Questions
The things people ask before they start
Short answers to the questions we get most, including the ones where the answer is no.
The basics
What this is, who it suits, what Free includes, and how long a first version takes.
What is a trust centre, in one paragraph?
A page you own that answers the security and data-protection questions buyers ask, before they ask them. Your certifications, what is covered and what is not, who your subprocessors are, and the documents themselves. Anything sensitive sits behind an agreement a buyer accepts on the page, so you can publish openly without publishing everything.
Who is this for?
Suppliers who sell to organisations that run due diligence: software companies, agencies, processors, anyone whose deals stall on a security questionnaire. It suits a company small enough that the questionnaire lands on somebody who has another job as well.
Is Free actually free, or a trial?
Free. One real trust page on a vitrovault.com address, the confidentiality agreement, an uncapped number of buyers accepting it, access requests, your subprocessor list, colleagues with roles, two-factor, and the complete audit trail. No card, and no expiry for as long as the trust page is in use. What you pay for on the higher plans is currency and checking.
How long does it take to put up?
An afternoon for a first version, if your documents exist. Upload what you have, write the short overview, choose what is public and what is gated, publish. A page with three documents is more use to a buyer than one that never goes live.
Documents, agreements and access
The confidentiality agreement, what a buyer does to open a gated document, and what happens to people who signed an earlier version or signed on paper.
Do I have to write my own NDA?
No. Every page comes with a standard confidentiality agreement, so your gate works from the first minute. Plus lets you replace the wording with your own; Managed can hold five different agreements, so different material can carry different terms. How often buyers accept one is never limited, on any plan.
What does a buyer actually do to read a gated document?
They give a work email, prove it with a one-time code, read the agreement and accept it. Then the document opens. You either let that happen automatically and hear about it, or hold every one for your approval; that is a per-page setting. The code is what makes your record of who accepted worth something.
If I publish a new version of my agreement, what happens to people who signed the old one?
Their access continues, and the version they accepted stays on the record as what was true that day. The next time they come back they are asked to accept the current text. Nobody is emailed about it and nothing is revoked.
Someone signed on paper. Can I let them in?
Yes, and you say so explicitly when you grant it, so the trail records that the agreement was made off the page rather than pretending they clicked something.
Can a buyer's AI agent read my page?
Whatever you publish openly, yes, on every plan: it is published. For gated material, Managed can issue a key a buyer’s agent uses, after you approve it. The key expires, you can revoke it, and every use lands on your trail.
Data and exit
Where your data sits, what we keep about your buyers, and how to leave.
Where is our data, and who is the controller?
Ireland, in the EU, throughout. For your trust page you are the controller and we are your processor, under a written agreement, with a published retention schedule.
What do you keep about the buyers who visit my page?
What your gate asked for: name, work email, company, the version they accepted, and when. Plus the record of what they opened, which is the evidence the page exists to produce. It is your data, held for you, and it goes when your account goes.
How do I leave?
Close the account yourself from the console. Before anything happens you are shown exactly what will be erased, which addresses stop resolving, how many buyers lose access, and what we keep and why. Confirm, and it is done.
Does any of this make us compliant with anything?
No. It gives you the evidence to show work you have already done, in a form a buyer can check. Certification comes from a certification body, not from a page.
What is the difference between declared, assessed, validated and audited?
Four levels of who checked. Declared is your word. Assessed means each area names the document behind it, on the page, so a buyer can follow the claim to the paper. Validated means we asked for proof that what the documents describe actually happens. Audited is a full internal audit under its own agreement. The first two are plans; the last two are scheduled work. The pricing page sets them out.
What happens if VitroVault goes away?
Your documents are yours and can be taken out at any time, and a buyer’s evidence record is a standalone file that stays readable without us. From Plus upward your page is on your own domain, so the address is yours to point elsewhere.
Still asking?
Email hello@vitrovault.com. If the question is about a specific page hosted with us, include its address.