What visitors see
Visitors open your trust center at its address, with no account and no sign-in. This page walks through what they see and which part of the admin controls it.
The header
Section titled “The header”- Your logo and company name. Without an uploaded logo, the page shows a default logo: your company’s initials on a coloured tile. Set the logo in Settings.
- A Notify me button, which lets visitors subscribe with their email address. See What visitors can do.
The company name is your trust center title without a closing “Trust Center”, “Trust Centre”, “Trust & Security” or “Trust and Security”. A title of “Acme Trust Center” shows as “Acme”.
The tabs
Section titled “The tabs”Below the header is a row of tabs. Home is always there. Documents, Security and Subprocessors appear only while their section is switched on in the Dashboard.
Home is the overview.
- Your name and introduction. The heading reads “Your name Trust & Security”, followed by your introduction. If you’ve set a review date, “Last reviewed” appears beside the heading.
- Featured Documents. Up to two documents you starred. Locked ones show a padlock. If you haven’t starred any, the card shows how many documents are available.
- Security Controls. Up to two starred controls, and the total number listed.
- Subprocessors. Logos for up to three starred subprocessors, and the total number.
- Compliance. Every framework you’ve added, with its status, its note and its logo where one exists. Frameworks without a logo show a neutral badge.
- Data & Privacy. A card with a Submit a request button. Shown when Privacy Requests is switched on.
- Report a Vulnerability. A card with a Report a vulnerability button. Shown when Vulnerability Disclosure is switched on.
Each of the first three cards has a button, such as View documents, that jumps to its tab. If a section has nothing in it yet, its card says that your company hasn’t listed anything yet.
Stars are the Featured column in the admin tables. See Documents, Security controls and Subprocessors.
Documents
Section titled “Documents”Lists every document that isn’t private, starred ones first and then in your order. Each row shows the title, the description and an “Updated” date, which is the document’s effective date as a month and year. What the visitor can do depends on the document:
| Document access | Button | What it does |
|---|---|---|
| Public file | Download | Downloads the file straight away |
| External link | Visit | Opens the link |
| Gated file | Request access | Opens a request form. See Access requests |
When any document is gated, a Request all button lets a visitor ask for all of them in one request. Private documents are not shown at all.
On Enterprise, a gated document can also have a Use password button beside Request access, which lets anyone with the password download it without a request, and can ask the requester to accept your NDA first. See Access rules.
Security
Section titled “Security”Controls are grouped into categories. Each category has a heading and the question a buyer asks, for example “Who can get to your data?”. Each control shows its name, its description and any detail you added, such as a review cadence. Only categories that contain a control appear.
Controls from the Notice Labs library carry a blue star that links to noticelabs.co’s page about the controls. A note at the bottom says that you state these apply and that Notice Labs hasn’t verified them. Controls you wrote yourself have no star. The tab also carries the Report a vulnerability button when that section is on.
Subprocessors
Section titled “Subprocessors”Lists every subprocessor with its logo, name, purpose and processing region. Rows are ordered by purpose. Regions are abbreviated: “US”, “EU”, “UK” and “CA”, with “Global” and “Australia” written out. A subprocessor with several regions shows them separated by slashes, for example “US / EU”.
The footer
Section titled “The footer”- The copyright line with your company name and the current year.
- Your general support email, from Settings, as “Need help or have a security question? Email …”.
- Your legal name, when you have given one under Legal entity in Settings, followed by your company number and country when you have given them.
- A “Trust center by Notice Labs” link to noticelabs.co. On Enterprise you can turn it off on the Dashboard.
Links that open a form
Section titled “Links that open a form”A link to your trust center can open a form as soon as the page loads. Add one of these to the end of the address:
| Link | Opens |
|---|---|
#report-vulnerability |
The report a vulnerability form |
#privacy-request |
The privacy request form |
#request-access |
The form that requests every gated document at once |
For example, https://trust.yourcompany.com/#report-vulnerability. A link only works while its
section is switched on, and #request-access only while at least one document is gated. Closing
the form takes the link off the address again.
security.txt
Section titled “security.txt”Every trust center serves a security.txt file at /.well-known/security.txt, for researchers
and tools that look for one. It is built from your trust center, and has:
- A Contact line for your report form, using the
#report-vulnerabilitylink, while Vulnerability Disclosure is switched on. - A Contact line with your Security reports address from Settings.
- An Expires date a little under a year ahead, which moves forward each time the file is fetched, and a Canonical line with the file’s own address.
It is available only while your trust center is public.
Your domain and the search engines
Section titled “Your domain and the search engines”Your trust center loads at noticelabs.co/trust-center/… or, once verified, at your own domain.
See Custom domains. Whether search engines are asked to index it is a
switch on the Dashboard.