Prove your security once. Share it with every buyer.
A maintained trust centre for suppliers who are not software companies. Host your policies and standards, show what your documents cover, and keep it current, so you answer the same questions once.
Free tier with an uncapped standard NDA flow. No card required.
Trust Centre
Security and data protection at Acme Ltd
Documented controls covering our people, systems and suppliers.
How it works
Three steps to a standing trust page
None of it needs a project plan. Most suppliers have the documents already and are simply sending them out one email at a time.
Host your evidence
Upload the policies, standards and certificates that show your posture. Your documents stay your own.
Show what is covered
Map your documents to the areas buyers expect. Each area is covered by a named document or it is not.
Share one page
Send buyers a maintained page instead of answering each questionnaire from scratch.
What a buyer sees
A page a reviewer can act on
Your page is read by people whose job is to check things. It is built for them: clear about what is covered, clear about what is not, and quick to work through.
Coverage they can follow
Each area is covered by a named document or it is not, and the document sits on the page beside it. No percentages, no grades, nothing for a buyer to interpret.
Grounded in your documents
Your page presents what your policies, standards and certificates establish. It is evidence of work you have already done, in a form a buyer can check for themselves.
Gaps in plain type
An area you do not cover appears in the same type as everything else, with nothing flagged red or counted against you. Buyers know nobody covers everything.
EU residency
Everything runs in Ireland: your documents, your page, your trail, the databases and the operational logs. Published retention schedule, and deletion you can run yourself. How the service is built and run.
How approvals work
Nothing goes live until it is approved
Publishing is always a deliberate act by a person who can see what they are about to reveal.
Draft
A contributor adds or updates a document. It stays in draft and is never visible on your trust page.
Review & approve
The document is reviewed and approved before it can be published. A single admin can do this, or you can require a different person to approve, whichever suits your team.
Published
Only after approval does the document appear on your public page, with a full audit trail of who did what and when.
You choose whether a distinct approver is required (separation of duties). Recommended for regulated teams; a single admin can approve and publish when you prefer.
When they ask anyway
Questions come to the page, and the answers stay there
A page answers most of it. For the rest, a buyer sends their questions from your trust centre instead of a spreadsheet, and you answer once.
Drafted from what you have published
Each question comes back with a proposed answer and the document it rests on. Where your published evidence cannot support a question, it comes back marked not answered, with the reason, rather than a guess that reads well.
Nothing goes back until you send it
Approve, rewrite or refuse each answer, then release the set when you are ready. The draft is a starting point; the answer that goes out is yours.
Answered once, not once per buyer
Publish an answer you are happy with and the next buyer reads it on the page instead of asking. The same forty questions arrive from every prospect; this is the version of that work that gets smaller.
What the buyer takes away
Something their file can hold, and their tools can read
A reviewer’s job does not end on your page. It ends in their third-party register, their report, or their own tooling.
A record for their register
A buyer who has signed can take a dated snapshot of your posture: what is covered, what is not, your certifications and subprocessors. It comes as a readable summary or as data, with every document listed under a fingerprint they can check against the file they hold.
Readable by their AI agent
Buyers increasingly send software rather than people. Your public posture is machine-readable on every plan. For anything gated, an agent asks, you approve, and it gets an expiring key you can revoke, with every use on your trail.
Access that expires on its own
An evaluation is a moment, not a standing arrangement, so agent access ends by default rather than lasting until somebody remembers to remove it. A buyer who needs longer asks again in a minute.
On every plan
The parts a buyer’s auditor opens first
A reviewer spends their time in the log and the access rules. None of that sits behind a paywall, on any plan.
Colleagues, with roles
Admins, contributors and reviewers, so the people who write are not automatically the people who publish. Free included, because the alternative is sharing a login.
Full audit trail
Who accepted which agreement version, when and from where; who viewed and downloaded what; every publish and every grant. Sealed entry to entry, so an alteration shows.
Two-factor where it matters
Require a second factor for the actions that change what the world can see: publishing, access, the team, deletion. Your organisation turns it on when your people are ready.
How we run it
The questions your buyers put to you, put to us
You are asking buyers to take your word through us, so the same questions are fair in this direction. The full answers are on our security page.
Support access shows on your log
If our support or operations staff open your account, it appears on your event log with the person’s name on it, beside everything else that happened that day. Not an internal record you would have to ask us for.
A trail that can be checked
Each entry is sealed to the one before it, and the sealed record is anchored separately under a lock with a fixed term. A reviewer who wants to verify your trail can do so instead of taking it on trust.
Currency without the reminder
When a document falls out of date, the claim resting on it stops being presented as current, on its own. You are told before it happens, so the page keeps pace with your work rather than with somebody’s diary.
Buyers keep what they agreed to
Whoever accepts your agreement receives the full text with a fingerprint they can check. Publish a new version and their acceptance stays on the record as what was true that day; they are asked for the current text the next time they visit.
Leave whenever you like
Your documents are yours, held apart from every other customer’s and in the EU. You can close the account yourself, and before anything happens you are shown exactly what will be erased, which addresses stop resolving and how many buyers lose access.
Start from work already done
If INKASEC has already assessed you, your page can start from that engagement rather than an empty template, so the first version is populated instead of a to-do list.
Pricing
Start free. Pay for currency.
The page itself costs nothing on any plan. What you pay for is the work of keeping it true: checking your coverage against your own documents, and telling you before something lapses. Compare the plans line by line.
Prices in GBP, exclude VAT. Plus and Managed are billed annually. Compare plans
Sign up with your work email. A trust page represents a company, so personal addresses (gmail, outlook, icloud…) aren't supported.
Contact
Talk to us, or report a concern
Questions about VitroVault, or a concern about a trust page hosted with us? Email our team and we will respond promptly. If your message is about a specific page, please include its address. Security reports go to security@vitrovault.com.