Trust center

The trust center is a public, read-only page you can share with prospects and customers to show your compliance posture: active certifications, the standards you follow, program numbers, and policy titles. Visitors need no CompStack account. The page lives at /trust/<token>, where the token is an unguessable link only you hand out. You edit and publish it from Settings.

Before you start

• You need the admin role: the editor lives in Settings > General, and Settings is admin-only.
• No module toggle is needed. The public page works even for signed-out visitors.
• Content is pulled live from other modules, so it helps to have data there first:
  • Active cycles in Certification workflow feed the Certifications table.
  • Standards adopted during onboarding or scoping feed the Compliance programs list.
  • Controls and evidence, completed Audits, and closed CAPAs feed the counters.
  • Policy documents with a published current version feed the policy list.

Set up the trust profile

1. Go to Settings > General and scroll to the Trust center section. The card is titled Public trust page.
2. The profile is created automatically the first time you open it, as an unpublished draft with a fresh link.
3. Fill:
   • Display name: defaults to your organization name if left empty.
   • Tagline: one line about your security and quality posture.
   • Security contact email, for example security@yourcompany.com.
4. Under Sections shown on the public page, toggle what visitors see:
   • Certifications (on by default): a table of your active certification cycles with Standard(s), Certificate no., Certification body, and Valid until.
   • Compliance programs (on by default): chips with the names of standards your organization has adopted.
   • Control stats (on by default): three counters: Controls in place, Audits completed, Corrective actions closed.
   • Policy titles (off by default): titles and codes of policy documents whose current version is published. Opt in deliberately; this reveals your policy list.
5. Click Save trust profile. You should see "Trust profile saved."

Add custom sections

Custom sections are free-text blocks shown at the bottom of the public page, for topics like data residency or subprocessors.

1. In the Custom sections area, click Add section.
2. Fill Section title (for example Data residency) and Body. The body is shown verbatim on the public page.
3. Add more sections as needed. Remove one with the X icon on its row.
4. Click Save trust profile. Sections where both title and body are empty are dropped on save.

Publish and share the page

1. Flip the toggle at the top of the card from Draft to Published. Anyone with the link can now view the page.
2. The share link is shown in the box below the toggle, in the form https://<your app>/trust/<token>.
3. Click Copy to copy it ("Trust page link copied."), or Preview to open it in a new tab.

Flip the toggle back to Draft to unpublish. The link then shows the "This trust page is unavailable" screen instead of your data.

Rotate the link

If the link leaked or you want to cut off everyone who has it:

1. Click Regenerate link.
2. Confirm Regenerate in the dialog. The warning is real: the current link stops working immediately, and anyone you already shared it with needs the new one.

The old URL now shows the same "unavailable" screen as a wrong guess, so it leaks nothing.

What visitors see

The public page shows, top to bottom: a "Trust Center" header with your display name, tagline, and security contact; the Certifications table; Compliance programs chips; "Program at a glance" stat tiles; "Published policies"; your custom sections; and a "Powered by CompStack" footer. Only the sections you toggled on appear. All numbers are computed live at view time, so the page never goes stale.

Try it

• Open Settings > General as an admin and scroll to Trust center. Expected: a Public trust page card with a Draft toggle and a share link.
• Fill a tagline and security contact, then click Save trust profile. Expected: "Trust profile saved."
• With the toggle still on Draft, open the share link in a private browser window. Expected: "This trust page is unavailable".
• Flip the toggle to Published. Expected: a message that anyone with the link can now view the page.
• Open the link in a private window again. Expected: the trust page renders without a login, showing your display name and tagline.
• With an Active cycle in Certification, check the page. Expected: a Certifications table with the certificate number, CB, and valid-until date.
• Toggle Policy titles on, save, and reload the public page. Expected: a "Published policies" section listing policy documents with published versions.
• Add a custom section titled Data residency with a body, save, and reload. Expected: the section appears verbatim near the bottom.
• Click Regenerate link, confirm, then open the old URL. Expected: the old link shows "This trust page is unavailable"; the new link works.
• Flip the toggle back to Draft. Expected: the link goes back to "unavailable".

If something goes wrong

• You cannot find the editor. It is in Settings > General, and Settings requires the admin role. Non-admins who paste a Settings URL are bounced to the dashboard.
• The public page says "This trust page is unavailable". Either the profile is not published, the token in the URL is wrong, or the link was regenerated. Check the toggle and re-copy the current link from Settings.
• The Certifications section says "No active certifications listed." Only cycles with status Active in Certification workflow appear. Suspended, withdrawn, or completed cycles are hidden.
• The policy list is empty or missing. The Policy titles toggle is off by default. Turn it on and save. Only documents of type policy whose current version is published are listed; drafts never show.
• The counters look wrong. They count all controls, audits with status completed, and CAPAs with status closed for your organization, computed at view time. Check the source modules.
• Edits do not show on the public page. Section toggles, text fields, and custom sections only take effect after Save trust profile. The publish toggle and link regeneration apply immediately.