---
title: "Trust Center rebuilt: NDA access, branding, honest claims"
canonical: "https://auditbadger.com/blog/trust-center-rebuilt-nda-access-branding-honest-claims/"
last-updated: "2026-10-06"
---

# Trust Center rebuilt: NDA access, branding, honest claims

By Maciej • Published 2026-10-06 • 7 min read • Categories: Product Updates, Soc2, Compliance Governance

Created with AI assistance. AuditBadger retains editorial control and responsibility.

**TL;DR:** AuditBadger rebuilt its Trust Center. It now supports your logo, brand color, light or dark theme and custom domain; four layouts (single column, sidebar, statement hero, compact tabs) switchable in settings; four levels of control detail per program with framework-correct wording (SOC 2 reads Audited, never certified) and an optional roadmap for programs in progress; twelve security practice cards whose Implemented status only shows when passing evidence or a dated internal review backs it, and that drop to In progress automatically when evidence fails; and NDA-gated documents and uploaded reports that open after a visitor verifies a work email and signs a click-through NDA or an e-signature through SignWell, with watermarked PDFs, an access log and expiring access. A dated status letter replaces the old engagement letter. Existing Trust Centers stay unchanged until you open the settings, it is included in the subscription, and it still carries no visitor analytics and cannot be published by an AI agent.

We rebuilt the AuditBadger Trust Center. It now carries your logo, colors and domain, comes in four layouts, lets buyers read your SOC 2® report or pentest summary after signing an NDA (click-through or e-signature), and shows security practices only as strongly as your evidence backs them. If you already have a Trust Center, nothing changes until you open the settings: the page keeps its current layout and every new option starts switched off.

## Why rebuild something that already worked?

When we [launched Trust Centers in November 2025](/blog/your-compliance-now-public-introducing-trust-centers/), we said buyers ask four questions: are you certified, what is your compliance status, who are your vendors, and can I see your documentation. The first version answered the first three well. The fourth usually ended in an email thread: someone asks for the report, someone sends an NDA, someone attaches a PDF, and a week later nobody remembers who has what.

The same launch post also listed custom branding as a "phase 2" item. That phase is here, along with a few things we did not plan back then, mostly because a trust page is only useful if a buyer believes it.

## Your brand, your domain

Upload a logo, pick a brand color, choose a light, dark or automatic theme, and write your own headline and intro. The page can live on your AuditBadger subdomain or on trust.yourcompany.com. Text in your brand color is darkened or lightened automatically until it is readable, so an adventurous brand palette does not turn your security page into an eye test. Our name stays where it belongs: a small credit in the footer.

![](https://auditbadger.com/assets/trust-center-branding-869c2e71.png)
_Three Trust Centers for the same fictional company in teal, pink and violet, the last one in the dark theme_

The page renders in your account's language (English, Spanish, German, Polish or Dutch), loads no tracking scripts, and sets no cookie for anonymous visitors.

## Four layouts, one switch

Different companies want different things from this page. Some want a calm document. Some want a dashboard procurement can scan in thirty seconds. Some want it to double as a marketing page. So there are four layouts: single column, sidebar, statement hero and compact tabs.

![](https://auditbadger.com/assets/trust-center-four-different-layuots-98d725f0.png)
_The same Trust Center in four layouts: single column, sidebar, statement hero and compact tabs_

The content and the visibility rules are identical in all four. Only the arrangement changes. Pick one in the Branding settings, preview it before saving, and switch again whenever you like.

![](https://auditbadger.com/assets/trust-center-layouts-switcher-d508f89f.png)
_The layout picker in Trust Center settings with four options and a preview button_

## Decide how much control detail to publish

Each compliance program gets its own card and its own level of detail. Hide the numbers behind a short "implementation is underway" note, show a summary, break it down by section, or list every control with its status.

