Trust Prep
Sign in

Security review guides

Answer the question this review is asking.

Each guide is one situation. Read that one, then come back if the next question is different.

Create your trust page

Where you are in the review

  1. Answer a vendor security questionnaire without SOC 2The form is open, and you do not have a SOC 2 report.
  2. Answer the penetration-test row with no independent testThe form asks about a penetration test, and you have not had an independent one.
  3. Answer how soon you tell the customer about an incidentThe form asks how fast the customer hears when something goes wrong.
  4. Answer whether customer data is encryptedThe form asks if data is encrypted at rest, in transit, or who manages the keys.
  5. Answer what data each vendor can seeThe form asks which customer data reaches each vendor, and which does not.
  6. Answer whether you support single sign-onThe form asks if customers can sign in with their company login, which providers, and on which plan.
  7. Answer whether you keep an audit log of who did whatThe form asks what you log, whether the customer can read or export it, and whether an entry can be changed later.
  8. Answer whether one customer can see another's dataThe form asks how one customer's data stays out of another's, including an agent and a shared store.
  9. Answer whether customer data trains a modelThe form asks if customer data is used to train, fine-tune, or evaluate a model.
  10. Answer how a customer gets their data out when they leaveThe form asks for an export when the customer leaves, how soon the rest is deleted, and whether you confirm that deletion.
  11. Answer what an agent is allowed to doThe form asks what the agent can do, which actions a person confirms, and what it can still reach if the model is tricked.
  12. Answer how someone reports a vulnerabilityThe form asks where a report goes, whether you run a bounty, and how soon you acknowledge one.
  13. Answer who can still open customer dataThe form asks who can reach production, how often access is reviewed, what happens when someone leaves, and whether MFA is on.
  14. Answer whether you have restored a backupThe form asks how backups work, whether you have ever restored one, and what recovery time to write.
  15. Answer the usual security-review asksThey want the vendor list, the agreements, and how you report a change.
  16. Tell customers you added or replaced a vendorA company is joining or leaving the list, and customers need a notice.
  17. Why security reviewers ask for a vendor listYou are deciding which companies belong on the list.
  18. Tell controller, processor, and subprocessor apartThe form asks which role you hold, and which vendors belong on the list.
  19. Put an AI provider on the vendor listA model company sees customer data, and you need to say whether it belongs.
  20. Copy a subprocessor list templateYou need a table now, with the columns a reviewer expects.
  21. Write the processing location when a vendor names no countryTheir page says global, lists several regions, or does not name a place.
  22. How long you keep customer dataThe form asks how long you keep customer data, or a vendor only says as long as needed.
  23. Line up company names on the vendor listThe agreement, the privacy policy, and the list use different names for the same company.
  24. When a vendor keeps the agreement on a higher planThey will only share the data processing agreement if you upgrade.
  25. A VendorLens alternative for a living vendor list pageYou want a trust center comparison, and the review is really about the vendor list link.
  26. Trust Prep vs a free trust pageA free trust page might be enough, and you are deciding whether to pay to publish.
  27. Trust Prep vs Notice LabsYou want a trust center before a SOC 2 report, and you are comparing a full page with a vendor list.
  28. Registora alternatives for a hosted subprocessor pageYou need a public page for the subprocessor list, and you are comparing hosted tools.
  29. SafeBase alternatives for a small teamA small team was pointed at SafeBase, and the review may only need the vendor list.
  30. Vanta Trust Center alternatives for a small teamA small team was pointed at a Vanta trust center, and the review may only need the vendor list.
  31. SafeBase vs Vanta: which trust center fitsYou are weighing SafeBase, now part of Drata, against Vanta Trust Center, and want to know how each is bought.

When they are waiting on the vendor list

Create the page, add the companies that handle customer data, and send one link.

Create your trust page