Trust Center
A Trust Center is a public page that shows the world you take security seriously. Instead of answering the same questions in every sales cycle, you point prospects at a page they can self-serve, which helps close deals faster.
Only an owner or admin can edit, publish or take down the trust center.
What it shows
Section titled “What it shows”Your Trust Center presents a curated view of your program:
- Frameworks and controls: the frameworks and controls you have fully in place, each with a green check.
- Policies: the names of your approved policies, and the documents behind them.
- Documents: certificates, audit reports and other files, open or behind an access request.
- Subprocessors: the third parties in your supply chain, so customers can see who’s involved in handling their data.
- Updates: a dated timeline of posts about your security program.
- System status and Security contact: a link to your status page and an email address for security questions.
Under Visible sections you switch each of these on or off.
What is never shown
Section titled “What is never shown”The published page lists only what is fully in place. Anything not yet in place is left off the page entirely: no percentages, no denominators and no count of what is outstanding. This is fixed and has no setting. Your readiness figures inside Keel are unaffected.
If a policy is approved in Keel but has no text written yet, the public page lists it as “No document published” and offers no download. Keel never publishes a stand-in document under your policy’s name. The Trust Center page warns you about any such policy and links to it; write the text, then save or republish.
Publishing safely
Section titled “Publishing safely”Publishing writes a curated snapshot to a separate public page. The Trust Center never reads your live tenant data. Saving takes a fresh snapshot of your posture, and approved policies appear automatically while the Policies section is on. The page shows when the snapshot was last updated.
Click Refresh & republish after a change you want visitors to see. Take offline removes the public page at any time, and the snapshot is retained rather than destroyed.
Setting it up
Section titled “Setting it up”- Open Trust Center in the app and choose the Public slug. The page lives at
/trust/<slug>. - Add a Headline, a Brand color, and optionally an Intro, a Security contact email, your Privacy policy URL and your System status URL.
- Add your branding: a Logo (PNG or SVG, up to 250 KB) and a wide Cover image (up to 1.2 MB).
- Choose your Visible sections.
- Click Publish. Share the link with prospects, or put the website badge on your site. Preview public page opens it as a visitor sees it.
Documents can be added once the page has been published for the first time.
Documents
Section titled “Documents”Each document has a title and a kind: report, certificate, policy or link. There are two ways to add one:
- Link to a file hosted elsewhere, with a full
https://URL. - Upload the file to Keel. PDF, Office, image and text files are accepted, up to 25 MB. Choose View in browser or Download. Images and PDFs can be viewed in the browser; other file types always download.
Gated documents and NDAs
Section titled “Gated documents and NDAs”Click Make gated on a document to put it behind an access request. A visitor then has to request it with their email address. If you fill in NDA / terms text for gated documents, that text becomes a checkbox the visitor must tick before requesting. Click Gated again to make the document open.
Every access request is a captured lead, shown under Analytics.
The visitor gets an emailed link that works for 7 days by default. To change how long it works, or to stop sending links to certain email domains, use Trust Center settings.
As the owning admin you can open a gated uploaded file without requesting access. Use its Preview link to see exactly what an approved visitor sees.
Subprocessors
Section titled “Subprocessors”List the third parties you rely on, such as cloud hosting, email and analytics providers. Each entry has a name, a purpose and optionally a location. They appear on a Subprocessors tab on the public page.
Audit status
Section titled “Audit status”The Audit status tab records the external audits you have engaged a firm for: SOC 2 Type I or Type II, ISO/IEC 27001, ISO/IEC 42001, PCI DSS or HITRUST. Each audit has a firm name, an optional audit period and a status:
| Status | What the public page says |
|---|---|
| Auditor engaged | Auditor engaged |
| Audit in progress | Audit in progress |
| Issued | Report issued, or Certificate issued for ISO, with the date |
An issued audit needs its issue date. Tick Engagement letter available on request to say so on the page until the report issues. Only audits marked Show on the public trust center appear there, and the block always states that the status is recorded by your company and not verified by Keel. Saving an audit updates the public page straight away.
Security pack
Section titled “Security pack”The Security pack tab prints a security overview you can send a buyer before your audit report exists. Open the pack and use your browser’s Save as PDF to keep a copy. It is built from records you already keep in Keel:
- Company facts from Company facts, including who can access customer data and how it flows.
