Trust Center Checklist for US SaaS and Start-ups

• Done for you, end to end

  We write the policies, set up the controls and evidence, run the internal audit and coordinate the independent audit. You deal with one team from first call to final report.

• Simple and quick

  A free gap assessment, then one plan with dates from day one. Effivity, our GRC automation platform, is included to keep the evidence moving.

• 8,100+ client engagements

  In 60+ countries over 20+ years, with experts who bring 30+ years of experience.

• Under US$10,000, all-inclusive

  For most start-ups and SMEs: SOC 2, ISO 27001, ISO 42001, HIPAA or ISO 9001, including the independent audit. A fixed quote follows a free gap assessment.

Sterling prepares the substance your trust center reports: the free gap assessment, policies written to your practice, evidence collection, an internal audit and coordination of the independent SOC 2 examination or ISO/IEC 27001 certification audit. You deal with Sterling end to end, the people who consult never audit you, and our experts bring 30+ years of experience.

Every Sterling consulting engagement comes with the following, so you are not buying extras to get to the finish line:

• Effivity, Sterling's GRC automation platform, with a full-year subscription, to run your controls, evidence, tasks and audits in one place.
• Sterling Academy: preferential course access, with complimentary awareness training for your people.
• Internal auditor training for your audit team, as applicable to your standard.
• For information-security engagements, a vulnerability assessment.

These are part of the engagement, not a separate purchase. The details depend on the standard you are working toward, which we confirm during the free gap assessment.

Consulting and auditing are always separated: the people who consult never audit you. That keeps your internal audit objective and protects the independence of the CPA firm, Qualified Security Assessor or certification body that performs the final step.

Behind this are 8,100+ client engagements in 60+ countries over 20+ years, led by experts with 30+ years of experience.

What the fee covers, and what it doesn't:

• It is the fee for your first SOC 2 report or your first certification only.
• Annual work is always additional and billed the following year: later SOC 2 report periods, and ISO surveillance and recertification audits.
• It assumes a typical start-up or SME scope: one product or service and one main location.
• Larger or multi-site scopes get a fixed quote after the gap assessment.
• PCI DSS is quoted separately: a fixed quote follows a free gap assessment.

^[1] Occupational Employment and Wage Statistics, May 2025: 15-1212 Information Security Analysts, national annual median wage. US Bureau of Labor Statistics. accessed October 23, 2026.

The outcome. US prospects answer their own first-round security questions, so fewer emails and faster reviews.

A trust center is a section of your website, or a dedicated site, that shows how you protect data, which independent assurance you hold, who your subprocessors are and how to reach your security team. Every document you send on request is one you could host once.

In Sterling's experience, US buyers use it at three points:

• Before the first call. A prospect's security analyst decides how deep the review must go.
• During procurement. The vendor file gets completed without a chain of requests.
• At renewal. An existing customer checks what has changed.

A neglected page, with an expired report and broken links, does the opposite: it signals nobody is watching. Note that neither SOC 2 nor ISO/IEC 27001 requires a trust center. It is a sales tool built on your real controls, so it should follow them, never lead them.

The outcome. A build list you can complete in one pass. The access column is a suggestion; settle each item with your counsel and your customers' expectations in mind.

The outcome. Assurance wording a US reviewer can rely on, with nothing to walk back later.

• SOC 2. SOC 2 is one of the System and Organization Controls services that CPAs provide^[1], and the examination covers a company's system and its controls relevant to security, availability, processing integrity, confidentiality or privacy^[2]. The SOC 2 report is issued by a US-licensed CPA firm, as AICPA standards require. State which categories your report covers, whether it is Type 1 or Type 2, and the date or period. Write "SOC 2 Type 2 report available under NDA, covering a stated period", never a badge that implies a certificate.
• ISO/IEC 27001. Show the certificate, the accredited certification body that issued it, the scope statement and the expiry date. The scope matters as much as the logo, because it tells the buyer whether their product is covered.
• Work in progress. Say so, with a target: "SOC 2 examination under way, report expected in a stated month." Overstating progress is the fastest way to lose a US buyer's trust.

The outcome. Transparency for buyers without handing attackers a map.

• Network detail. Diagrams, IP ranges and internal hostnames.
• Tool versions. Specific versions of security tools or exposed software.
• Raw reports. Full penetration test or vulnerability-scan output.
• People. Names of individuals in security roles beyond a contact role.
• Open findings. Details of anything still unresolved.
• Customer names. Unless you have written permission.

Where a reviewer needs detail, share it under an NDA or on a call. A defined path for that request is part of what makes the page credible.

