Not live yet. This comes with the Founder plan. Paid plans are not open yet, so nothing is charged. This page describes how it is designed to work.
Every app can have its own public trust page: one link you send when a customer, a buyer or an investor asks whether your app is secure. It shows only what the evidence backs up, in plain language and dated.
What it shows
- Your badge, in its current state, with the date of your last verified scan.
- That your domain is verified.
- The controls that passed, by area, each with how it was checked and roughly when.
- The published frameworks the passing controls cite.
- Your published policies and your subprocessors.
- A button to request your security questionnaire answers.
- A disclaimer that it is not an audit and does not assess your organisation. You cannot remove it.
What it never shows
Failures, open findings, percentages, commit hashes or a verdict. Those belong in your dashboard, and in a detailed link you choose to share with one buyer. A trust page never publishes anything you typed in by hand: every control on it is tied to dated evidence.
What it never claims
A trust page never says your app is compliant with or certified against anything, and never says you passed SOC 2 or ISO 27001. Those cover your organisation, not your app.
It keeps itself current
The page updates as the evidence does, including when something breaks: the badge moves to Last verified and the passing controls change. It is never taken down for age, a lost connection, billing or a downgrade.
When it comes down
- You delete your account or the app.
- Ownership proof has been lost for more than 14 days.
- Abuse, such as faked ownership or scanning an app you have no right to test.
In each case the page and the badge link return not found, with no public reason given.
Later
A trust page on your own domain arrives with the Team plan. White-label trust pages are part of Enterprise. An optional company-level page can sit above the pages for each app.