Count the days
Open your pipeline and filter by stage. There is usually a cluster parked between verbal agreement and signature, each carrying some version of the note "waiting on their security review". Count the days each has sat there. Not the days the buyer's reviewer took, the days your own side took: finding who holds the current certificate, asking for the processing agreement, waiting on the penetration test summary from a colleague who is not measured on your quarter.
Those are the cost, and they are sales days, not compliance days. Nothing about your security posture changed while the deal stood still, only the close date. That is why the budget for fixing it belongs with sales. Compliance owns the documents, sales owns the deal, and nobody owns the handover between them, so it is rebuilt by hand in every deal. The smaller you are, the more each parked enterprise deal matters, because one of them can be the quarter.
Why attachments fail three ways
Emailing the documents feels like the end of the problem. It is the start of three new ones.
Version. The certificate is renewed, the penetration test is repeated, the processing agreement changes after a subprocessor is added. The PDF in the buyer's inbox knows none of this. Months later their procurement team is reviewing a document you no longer stand behind, and the renewal opens with a correction.
Expiry. An attachment has no end date. It is forwarded, saved to a shared drive, attached to an internal ticket. Your most detailed description of how your systems work is now somewhere you cannot see.
Evidence. When your compliance lead asks who has received the current penetration test summary, the honest answer is a search through sent folders that will not be complete.
Alone, each is tolerable. Together they mean the document you sent to speed up the deal is the one you cannot update, recall or account for.
Open tier and gated tier
A trust centre is one destination where a prospect requests access and serves themselves. The first decision is what goes behind the gate.
The open tier holds what you would tell anyone who asked: which certifications you hold, your subprocessor list, where data is hosted, how you notify customers of an incident. Publishing these openly is a sales asset rather than a risk. A reviewer who finds the answer without asking does not raise a ticket, and because the page is indexable, a buyer still comparing vendors finds you on that question.
The gated tier holds the certificate itself, the penetration test summary, the processing agreement, architecture detail. It sits behind identity, so every download is tied to a named person and an organisation, and its most sensitive part sits behind a signed non disclosure as well.
Some buyers will not register to see documents. That is what the open tier is for. The reviewer who needs the gated tier is already invested enough to give a name.
Signing inside the flow
The step that usually costs a week is the mutual non disclosure. The reviewer asks for the penetration test summary. Sales knows it should not go out unsigned, so they either chase the signature through legal on both sides or send the file anyway, because chasing would slow the deal further. The second is what actually happens.
In the flow we built for a German compliance software vendor, the non disclosure is signed electronically inside the same request. The reviewer identifies themselves, reads the agreement, signs, and the sensitive tier opens. No separate thread, no legal queue, no judgement call by the salesperson about whether this buyer is probably fine.
The agreement also arrives earlier, because it reaches the reviewer at the moment they want something, which is when they are most willing to sign.
The record, and who it really serves
The access record is the compliance lead's win. Every request is attached to a person, an organisation, a document, a version and a time. Each download uses an expiring link generated per request, so a link shared last quarter no longer works and the reviewer comes back for a fresh one. When a certificate is renewed, the owner replaces one file and every later request gets the current version. Who has the penetration test summary becomes a list, not a search.
The record is itself personal data. In the build we delivered, what is stored about each requester, for how long and for what purpose was defined against GDPR obligations as part of the design, not after it. That is a requirement, not a guarantee, and your data protection officer will ask about it first.
For the IT lead, three requirements of whoever builds this, us included: documents in storage you own, identity from the provider you already run rather than a second account store, and an access record you can export. Then nothing depends on us staying.
Week one for sales
The salesperson stops asking a colleague for a file and sends a link. The reviewer lands on the trust centre, searches for the control on their questionnaire, finds it or requests it. Search matters more than navigation, because enterprise reviewers rarely browse: they arrive with one line to close.
Sales no longer decides what is safe to send, because the tiers decide. Compliance stops answering the same request by hand. The buyer's questionnaire still arrives at no predictable point, and now nothing has to be assembled when it does.
We applied the same move, taking a step out of email and into the tool where the work happens, to quoting for the same client: the quote calculator inside your CRM.
