Services · Now booking
Your Trust Center, built on evidence and kept current.
Third Party Threat Hunting (TPTH) practitioners write your Trust Center and verify every claim against your evidence, the way an assessor would. Your customers' security teams get answers they can rely on, and your team answers fewer repeat questionnaires. Now booking.
Who it is for
Vendors that keep answering the same security questionnaires
If you sell to banks, credit unions, healthcare organizations and other regulated customers, your buyers ask for your security posture before they sign. A Trust Center answers those questions once, in public, with evidence behind each claim.
It fits fintech and B2B software companies, service providers and nonprofits: a company with no Trust Center, and one whose Trust Center is out of date or cannot be backed up.
Aligned with published guidance
The Trust Center is aligned with the Third Party Risk Association (TPRA) published Trust Center guidance. We can also use your own format. You host the pages wherever you like.
See how we built ours →What is included
Build it once, or keep us on to maintain it
01
Build (one time)
Kickoff and complexity scoring, intake, an evidence check on every claim, written content and pages, launch, and a dated change log.
02
Maintain (monthly)
A quarterly refresh, the change log and sub-processor checks.
03
Manage (monthly)
A monthly evidence review, the change log, and incident and sub-processor updates as they happen.
Pricing
Priced by complexity band
We set the band at kickoff from the scoring sheet below. All prices are launch prices and may be revised.
| Band | Typical customer | Build | Maintain | Manage |
|---|---|---|---|---|
| A: Essentials | Small vendor or nonprofit, one product, up to about 10 sub-processors, no formal audit | $4,500 | $500 a month | $1,000 a month |
| B: Standard | SOC 2 or ISO, 1 to 3 products, up to about 30 sub-processors | $7,500 | $750 a month | $1,500 a month |
| C: Complex | Regulated, 30 or more sub-processors, several frameworks or products | Quoted, from $14,000 | Quoted | Quoted |
The build is paid 50% at kickoff and 50% at delivery. Maintain and Manage are billed monthly in advance, month to month, with 30 days' written notice to end.
Scoring sheet
How we set your band
Score each factor from 1 to 3 and add them up. 5 to 7 is Band A, 8 to 11 is Band B, 12 to 15 is Band C. A regulated customer with 30 or more sub-processors is Band C whatever the total.
| Factor | 1 point | 2 points | 3 points |
|---|---|---|---|
| Sub-processors to list | Up to 10 | 11 to 30 | More than 30 |
| Products or services in scope | One | Two or three | Four or more |
| Frameworks and audit reports | None | One (SOC 2 or ISO) | Two or more |
| Regulation and data sensitivity | Unregulated, low-sensitivity data | Sensitive data or contractual security terms | Regulated (bank, healthcare, similar) |
| Evidence readiness | Policies and evidence organized | Partly organized | Scattered or missing |
How it works
Six steps from kickoff to upkeep
Step 1
Kickoff and scoringWe score the factors with you and confirm the band and fee.Step 2
IntakeYou complete the intake form and supply evidence within 15 business days.Step 3
Evidence checkWe check every claim against its evidence. Anything we cannot verify is not published.Step 4
Draft and reviewYou review the content and confirm it is accurate.Step 5
LaunchThe pages go live within 45 to 60 days of receiving your complete intake and evidence.Step 6
UpkeepUnder Maintain or Manage, we keep it current and log every change.Your part
Your responsibilities, in plain words
- Provide the information without delay. Delays move the schedule, and work beyond the agreed scope is billed at $350 an hour after written notice.
- Confirm in writing that what you supply is accurate, and tell us promptly when it changes.
- If you decide not to share something we need to verify a claim, we can publish only what is evidenced, pause, or end the engagement. Either side may end it in writing; work delivered stays billable and unused prepayment is refunded.
- TPTH is not an auditor and does not guarantee any questionnaire or customer outcome.
The full terms are in your engagement agreement.
The offer in one page
Scope, bands, process and responsibilities, ready to share with your security or procurement team.
Questions