The outcome. Each document at the right level, so sensitive files stay controlled and common ones need no email. 1. Public. No friction: overview, subprocessors, privacy notice, status page. These clear the first round of questions. 2. Gated. Behind a short form or click-through NDA; typically the SOC 2 report and detailed policies. You learn who read what, and nothing sensitive is indexed. Keep the gate fast: a buyer waiting a week for a report starts sending questionnaire lines anyway. 3. On request. Shared case by case, such as a full test report. List that it exists and how to ask.

Be consistent. Buyers compare, and gating one item while publishing a similar one invites questions.

The outcome. A page that is true on the day a buyer opens it.

• Owner. Usually security or operations, with a backup.
• Cadence. At least quarterly, plus whenever something material changes: a new subprocessor, report period, hosting provider or certificate renewal.
• Triggers. Tie updates to your processes, so adding a vendor updates the subprocessor list and finishing an audit updates the assurance section.
• One set of answers. The page and your questionnaire responses must agree; a buyer who sees both disagree will believe neither. See answering security questionnaires.

The outcome. A page that fits your size, not a project in itself.

• Hand-maintained page. A section of your own website: cheap, flexible and fine for a small company with few documents.
• Inside a compliance platform. Report status and document lists can update automatically. Effivity, included in every Sterling engagement, can hold the evidence and records the page summarizes.
• Dedicated trust-center product. Adds request workflows and analytics.

Content and upkeep matter more than the tool. For when software alone is enough, see compliance tool vs consulting.

The outcome. A credible page for US prospects from the first month, not after the audit.

You can publish a useful trust center before any report or certificate exists: security overview, subprocessors, policy summaries, a security contact and a dated roadmap, with assurance added when it arrives. The roadmap must be real: name the standard, the stage and the target period, and back it with an actual gap assessment and engagement. The first-year roadmap shows the sequence, and SOC 2 for Series A shows how to present progress.

This is Sterling's recommendation, not a requirement of the AICPA, ISO or any customer. 1. Build a modest trust center early from the checklist; do not wait for a report. 2. Gate the SOC 2 report and detailed policies behind a fast NDA flow. 3. Describe SOC 2 as a report with its type and period; show an ISO certificate with its scope and certification body. 4. Keep a named owner and a dated quarterly review. 5. Use the same answers on the page and in questionnaires. 6. Update the page whenever a subprocessor, scope or report period changes.

Want real assurance to put on that page? Get started with a quick conversation about your buyers and your timeline.

A SOC 2 engagement has one deliverable that no consultant can hand you: the report. The SOC 2 report is issued by a US-licensed CPA firm, as AICPA standards require^[1]. What Sterling does is make sure you get there ready, and that nothing between today and the report lands on your desk.

With Sterling, you deal with one team from start to finish. We coordinate:

• a readiness review and a gap assessment against the Trust Services Criteria;
• the policies, procedures and controls you need, written for how your company actually works;
• evidence collection, so the examination does not become a scramble;
• an internal audit before the examiner arrives, carried out by people who did not advise you on the controls;
• the Type 1 or Type 2 path that fits your deal timeline, and the examination itself, including scheduling, requests and follow-ups.

Our experts bring 30+ years of experience, and the firm has completed 8,100+ client engagements in 60+ countries over 20+ years. You get a single plan, a single point of contact and a clear view of what happens next.

^[1] SOC (System and Organization Controls) Suite of Services. AICPA & CIMA. accessed October 23, 2026.

• SOC 2: standard overviewStandard overview
• ISO/IEC 27001: standard overviewStandard overview
• Clear US Enterprise Security Reviews and Questionnaires FastUnited States
• How US Start-ups Answer Security Questionnaires FastUnited States
• Compliance Tool vs Consulting for US Start-upsUnited States
• First-Year Compliance Roadmap for a US Start-upUnited States
• SOC 2 for Series A: What Founders Need and WhenUnited States
• Sterling in the United StatesUnited States

1. System and Organization Controls: SOC Suite of Services. AICPA & CIMA. accessed October 23, 2026.

2. SOC 2 Reporting on an Examination of Controls at a Service Organization Relevant to Security, Availability, Processing Integrity, Confidentiality, or Privacy. AICPA & CIMA. accessed October 23, 2026.

The information on this page is provided for general informational purposes only. It is not legal advice, and it is not a substitute for advice from a qualified attorney about your own situation.

Requirements depend on your scope, your customers' contracts, your industry and the regulations that apply to you. Two companies asking for the same standard can have very different obligations. We confirm yours during a gap assessment, and we update our content as standards change, but you should check the current text of any standard or rule that matters to you.

Sterling consults and prepares. It does not decide whether you meet a standard. That decision belongs to the independent party that performs the final step: the US-licensed CPA firm for a SOC 2 report, the Qualified Security Assessor or acquirer for PCI DSS, and the accredited certification body for ISO certificates. Timelines and outcomes depend on your readiness and on those parties.

Standards and marks named on this site belong to their respective owners.