The Trust Center Checklist
A practical 44-item checklist for launching and maintaining a SaaS trust center customers actually trust. Use it to scope your build, audit an existing portal, or send to a colleague before a security review.
Download the PDF
Single-page printable. No email required. Free to share with attribution.
1. Foundations
- Decide which customer questions the trust center should answer (security, privacy, compliance, subprocessors).
- Pick a public URL — trust.yourdomain.com (preferred) or yourdomain.com/trust.
- Confirm a single owner for the page (security, ops, or founder).
- Write a one-paragraph plain-English overview of your security posture.
- Add a security@ contact email and a vulnerability reporting note.
2. Documents to publish (or gate behind NDA)
- SOC 2 Type II report (NDA-gated if applicable).
- ISO 27001 certificate (public) and Statement of Applicability (gated).
- Penetration test summary letter (public) and full report (gated).
- Latest security whitepaper / overview.
- Data Processing Agreement (DPA) template.
- Standard Contractual Clauses (SCCs) where relevant.
- Privacy policy and Terms of Service (public links).
- Business Continuity / Disaster Recovery summary.
- Subprocessor list with last updated date.
3. Required content sections
- Compliance & certifications badges with last audit date.
- Encryption in transit and at rest (algorithms and key management).
- Authentication options (SSO/SAML, MFA, password policy).
- Access control model and least-privilege practices.
- Logging, monitoring, and incident response summary.
- Backup, RPO and RTO commitments.
- Vulnerability management and pen-test cadence.
- Employee security: background checks, training, offboarding.
- Hosting region(s) and data residency options.
4. Access control & gating
- Public tier: marketing-friendly overview, certs, subprocessors.
- Email-gated tier: whitepapers, architecture diagrams.
- NDA-gated tier: SOC 2 report, pen-test report, SOC 2 bridge letter.
- Time-limited access tokens (24–72 hours).
- Watermarking on PDFs with requester email.
- Auto-expire access after document download.
5. Customer experience
- Search bar across documents and FAQs.
- FAQ section covering the top 10 procurement questions.
- Clear CTA: request access / contact security team.
- Mobile-friendly layout — procurement opens links on phones.
- Live status indicator or link to status page.
6. Operations & maintenance
- Quarterly review cadence for every document.
- Subprocessor changes notified to customers in advance.
- Audit log of who accessed which document and when.
- Single source of truth — no scattered Google Drive links.
- Sales playbook: send the trust portal link before the questionnaire.
7. Bonus — to stand out
- Plain-English summaries on top of each long-form doc.
- Compliance roadmap (planned for next 6–12 months).
- Customer logos under an NDA list (with permission).
- Direct booking link to your security lead.
- RSS / changelog of trust center updates.
Why this checklist exists
Most SaaS teams build their trust center reactively — after a procurement team demands a SOC 2 report and a 120-question security questionnaire arrives in their inbox. By that point the deal is already stalled.
A trust center built proactively absorbs many of those questions before they get asked. The customer self-serves, the security review compresses from three weeks to three days, and your team stops answering the same five questions for every deal.
This checklist is the running list we use with the SaaS teams we work with at VendorLens. It covers the foundations, the documents to publish, the access controls to apply, and the customer experience details that separate a portal that closes deals from one that gets ignored.
Build the checklist with VendorLens
VendorLens is the affordable trust center for startups, SMBs and small B2B teams. Launch a professional trust center on your own domain. Start free, with custom domains from $99/month.
Trust center software
How VendorLens implements every item on this checklist.
guide to sharing a SOC 2 report
NDA gating, watermarking, time-limited access for SOC 2 reports.
Security document portal
One portal for every security document customers ask for.
Full launch guide
The long-form companion guide with rationale for every item.
See it in action
Book a 15-minute walkthrough or explore a live trust portal. No sales pitch.
Free to start · Custom domains from $99/mo
Free to share with attribution. © VendorLens Technologies Ltd.