Trust centre content inventory
Tick the documents you already have, check the tier, then give each one a named owner and a review date. The counts at the side update as you go, so you can see what is missing before the next deal stalls. Fill it in with your compliance lead in one sitting.
The four tiers
- Open. Published on a page anyone can read and search engines can index. Use it for anything you would say to a prospect on a first call.
- Identity gated. Released after the requester gives a name, a work email and an organisation. Every download is written to the access record.
- Non disclosure gated. Released only after a mutual non disclosure has been signed electronically in the same flow. The signature is stored with the access record.
- Never send. Kept internal. If a buyer insists, offer a call or a screen share with the owner instead of a file.
How to fill the columns
- Have it is ticked when the document exists today in a version you would hand to a buyer.
- Tier is prefilled with our recommended tier. Move a document up a tier if your legal team asks, never down without asking them.
- Version owner is one named person, not a team. They replace the file when it changes and nobody else does.
- Review date is the date the document must next be checked, usually the certificate expiry, the anniversary of the last test, or the next subprocessor change. Write a date, not a cadence.
Fill it in below. Your result updates as you go.
Inventory
One row per document enterprise buyers ask for in security review. The tier is prefilled with our recommendation. Use the spare rows for anything buyers ask you for that is not listed.
| Document | Have it | Tier | Version owner | Review date | |
|---|---|---|---|---|---|
| Security overview, one page, how you approach security in plain language | |||||
| Certifications and attestations held, with scope and certificate body | |||||
| Subprocessor list | |||||
| Hosting regions and data residency statement | |||||
| Incident notification commitment (what you tell customers and within what time) | |||||
| Vulnerability disclosure policy | |||||
| Service status and availability history | |||||
| Privacy notice and data protection statement | |||||
| Data processing agreement, template | |||||
| Information security management certificate, current copy | |||||
| Completed standard security questionnaire | |||||
| Cyber insurance certificate | |||||
| Encryption and key management summary | |||||
| Access control and authentication summary | |||||
| Backup, retention and deletion summary | |||||
| Business continuity and disaster recovery summary | |||||
| Penetration test summary (scope, method, findings by severity, remediation status) | |||||
| Audit attestation report, full version | |||||
| Architecture and data flow diagrams | |||||
| Risk assessment summary | |||||
| Internal audit findings and remediation log | |||||
| Business continuity plan, full version | |||||
| Penetration test report, full, with exploit detail | |||||
| Vulnerability scan raw output | |||||
| Network diagrams with addresses and hostnames | |||||
| Internal security policies in full | |||||
| Access matrices and staff lists | |||||
| Incident reports that name other customers | |||||
Reading the counts. Every document without an owner is one sales will chase by email on the next enterprise deal. Every document you currently send as an attachment that the table puts at non disclosure gated or never send is a file you cannot recall. An empty review date next to anything with an expiry is a correction waiting to happen at renewal.
Rules that go with the table
Tick each rule once it is agreed and written down, not once it is intended.
A trust centre build at a fixed scope, starting with the documents in this inventory.
The smallest version covers the open tier, identity before access and expiring links, with the price agreed before we start.
Find the right AI starting point.
Align the business case, governance and first implementation—without starting a large programme.