Trust center

What you configure

• URL, headline, and intro text. Your trust center lives at /trust/your-url, a lowercase, hyphenated URL 3 to 63 characters long, unique across every organization on the platform.
• What sections are visible. Framework coverage, control pass rate, and a breakdown of controls by theme can each be shown or hidden independently.
• Documents. A link to a document you host elsewhere (your own Google Drive, Dropbox, or a presigned S3 URL), not a file uploaded to this platform. Each document has one of three visibility levels: Public, visible to any visitor; NDA required, unlocked the moment a visitor accepts your NDA text, no approval needed; or Gated, visible only after you approve a named visitor's request.
• NDA text. The click-through text a visitor accepts to unlock your NDA required documents. This is a real, timestamped acceptance record, not a cryptographic signature, and is stated as such wherever it appears. No NDA required document can be unlocked until this text is set.
• Certifications. A self-declared badge for a framework you hold or are working toward, labeled by status. A Certified status requires a real, non-future certified date, since this platform has no way to independently verify a certification claim.
• Sub-processors. A name and purpose for every third party your product shares customer data with.
• Data categories. Which categories of data your product collects (customer PII, employee PII, payment information, health information, usage analytics, or other), each with an optional note.
• A custom domain. Point your own domain (for example trust.yourcompany.com) at your trust center, proven by publishing a DNS TXT record this platform checks with a live lookup before treating the domain as verified.

What a visitor sees and does

A visitor to your published trust center sees your headline, intro text, any enabled coverage sections, your certifications, sub-processors, and data categories, and your public documents. An NDA required document shows your NDA text with an accept form: the visitor gives a name, email, and optional company, and accepting unlocks every NDA required document on the page immediately, with no approval step. A gated document shows a request-access form instead: the visitor gives a name, email, and optional company and reason, which creates a pending request. Approving a request from Settings, Trust center sends the visitor an email with the gated document links. Declining leaves it recorded with no link sent. Only an owner or admin can approve or decline, and a request can only be decided once.

The chat assistant

A published trust center can offer a chat widget. Verazo AI answers a visitor's question from a context block built from exactly what that page already renders for an anonymous visitor: your organization name, headline, intro text, the titles of your public documents, the titles of your gated documents (titles only, never a link or the document's content), your control pass rate if that section is shown, and your framework coverage percentages if that section is shown. A section you have turned off reaches this context as empty, not as a value Verazo AI could still see. The function that assembles this context takes no organization id and makes no database call itself, so it can only ever describe the one organization whose already-computed public fields were passed into it.