What it is
A public page at /trust/your-slug that you send to buyers instead of re-answering the same questions.
What's public
- What you do well — computed strengths: adversarial testing with pass counts and recency, approved policy count with the signer, fully covered pillars, live monitoring, SOC 2 where you have it
- Controls you've implemented — named controls (prompt injection defense, PII isolation, human escalation…) verified as implemented across every agent they apply to
- Per-agent coverage bars and "X of Y controls implemented"
- Approved policies, by title (drafts never appear)
- Your compliance baseline, including honest SOC 2 status
- A "how we handle security questionnaires" section with your stated turnaround
- A contact form for reviewers to request the full picture
What it deliberately doesn't show
No readiness percentage. Internally the score is how you steer; publicly it's a grade that invites comparison and reads poorly at anything under 90% — even when the underlying posture is strong. A reviewer wants to know what you've done, not what number a tool assigned you.
Every strength shown is derived from your data and only appears when true. A claim like "12 of 15 probes passed, last run 2 days ago" is checkable, which is the point.
What's not public
Your full control matrix, per-control statuses, gap list with timelines, and raw test results stay private. Reviewers request them through the contact form.
This is deliberate. An early version published the complete gap list; for a four-person team that reads as unfinished rather than transparent. Detail on request lands better — and it starts a conversation with a named human.
SOC 2 honesty
If you told the wizard you don't have SOC 2, the page says so. That's on purpose: silence reads as evasion to a reviewer who is going to ask anyway, and "on our roadmap" is a fine answer. See Does Veriflow replace SOC 2?.
Live Q&A (Scale)
On Scale, the page includes a widget where reviewers ask questions and get instant cited answers from your verified answer bank and control data. Low-confidence questions fall back to the contact form.
Sharing and disabling
Copy the link from Trust center. You can disable the page at any time with the toggle; the URL then 404s.