Free Trust Page Generator for SaaS
A trust page is a public security page that tells customers how you protect their data: where it is hosted, how it is encrypted, who can access it, what compliance work you have done and which vendors touch it. Enterprise buyers look for one early, and it answers many of the questions that later appear in security questionnaires. Fill in the form, watch the page take shape, and download it as a single HTML file.
The page is built in your browser and nothing is uploaded. Host the downloaded file anywhere, for example at yourcompany.com/security. Review every line before you publish: only publish statements that are true today.
What to put on it
- Your compliance status, worded exactly as it stands today.
- Where you host, in which region, and how data is encrypted and backed up.
- How employees and customers sign in (MFA, SSO).
- Your subprocessors, with what each one does and where it is located.
- A security contact that someone actually monitors.
What not to claim
- "SOC 2 compliant" or "certified". SOC 2 is an examination report from a CPA firm, not a certificate.
- Controls you have not implemented or cannot show evidence for.
- Uptime figures, customer counts or other statistics you cannot back up.
- Response-time promises you are not staffed to keep.
Frequently asked questions
- What is a trust page?
- A trust page (also called a security page) is a public web page where a company states how it protects customer data: hosting, encryption, access controls, compliance status, subprocessors and who to contact about security.
- Do I need a SOC 2 report to publish one?
- No. The generator has a status for every stage, including not started, and it only mentions SOC 2 when you say something about it. Do not describe yourself as SOC 2 compliant or certified before an examination has produced a report.
- Where do I host the file?
- Anywhere that serves static HTML: a route on your own site such as /security, your marketing site's CMS, or a static host. The downloaded file is a single self-contained page with no external scripts or fonts.
- Is anything I enter sent to a server?
- No. The page is generated in your browser. If you previously used the Policyseed generator, its saved answers are read from your browser's local storage to pre-fill a few fields, and they never leave your device.
Policyseed provides governance policy templates and AI tailoring. It is not legal advice and not a compliance guarantee. Management adopts the policies; the CPA firm performs the SOC 2 examination.