What it's for
Managing the public page you send buyers instead of re-answering the same questions, and handling the requests it generates.
When you use it
Once to enable and grab the link, then whenever a reviewer gets in touch.
What's on the screen
Public page card — live/disabled status, a preview link, an enable/disable toggle, and a copyable share URL.
Inbound requests — name, email, company, message, and timestamp for each reviewer who used the contact form.
How it works
The public page at /trust/your-slug renders live from your data. It deliberately does not show a readiness percentage — a bare grade invites comparison and reads badly at anything under 90%. Instead it leads with what you do well: a strengths section, a list of named controls you've implemented, per-agent coverage, approved policies, your honest SOC 2 baseline, a questionnaire-handling commitment, and the contact form. On Scale it also carries a live Q&A widget.
Highlights are computed, never written — "Adversarially tested: 12 of 15 probes passed, last run 2 days ago" only appears if that's true of your data.
Detailed control statuses, the gap list, and raw evidence stay private — reviewers request them.
Contact submissions are stored here and emailed to you when Resend is configured. Without it, they're logged to the server console only.
Gotchas
- Only approved policies appear. Drafts are invisible to buyers.
- Configure email notifications. The page promises a 48-hour response; nobody watches server logs.
- Disabling makes the URL 404 immediately — including for anyone you already sent it to.