What visitors can do

A visitor can read your trust center and download public documents without giving any details. Everything else is a form. Each form asks the visitor to complete a short human check before it sends, and each one tells the visitor that submitting means agreeing to your privacy policy, using the address you set in Settings.

Notice Labs sends the visitor’s confirmation emails in your company’s name, as “Your company via Notice Labs”. Replies go to the matching address in your settings. See Emails for every message.

Request access to a document

Shown on gated documents, and as Request all when there are several.

The visitor enters: email, full name, company. The form lists the documents being requested.

Then:

1. The request is saved and appears under Documents, then Requests, in your admin.
2. The visitor gets an email that the request was received.
3. Your document requests address gets an alert with the requester’s details and a link to the requests page. Replying to it reaches the requester.
4. You approve or deny in the admin. The visitor is emailed your decision, with download links if you approved. See Access requests.

A visitor can’t get a gated file without an approved request.

On Enterprise, Access rules change this flow:

• An NDA. When a document requires your NDA, the form shows its text and the visitor must accept it before they can send the request. Notice Labs records the acceptance.
• Automatic approval. A request from a pre-approved email domain, or from a domain you have approved before, is approved at once. The visitor gets the approval email with their download links, rather than the “received” email, and you are alerted that it was approved automatically.
• Blocked domains. A request from a blocked domain is refused with a message, and nothing is saved.
• A password. A gated document can have a Use password button. A visitor with the password enters it and the download starts, with no request.

Report a vulnerability

Shown on the Home tab and the Security tab when Vulnerability Disclosure is on. The dialog tells the visitor the report goes to a private intake and isn’t published anywhere.

The visitor enters: a summary, details, the affected asset or URL, a suggested severity (Not sure, Low, Medium, High or Critical), steps to reproduce, their name and their email. Every field is required.

Then:

1. The report is saved under Security, then Reports, in your admin.
2. The visitor gets an email that their report was received. It doesn’t repeat what they wrote.
3. Your security reports address gets an alert with the report and the reporter’s email. Replying to it reaches the reporter.

See Vulnerability reports.

Submit a privacy request

Shown on the Home tab when Privacy Requests is on.

The visitor enters: full name, email, a request type and details. The types are Access my data, Delete my data, Correct my data, Export my data and Something else.

Then:

1. The request is saved under Privacy, then Requests, in your admin.
2. The visitor gets an email confirming it was received, with the request type and when it was submitted.
3. Your privacy requests address gets an alert with the details. Replying to it reaches the requester.

See Privacy requests.

Notify me

The Notify me button in the header opens a dialog titled “Subscribe to updates”.

The visitor enters: an email address.

Then:

1. The visitor sees “Check your email”. The form says the same whether or not the address was already subscribed, so it never reveals who is.
2. They are emailed “Confirm your subscription to Your company’s trust center”, with a Confirm subscription button. Nothing is subscribed until they use it. The link works for 7 days.
3. The link opens a page with a Confirm subscription button. Choosing it subscribes them.
4. The address appears in your admin under Subscribers, first as Pending and then as Confirmed.

After that they get one email a day when something changed on your trust center, and only about the kinds of change you have switched on. Each email has a link to unsubscribe. See Subscribers.

Replies to these emails reach your subscriber replies address.

Search engines

Search engines can index your trust center unless you switch indexing off on the Dashboard. With indexing off, every response for your trust center, including its documents and logo, asks search engines not to index it. Anyone with the link can still open the page.

On a custom domain, your trust center also serves /robots.txt and, while indexing is on, a /sitemap.xml listing the page, so search engines can find it without a link from elsewhere.

If a section is switched off

Switching off Documents, Security or Subprocessors hides its tab. Switching off Vulnerability Disclosure or Privacy Requests hides its card and button, and the form stops accepting submissions. Requesting access to documents stops when Documents is off.