![](https://auditbadger.com/assets/trust-center-different-granularity-levels-a62db12f.png)
_Four levels of control detail for an ISO 27001 program: hidden, summary, by section and the full control list_

Two details we care about more than the visuals:

- **The wording follows the framework.** ISO 27001 and Cyber Essentials end in a certificate, so a finished program reads Certified. SOC 2 is an attestation, so a finished SOC 2 program reads Audited. Frameworks with neither never mention an audit at all. You cannot accidentally tell a buyer you are "SOC 2 certified".
- **Programs in progress can show a roadmap.** Scope, policies, controls, evidence, readiness, and finally the audit or certification, each step derived from what is actually in your account. Target dates show as a quarter and say plainly that they are estimates.

A completed program can also carry its certificate or audit report. Certificates can be public. Reports sit behind the NDA, and the card only offers "Request the report" when a file really exists.

## Security practices that cannot overclaim

This is the part we are most opinionated about. Most trust pages have a row of green ticks: encrypted at rest, MFA everywhere, backups tested. Nothing on the page tells you whether anyone checked.

The new Trust Center has twelve security practice cards: encryption at rest and in transit, MFA, access control, logging, backups, vulnerability management, secure development, endpoint security, vendor management, incident response and security awareness training. You choose what to claim for each: Planned, In progress or Implemented. Your evidence decides what the buyer actually sees.

- Implemented only shows when passing evidence backs it (an automated check from a connected integration, or a record a person verified in AuditBadger), or a dated internal review that expires after twelve months.
- AuditBadger refuses to publish an Implemented card that nothing supports.
- If a check starts failing or the evidence goes stale, the public card drops to In progress on its own, and your administrators get a notification. A review never overrides a failing check.
- The buyer sees the practice, its status, which integrations back it and when it was last checked. Never check names, resource names, failure details or who reviewed what.

Automated checks run monthly, plus on demand, so this is not a live feed and we will not pretend it is. What it is: a page that cannot keep claiming something your own evidence stopped supporting.

## The report, behind an NDA, without the email thread

Any document or uploaded PDF (your SOC 2 report, an ISO certificate, a penetration test summary, up to 25 MB) can be marked NDA-required. Its title and summary stay public. The content opens only after this:

1. The visitor enters a work email. Free-mail domains are turned away by default.
2. A one-time link confirms the address.
3. They sign the NDA: a click-through with their name and organization, or an e-signature through SignWell, optionally countersigned by one of your administrators. You don't need your own SignWell account.
4. Access is granted automatically for twelve months, or waits for your approval. You can extend, revoke or reject at any time.
5. Documents open online or download as a PDF watermarked with the visitor's name, email, company and time. Uploaded reports download exactly as you uploaded them, so an auditor's digital signature survives.

Every view and download lands in an access log. The visitor gets a copy of what they signed and a reminder fourteen days before their access ends. The built-in NDA template is a one-way agreement in five languages. It is an example, not legal advice, so if your lawyer has opinions, paste in your own text.

If you are still deciding what belongs behind the NDA and what can be public, [no SOC 2 yet? What to send when a customer asks](/blog/no-soc-2-yet-what-to-send-when-a-customer-asks/) covers the package we would put together before the report exists.

## A status letter instead of an "engagement letter"

The old Trust Center offered an engagement letter. It is now a dated "Security and compliance status" letter: your logo, your programs, the practices shown as implemented, which documents are public and which are under NDA, your security contact, and a QR code back to the live page. It is built from exactly what the page shows, so it can never say more than the page does, and it states plainly that it is not an audit report, attestation or certification. Procurement teams like having something to file. Now it is something accurate.

## What it still does not do

- No visitor analytics. That is deliberate: the public page carries no tracking at all.
- No AI agent can publish it. Publishing the Trust Center, its security claims and NDA decisions stay web-only acts for your administrators, even if you connect an agent through our MCP server.
- The NDA template is not legal advice, and the roadmap's target dates are estimates.

## How to switch it on

Go to Account settings, then Trust Center. The Branding tab has the logo, color, theme and the layout picker. Security posture is where you claim and publish practices. Files and NDA access cover the gated documents. If you already run a Trust Center, it stays exactly as it was (same layout, no posture cards, no NDA gating) until you change something.

