Security controls

Security, then Controls, in the admin sidebar is where you list the security controls shown on your trust center’s Security tab. Vulnerability reports are on a separate page: Vulnerability reports.

Two kinds of control

• Notice Labs Controls come from the Notice Labs controls library. The wording is Notice Labs’ and each has a blue star. There are 33, each written as a single claim that a buyer can understand, such as “Staff need more than a password to sign in to systems that hold customer data.”
• Your own controls are in your own words. They have no star.

The library’s rules: a control is one claim, described by its outcome and not by a product or an algorithm, and it doesn’t put specific numbers or names in the wording. Anything specific, such as how often you review access, goes in a detail that you add. The library is not a certification. On your public trust center a note says that you state the controls apply and that Notice Labs hasn’t verified them, so add only what is true.

The library

Controls are grouped by the question a buyer asks.

Category	The question	Controls
Access	Who can get to your data?	Multi-factor authentication, Least-privilege access, Access reviews, Secrets management
Data	Is your data protected, kept apart, and removed when you leave?	Data encryption, Customer data isolation, Production data separation, Retention and deletion
Foundations	Is the service built on solid ground, and will it stay up?	Audited cloud hosting, Network protection, Email domain protection, Automated backups, Disaster recovery, Public status page
Detection and response	If something goes wrong, will it be noticed, handled and reported to you?	Audit logging, Security monitoring, Incident response, Breach notification
Product security	Is the product built and changed safely?	Change review, Automated security checks, Vulnerability management, Independent penetration testing, Vulnerability disclosure
People and suppliers	Are the people, devices and vendors that could touch your data vetted?	Background checks, Security training, Device security, Vendor security review, Risk assessment
AI	If AI is used, is it governed, and is your data kept out of training?	No training on customer data, AI use policy, AI provider review, Human oversight of AI, AI evaluation

Your own controls can also go in an Other category, which the library never uses. On your public page a category appears only when it holds at least one control.

Add controls from the library

1. Choose Add controls. A picker opens with the whole library, grouped by category. Use the search box to filter by name or wording. Controls you’ve already added are marked Added and listed first in their category.
2. Choose a control to open its page. It shows the Description, which is the exact wording your trust center will use, and Why, the reason a buyer cares.
3. If the control takes a detail, fill it in. See below.
4. Choose Add control. It’s added to the end of your list.

Notice Labs recommends adding every control that’s true for you. Buyers look for them, and each one answers a question before they have to ask.

A library control can be added once. Choosing one you’ve already added opens it for editing.

Details

Some controls take a detail in place of a specific the wording would otherwise bake in.

• A text detail is shown with the control on your trust center as its label and your value. For example Review cadence on Access reviews, filled in with “Quarterly”. Text details are optional.
• A choice changes the claim itself. Data encryption asks for a Scope: “In transit and at rest” or “In transit”. The claim your visitors read changes to match. The default is “In transit and at rest”.

Change a detail later by choosing the control, then Save changes.

Write your own

At the bottom of the picker choose Write your own for anything the library doesn’t cover. It asks for:

• Name. Required.
• Category. One of the categories above, including Other.
• Description. Optional. One sentence on what’s true, shown under the name.

Your own controls show without the star, and you can edit all of their fields later.

Keep the wording up to date

The library changes by adding a new version of a control. It never edits a version you’ve already added, so your trust center keeps its current wording until you switch.

When a newer version exists, the control shows an Update available badge in the list. Open it to see what changed, in a sentence, and the new wording. Choose Use the new wording to switch. If the new version still takes your detail, your value is kept.

You are told in two places when wording is waiting:

• The Dashboard. A banner at the top of the Dashboard says how many of your controls have new wording, and links to this page.
• Email. Notice Labs writes to your Subscriber replies address (see Settings) with the controls and what changed in each, and a Review updates button. It is sent once for each update.

Either way, your public page keeps its current wording until you choose Use the new wording. Subscribers can be told when a control is reworded. See Subscribers.

Manage the list

• Featured. Star a control to feature it. The Security tab shows featured controls first, and up to two appear on the Home tab.
• Order. Drag a row by its handle to reorder. Visitors see controls in this order within each category, after featured ones.
• Edit. Open the actions menu (three dots) on a row, then Edit. For a library control you can change its detail. The wording is the library’s.
• Delete. The actions menu also has Delete. It removes the control from your trust center after you confirm. You can add it again from the library.

What visitors see

See What visitors see. If the Security switch on the Dashboard is off, the tab is hidden.