.jpeg)
Sooner or later, a sales representative will ask you for a "security page." A "Trust Center" is precisely that: a page where a company shows customers how it protects their data.
In this article, we examine ten real-world examples and evaluate them based on one simple question: does the page specify what has been certified, for which systems, and since when?
Most other articles on this topic are written by companies that sell compliance software. We don't sell compliance software or Trust Center tools, so we can share our observations without promoting any specific product.
The Review That Happens Before Procurement
Why Th is Page Exists
Here is what happens at a large company before a contract is signed: a security expert vets the supplier. They want to determine whether it is safe to entrust the company's data to them. If they cannot get an answer quickly, they send a lengthy list of questions, a so-called security questionnaire. Then, someone at the supplier spends days filling it out.
A "Trust Center" is created precisely to answer those questions before anyone even asks them. Every piece of information provided on that page means one less item to address in the questionnaire. That is the entire business logic behind it.
Where you place that link also matters. The best spot is where the question of security first arises for the customer, usually the pricing page. If you want to see how trust shows up across other B2B sites, look at our list of B2B SaaS websites worth studying and our piece on cybersecurity web design.
What Reviewers Actually Check
The assessor does not simply count labels; they look for specific details, above all, certifications with a clearly defined scope. A SOC 2 report represents an independent audit of a company’s security controls, where the "Type 2" designation indicates that the report covers a specific period of time rather than just a single day. A label lacking a specified type and time period tells the assessor almost nothing.
Then come the practical questions. Is there an up-to-date list of sub-processors? These are external companies that handle client data on your behalf. Where is the data stored, and is there a Data Processing Agreement (DPA) in place? When was the last "penetration test" (a test where hired experts attempt to breach the system) conducted? What are the commitments regarding system availability, and what is the track record of that availability? Have previous incidents been disclosed, along with the relevant details?
Finally, there is the question of access. What is available to everyone, and what requires a specific inquiry?
Here is a test: can an evaluator determine what is certified, for which systems, and since when, without sending an email to anyone? If not, then those labels are merely decoration.
Ten Trust Centers Worth Studying
The Comparison Table
Here are ten real-world trust centers, listed in alphabetical order. This is not a ranking. We selected them because each offers a design solution worth learning from.
The table shows the platform each page is built on and whether it specifies the scope of its audit. Trust centers change constantly, so the table also indicates the date each page was checked.
Ten Entries
Some of these examples also appear in the overview of trust centers compiled by Dock.us, and we are happy to cite that list as a starting point.
Atlassian (work management)
Their trust center ranks second on Google search for this specific term. They dedicate specific sections to regional compliance and AI governance, helping the assessor quickly find the right answer.
Carta (equity management)
Carta operates close to the financial sector, so the regulatory scope is more significant than usual. Lesson: if you operate near a regulated industry, clearly state which rules apply to you.
Datadog (system observability)
Datadog serves as a benchmark for information transparency. The platform is built on SafeBase and displays active incidents, including dates and detailed severity information. It is much harder to fake a specific security incident with a date than a simple label or badge. This shows that the company does not hide its issues.
dbt Labs (data transformation)
Their target audience are developers, so their approach to trust resembles technical documentation. This model is worth adopting if your customers are technically savvy and expected to read the content thoroughly rather than just skimming it.
Miro (visual collaboration)
Miro caters to both small teams and massive corporations from a single page. They show how a single trust center can successfully serve both groups.
OpenAI (AI platform)
OpenAI serves as our benchmark for scope. They also use SafeBase. They specify the validity period for their SOC 2 audit (July 2025 - June 2026), list ISO standards by product, and require access credentials only for the SOC 2 report itself, rather than the entire page. An evaluator can see key facts at a glance and request the full report if needed.
Slack (messaging)
Slack shows what trust looks like at the enterprise level. Their approach reflects the style of security pages from the Salesforce era. Also, this is one of the four examples cited in the original plan.
Snyk (developer security)
Snyk is a security company, so their own security posture is part of their sales proposition. It serves as a good reminder that, for some vendors, a trust center also acts as proof of credibility.
Vanta (compliance automation)
Vanta sells compliance software, and their trust center runs on their own platform. They display real-time control status, allowing you to see the product in action at the vendor itself.
Wiz (cloud security)
Wiz serves as our benchmark for storytelling. The page was created internally and describes specific control measures in simple language: FIDO2 multi-factor login, just-in-time access, and immutable infrastructure. The text reads as if it were written by the security team, because it was.
Platform Or Self-Built
The Trade-Off
You have two ways to build a trust center. You can use a platform, or you can build it yourself. A platform (like SafeBase, Vanta, or Drata) buys you automation. That means NDA gating, subscriber updates, and analytics. The cost is design flexibility. A self-built page gives you full control and room to explain things in your own words. The cost is that your team maintains all of it.
Here's some market context. Drata announced on February 11, 2025 that it was acquiring SafeBase for $250 million. SafeBase had more than 1,000 customers. The prices below are reported figures, so confirm them with each vendor. Third-party estimates put SafeBase on its own at roughly $8,000 to $15,000 a year. Vanta and Drata bundle trust centers into their compliance platforms, and Vendr, a third-party source, puts the median contract value around $25,000 a year. Conveyor's Professional plan is reported at $4,800 a year.