It is part of the subscription, not an add-on. Our own [Trust Center](/trust-center/) runs on it, and the full capability list is on the [Trust Center feature page](/features/trust-center/). For context, our own SOC 2® Type II observation window ran from 27 March to 27 June 2026, on AuditBadger, with no external consultants. A page like this is the thing we wished we could have sent buyers while we waited for the report.


## Frequently asked questions

### What is a Trust Center and do I need one for SOC 2 compliance?

A Trust Center is a public or semi-public webpage that shows your security posture, compliance status, certifications, and audit reports to prospects and customers. While not technically required for SOC 2, a Trust Center accelerates sales cycles by letting buyers verify your compliance without email threads—AuditBadger generates one automatically from your control evidence and lets you share SOC 2 reports behind an NDA.

### How do I share my SOC 2 report with customers without losing control of the document?

AuditBadger's Trust Center lets you put your SOC 2 report behind a click-through or e-signature NDA that buyers sign directly on your branded security page. This eliminates the usual email-and-PDF workflow while giving you visibility into who has accessed the report and keeping the document protected.

### Can I customize my Trust Center with my own branding and domain?

Yes—AuditBadger Trust Centers support custom logos, brand colors, light or dark themes, and can run on your own subdomain like trust.yourcompany.com. The page automatically adjusts text contrast for readability and includes no tracking scripts, keeping your security page fast and privacy-friendly.

### How long does it take to prepare for a SOC 2 audit?

Type I audits typically take 1–3 months total (preparation plus audit). Type II takes 6–15 months because it includes a mandatory 3–12 month observation period. Industry data shows 56% of organizations spend 3–6 months in the preparation phase alone, though companies using compliance automation platforms report cutting preparation time by roughly 40%. Starting from scratch with no documented policies will take longer than building on existing security practices.

### What's the difference between a Trust Center and a security questionnaire response?

A Trust Center is a proactive, always-updated public page that answers the most common buyer security questions before they ask, reducing inbound questionnaires by 40–60%. Security questionnaires are reactive documents you fill out per-customer—AuditBadger helps with both by generating a Trust Center from your evidence and providing an AI-assisted questionnaire response workflow.

### What is a Trust Center and why do buyers ask for one?

A Trust Center is a public page where prospects can verify your security posture, compliance status, and certifications without scheduling a call or signing an NDA upfront. Buyers ask for Trust Centers during procurement because it speeds up vendor risk assessments and shows you take security seriously enough to share evidence transparently.

### Can I put my SOC 2 report on a Trust Center without losing control over who sees it?

Yes. AuditBadger's Trust Center lets you gate your SOC 2 report behind an NDA that buyers sign directly on the page—either as a click-through agreement or e-signature. This keeps the report confidential while removing the back-and-forth email threads and giving you a record of who accessed it and when.

### How much does it cost to set up a branded Trust Center for compliance?

AuditBadger includes a fully branded Trust Center with custom domain, logo, colors, and NDA-gated report sharing as part of the standard $250/month plan with unlimited users. There are no extra fees for custom branding, layouts, or the number of visitors, making it affordable for small teams preparing for SOC 2 or ISO 27001.

### What information should I show on a Trust Center without overclaiming compliance?

Your Trust Center should reflect only what your evidence actually supports: completed certifications or audits, in-progress roadmaps with realistic timelines, security practices backed by controls and documentation, and vendor or pentest summaries when available. AuditBadger prevents overclaiming by letting you show control detail only as strongly as your implementation evidence backs it, so you never accidentally say you're 'SOC 2 certified' when you mean audited.

### Can I customize the design and domain of my compliance Trust Center?

Yes. AuditBadger Trust Centers support custom logos, brand colors, light or dark themes, and can be hosted on your own domain like trust.yourcompany.com. You can also choose from four layouts—single column, sidebar, statement hero, or compact tabs—and switch anytime without losing content or visibility settings.