standard questions. Many customers accept a link as an answer or as an attachment to the questionnaire. You then only answer what is genuinely individual, such as contractual specifics or questions about connecting to the customer's systems.
For this to work, the information in the Trust Center and the answers in questionnaires must match. Maintain standard answers in one place. If something changes, for example because of a new subprocessor, update the Trust Center first.
For sales, this means the link belongs early in the conversation. A prospect who can already see during the selection phase which frameworks you follow and what evidence exists asks fewer follow-up questions in procurement. That saves both sides time.
Useful even without a certificate
A Trust Center does not require a certificate. There is no certification requirement for NIS2, and a certificate is unusual for the GDPR as well. Customers still ask how you implement the requirements. The Trust Center shows which frameworks you actively maintain and which measures are in place.
It is also useful on the way to certification. You show that you work in line with ISO 27001 and are planning an audit, without claiming a certificate you do not yet have. Pay attention to precise wording. Only speak of certification once an accredited body has issued the certificate. Before that, wording such as “information security management based on ISO 27001” fits.
Sightadel itself does not certify. The audit is carried out by an external, independent body, from the partner network in the app or one you choose yourself. Once you have the certificate, upload it to the evidence archive, approve it in the Trust Center and publish a dated update. Customers can then see at a glance since when it has been valid.
