---
title: Share SOC 2 Reports & Security Documents Under NDA – Simple Trust Center | HelpRange
url: https://www.helprange.com/share-security-documents
---

Security reviews · trust center

# Share SOC 2 reports and pen-test summaries under NDA – and see who read them

Your security package in one room: prospects verify their e-mail, sign your NDA online, read the SOC 2 report view-only with their e-mail on every page, and lose access on the date you set. You see which pages each reviewer read.

 [Start free trial](https://www.helprange.com/#signUpSection) [Live demo](https://www.helprange.com/demo) [Free security questionnaire](https://www.helprange.com/vendor-security-assessment-questionnaire)

Your whole team, unlimited guests, one price. Or $199 for a single deal. No sales call.

Unlimited is $174 a month for your whole team – data rooms, NDA before access, AI Q&A. The Deal Room Pass is $199 once for 90 days and never renews. Sign up and pay by card.
  [See pricing](https://www.helprange.com/pricing)

### NDA before the first page

Reviewers confirm their e-mail with a one-time code and sign your NDA online. Both sides get a PDF record: name, company, e-mail, time, IP and the exact text.

### Their e-mail on every page

Dynamic watermark with the reader's e-mail, date, time and IP – a forwarded screenshot of your SOC 2 report shows where it came from.

### View-only

Downloads and printing off unless you allow them, per link or per room.

### Access that ends

Expiry date on the room or link, a views limit, or revoke one reviewer at any time – even after they signed.

### Who read what

Every reviewer, every document, time on each page – with an e-mail, Slack or webhook alert on each open.

### One package, every deal

Replace the SOC 2 report or bridge letter with the new version and the links you already sent show it.

**Short answer:** B2B buyers ask for your SOC 2 report, ISO 27001 certificate, penetration test summary and policies before they sign. Do not attach them to e-mails – an attached SOC 2 report can be forwarded forever and you never know who read it. Put the documents in one room, require an NDA before access, watermark each page with the reader's e-mail, keep it view-only and set an end date. That is what a "trust center" does for the confidential part of your security package; you do not need an enterprise tool for it.

## What goes into a security package – and what to put behind an NDA

| Document | Who asks for it | How to share |
|---|---|---|
| Security overview / whitepaper, list of certifications, status page | Anyone – public page | Public |
| ISO/IEC 27001 certificate | Prospects and customers | Public or e-mail gate |
| Subprocessor list, privacy policy, template DPA | Prospects and customers | Public or e-mail gate |
| SOC 2 Type II report and bridge letter | Qualified prospects, customers, auditors | NDA, watermark, view-only, expiry |
| Penetration test executive summary and remediation letter | Qualified prospects, customers | NDA, watermark, view-only, expiry |
| ISO 27001 Statement of Applicability, key policies (access, incident response, BC/DR) | Security reviewers at the customer | NDA, watermark, view-only |
| Completed questionnaires (CAIQ, SIG or your own), architecture diagram | Security reviewers at the customer | NDA, watermark, view-only, expiry |
| Insurance certificate, financial statements | Procurement | NDA |

SOC 2 reports are restricted-use reports meant for customers and prospects who understand them, which is why almost every vendor shares them only under NDA. Penetration test summaries and completed questionnaires describe how your systems work – the same rule applies.

## How to share SOC 2, ISO 27001 and pen-test reports under NDA (step by step)

1. **Write your NDA once.** Settings → NDAs: paste your mutual NDA. Keep a second one for partners or auditors if you need it.
2. **Create a data room called "Security package"** and upload the SOC 2 report and bridge letter, ISO 27001 certificate and Statement of Applicability, penetration test summary, key policies, subprocessor list, DPA and your completed questionnaire. Number the folders so reviewers can cite them.
3. **Switch on the protections:** Require NDA, watermark on, downloads off, and an expiry date for the evaluation period.
4. **Invite the reviewers** from the prospect by e-mail – security, procurement and legal. Each one logs in with a one-time code sent to their address and signs the NDA before anything opens.
5. **Or send a single document** – for example only the ISO certificate – as a tracked link with e-mail verification, passcode, watermark and expiry.
6. **Follow the review:** see which documents and pages each reviewer opened and for how long; nudge the deal when the security team has actually read the report.
7. **Close access** when the evaluation ends or the deal is lost; replace the report when the new audit period is issued.

Plans: tracked links with e-mail verification, passcodes, expiry, watermarks and download blocking are on Pro ($39 per team per month, which also includes up to 3 data rooms). NDA before access is on Unlimited ($174 per team per month), the Deal Room Pass ($199 once for 90 days, nothing renews) and the 3-day trial. Guests are not counted on any paid plan. [Pricing](https://www.helprange.com/pricing) · [NDA before access](https://www.helprange.com/data-room-nda)

## Dedicated trust-center tools compared (published pricing, 7 November 2026)

Tools built only for security reviews add a public trust page, live control status from compliance automation, AI answers to questionnaires and CRM-based approval. None of them publishes a price for its trust center – every one sends you to a demo or a quote.

