Short answer: B2B buyers ask for your SOC 2 report, ISO 27001 certificate, penetration test summary and policies before they sign. Do not attach them to e-mails – an attached SOC 2 report can be forwarded forever and you never know who read it. Put the documents in one room, require an NDA before access, watermark each page with the reader's e-mail, keep it view-only and set an end date. That is what a "trust center" does for the confidential part of your security package; you do not need an enterprise tool for it.
What goes into a security package – and what to put behind an NDA
| Document | Who asks for it | How to share |
|---|---|---|
| Security overview / whitepaper, list of certifications, status page | Anyone – public page | Public |
| ISO/IEC 27001 certificate | Prospects and customers | Public or e-mail gate |
| Subprocessor list, privacy policy, template DPA | Prospects and customers | Public or e-mail gate |
| SOC 2 Type II report and bridge letter | Qualified prospects, customers, auditors | NDA, watermark, view-only, expiry |
| Penetration test executive summary and remediation letter | Qualified prospects, customers | NDA, watermark, view-only, expiry |
| ISO 27001 Statement of Applicability, key policies (access, incident response, BC/DR) | Security reviewers at the customer | NDA, watermark, view-only |
| Completed questionnaires (CAIQ, SIG or your own), architecture diagram | Security reviewers at the customer | NDA, watermark, view-only, expiry |
| Insurance certificate, financial statements | Procurement | NDA |
SOC 2 reports are restricted-use reports meant for customers and prospects who understand them, which is why almost every vendor shares them only under NDA. Penetration test summaries and completed questionnaires describe how your systems work – the same rule applies.
How to share SOC 2, ISO 27001 and pen-test reports under NDA (step by step)
- Write your NDA once. Settings → NDAs: paste your mutual NDA. Keep a second one for partners or auditors if you need it.
- Create a data room called "Security package" and upload the SOC 2 report and bridge letter, ISO 27001 certificate and Statement of Applicability, penetration test summary, key policies, subprocessor list, DPA and your completed questionnaire. Number the folders so reviewers can cite them.
- Switch on the protections: Require NDA, watermark on, downloads off, and an expiry date for the evaluation period.
- Invite the reviewers from the prospect by e-mail – security, procurement and legal. Each one logs in with a one-time code sent to their address and signs the NDA before anything opens.
- Or send a single document – for example only the ISO certificate – as a tracked link with e-mail verification, passcode, watermark and expiry.
- Follow the review: see which documents and pages each reviewer opened and for how long; nudge the deal when the security team has actually read the report.
- Close access when the evaluation ends or the deal is lost; replace the report when the new audit period is issued.
Dedicated trust-center tools compared (published pricing, 7 November 2026)
Tools built only for security reviews add a public trust page, live control status from compliance automation, AI answers to questionnaires and CRM-based approval. None of them publishes a price for its trust center – every one sends you to a demo or a quote.
| Tool | Published price | NDA before access | Access expiry | Analytics |
|---|---|---|---|---|
| SafeBase (Drata Trust Center) | Quote only (Foundation, Advanced, Enterprise) | Click-through NDA on all tiers; DocuSign / Ironclad on Advanced+ | Access expiry on Advanced and Enterprise | Dashboards |
| Vanta Trust Center | Quote only ("personalized pricing") | NDA through DocuSign / Ironclad | Not stated | Downloads, page views, chatbot questions |
| Conveyor | Quote only (priced on usage) | Click-through NDA | Not stated (auto-approval by domain; watermark on downloads) | Engagement and requests |
| Whistic | Quote only ("Request Pricing") | Standard NDA | Auto-expiration | Not stated |
| Secureframe Trust | Quote only | Automated NDA workflow | Not stated | Not stated |
| TrustCloud TrustShare | Quote only | Click-wrap NDA in invitation-only rooms | Not stated | Most-used documents |
| HyperComply | Quote only (free trial of a Trust Page) | NDA or approval per document | Auto-expiry in data rooms | Access log in data rooms |
| HelpRange | Pro $39 / team / month; Unlimited $174 / team / month; Deal Room Pass $199 once (90 days) | Click-to-sign NDA with PDF record (Unlimited, Pass) | Per room and per link | Per reviewer, per page, with alerts |
Which one do you need?
- A dedicated trust center makes sense when you answer many security questionnaires a month, already run compliance automation (Vanta, Drata, Secureframe) and want a public page with live control status and AI-drafted questionnaire answers.
- A data room with NDA is enough when what you need is to give a handful of prospects at a time controlled access to the SOC 2 report, pen-test summary and policies – with a known price, no sales call and no per-reviewer fees.
- Not covered by HelpRange: compliance monitoring, a public security status page and automated questionnaire answering. Keep your public overview on your website and link from it to the room.
Answer the questionnaire once
Most security questionnaires ask the same things. Fill in our free vendor security assessment questionnaire (75 questions, mapped to NIST CSF 2.0 and the CSA Cloud Controls Matrix), put it in the room next to your SOC 2 report and send every new prospect the same link. For company, financial and contract documents buyers request from suppliers, see the vendor due diligence checklist.