Choosing
Wiz chose to build its own, and the writing shows it. OpenAI and Datadog chose SafeBase, and the structure shows it. Both paths are fine.
What fails is something else. A marketing team builds a static page in the website CMS (the tool used to edit the site), then nobody is assigned to keep it current. That's what most companies do. Within a year the page is out of date, and a stale trust center is worse than none, because it signals that no one is watching.
Does It Actually Shorten Deals
The Claims, With Provenance
Nearly every claim about trust centers speeding up deals comes from a company that sells one. That doesn't make the claims false. It means you should know where each one comes from.
SafeBase says trust centers can cut questionnaires by up to 98 percent. One vendor case study reports questionnaires dropping from 18 to 7 a month and review time falling from 12 days to 5. Vanta points to IDC research saying trust centers save weeks. Drata cites $15 billion in transactions. All of these are vendor-published.
Two more points. Conveyor's own materials admit they don't prove that trust center visits cause shorter sales cycles. The data shows the two go together, not that one causes the other. And a popular figure about how many buyers check a vendor's security page comes from Orbiq's own research, and it gets repeated across the category as if it were independent. We haven't used it.
The Honest Conclusion
A trust center plausibly cuts questionnaire volume, because it answers questions before they're asked. There's no independent evidence saying by how much. So build one because the reasoning holds up, not because a vendor handed you a number.
What separates a good one from a weak one is scope and dates. A badge with no date makes a reviewer send the questionnaire anyway. A line like "SOC 2 Type 2, July 2025 to June 2026" lets them move on. Sprinto has a helpful breakdown of public and gated access models, and the pattern that works is both at once: open posture, gated evidence. For more on how enterprise sites handle this kind of detail, see our look at enterprise website design trends.
Building Yours
What To Publish And What To Gate
Put these in the open: certifications with scope and dates, the subprocessor list, data residency, incident history, and a security contact. Put these behind a click-through NDA (a quick agreement a visitor signs online): the SOC 2 report itself, pen test details, and architecture diagrams. Never publish anything that would help an attacker. Your security team decides that line, not marketing.
Don't gate the whole page, though. If a reviewer can't see anything without signing an agreement, they'll skip you or send the questionnaire. Gate the sensitive documents. Leave the summary open.
Finally, link the trust center where the question first comes up. That means the pricing page and enterprise plan pages. See our SaaS pricing page examples for how others handle those pages.
Who Owns It
Marketing builds the page. Security owns what's on it. And one named person keeps it current. Without that person, a trust center turns into the stale PDF hub within a year, with a nice design and old documents.
Go back to the test from the start. Could a reviewer answer their own questions from your page without emailing anyone? If yes, you're done. If you need help building and maintaining a page like this on your site, see our enterprise Webflow delivery.
Closing
Could a reviewer answer their own questions from your page?
That's the whole test. It's not about how pretty the page is, or how many badges it carries. It's whether a security reviewer doing a first pass can see what's certified, for which systems, and as of when, without emailing anyone.
Most of the pages above pass. Most of the pages that don't are static pages that marketing built once and nobody was asked to maintain. We build B2B SaaS websites, and the trust center is usually where that maintenance question gets settled.
Work With Veza / See Our Case Studies
FAQs
What is the purpose of a trust center?
To answer a security reviewer's questions before they are asked. Every certification, subprocessor and incident disclosed on the page is a line not sent in a questionnaire. The commercial argument is that it shortens the review, though the evidence for how much is entirely vendor-published.
What should a trust center include?
Certifications with scope and audit dates rather than badges, a current subprocessor list, data residency, a pen test summary with the last test date, SLAs, uptime history and incident disclosure with dates. Plus a visible last-updated line, because freshness is the first thing a reviewer checks.
Should a trust center be public or gated?
Both. Public posture, gated evidence. Certifications, subprocessors and incident history visible to anyone. The SOC 2 report and pen test details behind a click-through NDA. Gating everything means a reviewer cannot do a first pass without a signed agreement, so they send the questionnaire anyway.
Do trust centers actually shorten sales cycles?
Plausibly, and nobody has proven it independently. SafeBase claims up to 98 percent questionnaire reduction. Conveyor's own materials concede their data does not prove causation. Build one because the mechanism is obvious, not because a vendor gave you a number.
Should we use a platform like SafeBase or build our own?
Platform-built buys automation, NDA gating and continuous-monitoring feeds at roughly 8,000 to 25,000 dollars a year depending on bundle. Self-built buys narrative depth and design control, and you maintain everything yourself. Wiz chose self-built. OpenAI and Datadog chose SafeBase. Both work.
What is the difference between a trust center and a security page?
Mostly vocabulary. A security page is usually a single static page. A trust center implies a maintained hub with document access, often on a platform. The distinction that matters is whether anyone is assigned to keep it current, not what it is called.
Do I need a trust center if I already have a SOC 2 report?
Yes, because the report is the evidence and the trust center is where a reviewer finds out it exists. Stating the type, the audit period and the systems in scope on a public page answers the first three questions a reviewer asks before they request the report itself.
Where should we link to the trust center?
Where the security question first occurs, which is the pricing page and enterprise plan pages, plus the footer. Surfer's data shows pricing page as a recurring term on this SERP, which reflects that placement pattern across the sites that rank.
