# Trust centre content inventory

Tick the documents you already have, check the tier, then give each one a named owner and a review date. The counts at the side update as you go, so you can see what is missing before the next deal stalls. Fill it in with your compliance lead in one sitting.

## The four tiers

- **Open.** Published on a page anyone can read and search engines can index. Use it for anything you would say to a prospect on a first call.
- **Identity gated.** Released after the requester gives a name, a work email and an organisation. Every download is written to the access record.
- **Non disclosure gated.** Released only after a mutual non disclosure has been signed electronically in the same flow. The signature is stored with the access record.
- **Never send.** Kept internal. If a buyer insists, offer a call or a screen share with the owner instead of a file.

## How to fill the columns

- **Have it** is ticked when the document exists today in a version you would hand to a buyer.
- **Tier** is prefilled with our recommended tier. Move a document up a tier if your legal team asks, never down without asking them.
- **Version owner** is one named person, not a team. They replace the file when it changes and nobody else does.
- **Review date** is the date the document must next be checked, usually the certificate expiry, the anniversary of the last test, or the next subprocessor change. Write a date, not a cadence.

## Inventory

One row per document enterprise buyers ask for in security review. The tier is prefilled with our recommendation. Use the spare rows for anything buyers ask you for that is not listed.

| Document | Have it | Tier | Version owner | Review date |
|---|---|---|---|---|
| Security overview, one page, how you approach security in plain language | [ ] | Open |  |  |
| Certifications and attestations held, with scope and certificate body | [ ] | Open |  |  |
| Subprocessor list | [ ] | Open |  |  |
| Hosting regions and data residency statement | [ ] | Open |  |  |
| Incident notification commitment (what you tell customers and within what time) | [ ] | Open |  |  |
| Vulnerability disclosure policy | [ ] | Open |  |  |
| Service status and availability history | [ ] | Open |  |  |
| Privacy notice and data protection statement | [ ] | Open |  |  |
| Data processing agreement, template | [ ] | Identity gated |  |  |
| Information security management certificate, current copy | [ ] | Identity gated |  |  |
| Completed standard security questionnaire | [ ] | Identity gated |  |  |
| Cyber insurance certificate | [ ] | Identity gated |  |  |
| Encryption and key management summary | [ ] | Identity gated |  |  |
| Access control and authentication summary | [ ] | Identity gated |  |  |
| Backup, retention and deletion summary | [ ] | Identity gated |  |  |
| Business continuity and disaster recovery summary | [ ] | Identity gated |  |  |
| Penetration test summary (scope, method, findings by severity, remediation status) | [ ] | Non disclosure gated |  |  |
| Audit attestation report, full version | [ ] | Non disclosure gated |  |  |
| Architecture and data flow diagrams | [ ] | Non disclosure gated |  |  |
| Risk assessment summary | [ ] | Non disclosure gated |  |  |
| Internal audit findings and remediation log | [ ] | Non disclosure gated |  |  |
| Business continuity plan, full version | [ ] | Non disclosure gated |  |  |
| Penetration test report, full, with exploit detail | [ ] | Never send |  |  |
| Vulnerability scan raw output | [ ] | Never send |  |  |
| Network diagrams with addresses and hostnames | [ ] | Never send |  |  |
| Internal security policies in full | [ ] | Never send |  |  |
| Access matrices and staff lists | [ ] | Never send |  |  |
| Incident reports that name other customers | [ ] | Never send |  |  |
|  | [ ] |  |  |  |
|  | [ ] |  |  |  |
|  | [ ] |  |  |  |
|  | [ ] |  |  |  |
|  | [ ] |  |  |  |

**Reading the counts.** Every document without an owner is one sales will chase by email on the next enterprise deal. Every document you currently send as an attachment that the table puts at non disclosure gated or never send is a file you cannot recall. An empty review date next to anything with an expiry is a correction waiting to happen at renewal.

## Rules that go with the table

Tick each rule once it is agreed and written down, not once it is intended.

- [ ] Every gated document is delivered through an expiring link generated per request, never as an attachment.
- [ ] Identity comes before access. No gated document leaves without a name, an organisation and a time in the access record.
- [ ] The non disclosure is signed in the same flow as the request, before the sensitive tier opens.
- [ ] One owner per document. If two people think they own it, nobody does.
- [ ] When a review date passes, the document is pulled from the trust centre until the owner confirms or replaces it.
- [ ] The access record is personal data. Agree with your data protection officer what is stored, for how long and why, before the first request.

Take two lists to your compliance lead: the documents not ticked as in place, and the documents without an owner. Each one is a document sales will chase by email on the next enterprise deal.