📋 GRC compliance for CMMC 2.0, CPCSC, CPA Canada, IIROC…SaaS discovery for data governanceFree enriched web chat widget🚀 Enriched remote support without your laptop

Trust Centre

Publish a public security and privacy page that answers customer due-diligence questions and shares your security documents safely.

Where to find it
Business continuity › Trust Centre
Who can use it
Anyone whose compliance (GRC) role includes viewing can look; changing anything that is shown publicly needs a compliance role that can approve, and removing documents needs delete permission
Plan
Resilience: Plans, BIA Report & Trust Centre add-on
For
Everyone

What the page is for

Customers, prospects and their procurement teams regularly ask how you protect their data. A Trust Centre is a public web page you can link to or embed on your own website that answers those questions up front: which frameworks you hold, which policies you have, which subprocessors you use, where data is processed, your responsible AI statement, and how to contact you.

You choose exactly which sections appear. You can also offer security documents, such as a SOC 2 report, an ISO certificate or a penetration test letter. Each document can be public, available after the visitor verifies their email address and accepts your confidentiality terms (NDA), or available only after you approve the request. Every download is logged.

An optional measured security summary shows percentages Lavawall measures across your environment: multi-factor sign-in, disk encryption, healthy endpoint protection, and a range for outstanding updates. It never shows names, and nothing is shown for fewer than five accounts or devices.

What you see

The Trust Centre page (illustration), with the tabs, public page settings, framework badges, share and embed, documents offered and access rules numbered 1 to 6.
Illustration of the Trust Centre page. Numbers match the list below.
  1. Tabs: Public page, Documents & access, Access requests and Analytics.
  2. Public page settings: Trust Centre is public switch, Headline, Introduction, Public sections, the "Questions?" contact options, Custom sections and Policies listed by title, with Save and publish.
  3. Framework badges: which of your compliance frameworks are shown as held, with Save badges.
  4. Share and embed: the Public link, Copy embed code, Preview and Rotate link, plus Measured security summary (Preview figures) and Subprocessors on the public page.
  5. Documents offered: each document's title, source, access level, downloads and whether it is live, with Add document, Download log, Edit and Remove.
  6. Access rules: confidentiality terms, terms version, automatically approved email domains and Access lasts (days).

How to set up your Trust Centre

  1. Open Trust Centre and select Create the Trust Centre.
  2. On the Public page tab, enter a Headline and Introduction.
  3. Under Public sections, switch on the sections you want: security and compliance frameworks, our policies, subprocessors and key service providers, where data is processed, responsible AI statement, Questions? (contact section), security documents and measured security summary.
  4. Choose how the "Questions?" section works: Contact form (recommended), Show an email address or No contact section. Enter where enquiries and access requests are delivered; this address is never shown publicly.
  5. Tick the published policies to list by title. Only titles and short descriptions are shown, never the content.
  6. Switch on Trust Centre is public and select Save and publish.

How to show framework badges

  1. Under Framework badges, tick the frameworks the company holds.
  2. Choose what happens to frameworks you have not ticked: Do not show them (recommended) or Show them, clearly labelled "In progress".
  3. Select Save badges. In Confirm the attestations, tick the box confirming the company holds a current attestation for each one, and select Publish badges.

How to offer a security document

  1. Open the Documents & access tab and select Add document.
  2. Under Where it comes from, choose Upload a file (PDF, image or Office document) or A published policy (rendered to PDF when downloaded).
  3. Enter the Title shown to visitors and a Short description.
  4. Choose Who may download it: Public, NDA or Approval. Set the Order and tick Offered on the Trust Centre.
  5. Select Save.

How to set access rules

  1. On Documents & access, under Access rules, enter the Confidentiality terms visitors accept.
  2. Change the Terms version whenever the wording changes. Visitors who accepted an older version are asked again before their next download.
  3. Under Approve automatically for these email domains, enter trusted domains, separated by commas.
  4. Set Access lasts (days) (between 1 and 365) and select Save access rules.

How to approve or deny an access request

  1. Open the Access requests tab. Waiting for a decision lists pending requests with who asked, their reason and the terms they accepted.
  2. Select Approve or Deny and confirm. A denied requester is told the request was not approved.
  3. To end access early, find it under Recent decisions and select Revoke. Their sessions end at once.

How to share or embed the page

  1. In Share and embed, select Copy next to the Public link, or Copy embed code to put it on your website.
  2. Select Preview to see the page as visitors do.
  3. Only if a link has leaked, select Rotate link. This creates a new address and breaks every existing embed and shared link.

Tips

  • Subprocessors come from your Vendor Inventory. Only active vendors marked as subprocessors appear, and changes publish at once. Select Manage vendors to change them.
  • Use NDA or Approval for SOC 2 reports and penetration test letters. Keep Public for things like a certificate you are happy for anyone to see.
  • Only show frameworks the company can back up with a current certificate, attestation report or formal assessment.
  • The Analytics tab shows visitors, verified access requests and approvals by week, and the organizations that request access most.
  • Webmail addresses are flagged when you approve, so check who they are first.

Troubleshooting

  • "You can look but not change anything here." Saving publishes the settings, so it needs a compliance role that can approve.
  • "Security documents" is switched off on the Public page tab, so none of these are offered yet. Switch on the Security documents section and save.
  • "No published documents yet." Publish policies in the Document Library first; they then appear under Policies listed by title.
  • "No frameworks are switched on for this company." Choose frameworks on the Compliance Frameworks page.
  • "No vendors are marked as subprocessors yet." Flag them in Vendor Inventory.

Task guides that use this page

Still need help?

Search the support centre, or contact our support team and tell us which page you were on.

Names, companies, devices and figures in the pictures are examples. Other product and company names are trademarks of their respective owners.

We use privacy-friendly, cookieless analytics to count visits, and one cookie to run our live chat. Both load only if you accept. We do not use advertising trackers, and we do not profile you across other websites. The essential cookies that keep the site working are always on. See our privacy policy.