- Every audit recorded on the Audit status tab, in the same words the trust center uses.
- Your subprocessors, each with the standing of its latest SOC report from the vendor register.
- Your approved policies, by title and version.
- Up to 25 answers from the answer library whose review-by date has not passed.
A section with nothing recorded is left out. The pack states that it was prepared from your own records, that Keel does not verify them, and that it is not an audit report. Only an owner or admin can open it.
Updates feed and subscribers
Section titled “Updates feed and subscribers”The updates feed is a public security changelog. Post when you earn a certification, ship a control or respond to an incident. Each post needs a date and a title, and the posts appear as a dated timeline on an Updates tab.
Visitors can subscribe to updates. A subscriber is pending until they confirm by email. Confirmed subscribers are emailed when you post a new update, but only while the page is published.
Analytics and leads
Section titled “Analytics and leads”The Analytics tab shows engagement with your published page: access requests, unique visitors, documents opened, NDA acceptances, and confirmed and pending subscribers. A per-document breakdown shows which files people ask for.
Recent access requests are listed with the email address, the document, the time, whether it was opened and whether the NDA was accepted. Click Download leads (CSV) for the full list.
AI narrative draft
Section titled “AI narrative draft”On the AI draft tab, Draft trust-center narrative writes prose for your page from your real posture: enabled frameworks, controls met and published policies. Copy what you like into the Intro and section text. The draft is labeled AI-drafted until someone reviews it.
Drafting uses AI credits, and an owner or admin runs it. It is unavailable while AI is turned off for the workspace. If a request fails, the credits are refunded.
Branding and plans
Section titled “Branding and plans”Every plan includes the trust center, with your own logo and cover. The page shows a small “Published with Keel.” credit in the footer unless the workspace is white-labeled: Enterprise, the MSP / Partner plan, or the Trust Center Pro add-on on any other plan. An owner or admin can ask for Trust Center Pro from the Branding tab of the Trust Center page; it is billed as a monthly add-on.
A white-labeled workspace can still choose to show the credit. Click Show the credit to add it and Hide the credit to remove it again. The change applies to the public page straight away, with no republish needed.
Custom domain
Section titled “Custom domain”A workspace that is white-labeled (Enterprise, the MSP / Partner plan, or the Trust Center Pro
add-on) can serve its trust center on its own hostname, such as trust.yourcompany.com. An
owner or admin sets it up:
- Publish the trust center first. A custom domain only serves a live page.
- Under Custom domain on the Branding tab of the Trust Center page, enter the hostname and click Add domain.
- At your DNS provider, add the two records Keel shows: a TXT record at
_keel-verify.<your hostname>that proves you own it, and a CNAME that points the hostname at Keel. Each value has a copy button. - Click Verify now. DNS changes can take a few minutes to propagate, so if Keel cannot find the TXT record yet, wait and try again.
- Once ownership is confirmed, the domain shows Certificate issuing while Cloudflare issues the TLS certificate. This usually takes a few minutes after the CNAME resolves. Click Recheck status until the domain shows Verified & live.
A hostname can belong to only one workspace. Remove releases it.
Website badge
Section titled “Website badge”You can put a small “View our trust center” badge on your own website. It is a link to your public trust page, available on every plan. An owner or admin finds it under Website badge on the Trust Center page, once the trust center is published. Before that, the section asks you to publish first, because the badge would have nothing to open.
Pick how it looks, then copy it:
- Under Background, choose Light or Dark to suit the page the badge will sit on.
- Under Size, choose Compact for a single line, or Card, which adds a second line reading “Security and compliance details”.
- Leave Show the Keel mark ticked to draw the Keel logo on the left, or untick it for a text-only badge.
- Check the preview, then click Copy snippet and paste the HTML snippet into your site.
The snippet is a plain link around an image, with no script. The image loads from Keel. The link goes to your verified custom domain if one is live, and to your Keel trust page URL otherwise. The line under the button shows where it points.
The badge shows no date, no status and no pass or fail result. It reads the same for every workspace, whatever is on your trust page. It is not a certification or a seal, and Keel does not certify you. It tells a visitor where to find your security information.
Because the badge never changes, you set it once. If you change your trust center address, such as a new slug or a custom domain going live, copy the snippet again and replace the old one.