| Tool | Published price | NDA before access | Access expiry | Analytics |
|---|---|---|---|---|
| [SafeBase (Drata Trust Center)](https://drata.com/pricing) | Quote only (Foundation, Advanced, Enterprise) | Click-through NDA on all tiers; DocuSign / Ironclad on Advanced+ | Access expiry on Advanced and Enterprise | Dashboards |
| [Vanta Trust Center](https://www.vanta.com/pricing) | Quote only ("personalized pricing") | NDA through DocuSign / Ironclad | Not stated | Downloads, page views, chatbot questions |
| [Conveyor](https://www.conveyor.com/pricing) | Quote only (priced on usage) | Click-through NDA | Not stated (auto-approval by domain; watermark on downloads) | Engagement and requests |
| [Whistic](https://www.whistic.com/pricing) | Quote only ("Request Pricing") | Standard NDA | Auto-expiration | Not stated |
| [Secureframe Trust](https://secureframe.com/pricing) | Quote only | Automated NDA workflow | Not stated | Not stated |
| [TrustCloud TrustShare](https://www.trustcloud.ai/pricing) | Quote only | Click-wrap NDA in invitation-only rooms | Not stated | Most-used documents |
| [HyperComply](https://www.hypercomply.com/pricing) | Quote only (free trial of a Trust Page) | NDA or approval per document | Auto-expiry in data rooms | Access log in data rooms |
| [HelpRange](https://www.helprange.com/pricing) | Pro $39 / team / month; Unlimited $174 / team / month; Deal Room Pass $199 once (90 days) | Click-to-sign NDA with PDF record (Unlimited, Pass) | Per room and per link | Per reviewer, per page, with alerts |

Read on each vendor's own pricing page (linked) on 7 November 2026; features as stated on the vendor's pages – "not stated" means we did not find it there, not that it is missing. Prices change; check before you buy. Disclosure: HelpRange is our product.

## Which one do you need?

- **A dedicated trust center** makes sense when you answer many security questionnaires a month, already run compliance automation (Vanta, Drata, Secureframe) and want a public page with live control status and AI-drafted questionnaire answers.
- **A data room with NDA** is enough when what you need is to give a handful of prospects at a time controlled access to the SOC 2 report, pen-test summary and policies – with a known price, no sales call and no per-reviewer fees.
- **Not covered by HelpRange:** compliance monitoring, a public security status page and automated questionnaire answering. Keep your public overview on your website and link from it to the room.

## Answer the questionnaire once

Most security questionnaires ask the same things. Fill in our [free vendor security assessment questionnaire](https://www.helprange.com/vendor-security-assessment-questionnaire) (75 questions, mapped to NIST CSF 2.0 and the CSA Cloud Controls Matrix), put it in the room next to your SOC 2 report and send every new prospect the same link. For company, financial and contract documents buyers request from suppliers, see the [vendor due diligence checklist](https://www.helprange.com/due-diligence-checklist/vendor).

Looking for how HelpRange protects your own documents? See [HelpRange security](https://www.helprange.com/security) – documents are encrypted and stored in Frankfurt, Germany; HelpRange does not yet hold its own SOC 2 or ISO 27001.

FAQ

## Sharing security documents – questions

Do I need a dedicated trust center tool to share a SOC 2 report?

No. What you need is control: an NDA before access, a known reader, no free downloads and an end date. A data room with click-to-sign NDA, dynamic watermarks and expiry does that. Dedicated trust centers add a public security page, compliance-monitoring integrations and AI answers to questionnaires – worth it if you answer many questionnaires a month, and they are sold on quotes.

Can I require an NDA before a prospect sees our SOC 2 report?

Yes. Write your NDA once in Settings → NDAs and switch it on for the room or link. The viewer confirms their e-mail with a one-time code, signs, and only then sees documents. You and the signer both get a PDF confirmation with name, company, e-mail, time, IP and the exact text. NDA before access is part of Unlimited, the Deal Room Pass and the trial.

Can prospects download or print the report?

Only if you allow it. Downloads are off by default on links; for a room you choose whether files can be downloaded. Every page can carry the viewer's e-mail, the date and time and their IP, so a screenshot or photo still shows who it came from – no viewer can prevent screen photos, but the watermark makes them traceable.

Can access expire when the evaluation ends?

Yes. Set an expiry date on the link or on the data room, a views limit on a link, or revoke a reviewer at any time – also after they signed the NDA.

Can I see who read the penetration test summary?

Yes – every view with the reader's e-mail, time, country and time spent on each page, plus an e-mail, Slack or webhook alert when someone opens it. Useful to know whether the security reviewer has actually started.

Can several people from the customer's team review the documents?

Yes. Invite each reviewer by e-mail; guests are not counted or charged on paid plans. Each one signs the NDA and appears separately in the statistics.

Is HelpRange itself SOC 2 or ISO 27001 certified?

Not yet – we say so on our own security page, which also describes where documents are stored (encrypted in Frankfurt, Germany) and how access is controlled. If your reviewers need a vendor with its own SOC 2 report for this kind of tool, choose accordingly.

What should I send instead of a 300-question questionnaire?

Offer your SOC 2 report and a short standard questionnaire you have already filled in. Our free vendor security assessment questionnaire is a good base: answer it once, put it in the room next to the report, and point every new prospect to the same link.

 Related

 [Vendor security questionnaire (free CSV)](https://www.helprange.com/vendor-security-assessment-questionnaire) [NDA before access](https://www.helprange.com/data-room-nda) [Vendor due diligence checklist](https://www.helprange.com/due-diligence-checklist/vendor) [Dynamic watermarks](https://www.helprange.com/feature-documents-watermarking) [Deal Room Pass – $199](https://www.helprange.com/deal-room-pass)

## Put your security package behind an NDA today

3-day free trial with every feature, including NDA before access. No credit card required.
 [Start free trial](https://www.helprange.com/#signUpSection)