What 164 Cloud Companies Publish on Their Trust Centers

Data from 2 October 2026.

131 of the 164 cloud companies in the sample run a dedicated trust center, 80%. Almost none of them let a visitor download the SOC 2 report. Of the 114 trust centers that say how to get it, 5 offer a public download. The rest ask for a form, a login, an NDA click or an email.

The sample is the 2025 Forbes Cloud 100, which lists private companies, plus the 64 other companies in the BVP Nasdaq Emerging Cloud Index, which are public. The 2026 Cloud 100 was not out on 2 October 2026. Vanta is on the Cloud 100 and is also a platform we score. Its trust center was counted like any other.

Who runs a trust center

A trust center is a dedicated page where a company lists the frameworks it holds and shares its security documents. 131 companies have one. 25 more have only a marketing security page. 4 put everything behind a login, and 4 show no trust center at the usual addresses.

Private and public companies are level. 81% of the Cloud 100 run a trust center, and so do 78% of the public index.

The SOC 2 report stays behind a request

A SOC 2 report is the document a CPA firm issues after the audit. 114 trust centers say how to get it. 89 use a request form, 7 need a login, 7 say to contact the company and 6 use an NDA click-through. 5 let anyone download it, which is 4% of the 114. The other 17 trust centers do not say how to get the report.

Other documents follow the same pattern. Pen test results are gated on 67 trust centers. 5 show a public summary, and 1, HubSpot, publishes the full report. Security questionnaires such as the CAIQ and SIG are gated on 59 and public on 6. Subprocessor lists are the most open document, public on 50 trust centers and gated on 29.

70% of documents need a request

Vanta and Conveyor tag every document on a trust center with an access level in the page data, so for those two platforms the count is exact. 40 companies run their trust center on Vanta or Conveyor. Between them they list 941 documents, and 660 of those need a request or an NDA, which is 70%. Vanta pages gate 437 of 620 documents. Conveyor pages gate 223 of 321.

The 70% covers those 40 companies only. SafeBase pages carry no clean per-document flag, so SafeBase trust centers are left out of this figure.

SafeBase hosts the most trust centers

SafeBase runs 50 of the 131 trust centers, 38%. Drata owns SafeBase. Vanta hosts 26 (20%), and another 26 are self-built. Conveyor hosts 14 (11%). Whistic, TrustCloud and the other platforms host under 2% each, and Secureframe hosts 1. For 7 trust centers, the platform is not identifiable.

Six of the compliance platforms we score sell a trust center of their own, and it counts toward the Trust and questionnaires criterion in our rubric. Their AWS Marketplace listings put Vanta’s trust center in its Plus tier and above, from $21,500 a year. Drata lists its trust center as an optional module.

SOC 2 and ISO 27001 travel together

82% of trust centers name both SOC 2 and ISO 27001. 11% name SOC 2 only, and 4% name ISO 27001 only.

The median trust center names 7 frameworks. HIPAA appears on 44% and PCI DSS on 43%. CSA STAR and ISO 27701 each show on 34%, and SOC 3 on 31%. Some level of FedRAMP appears on 27%, TISAX on 19% and C5 on 15%.

ISO 42001 already shows on 31%

ISO 42001, the management system standard for AI, is named on 40 of the 131 trust centers. Private companies lead: 35% of Cloud 100 trust centers name it, against 24% in the public index. 56% of trust centers have a section on AI.

How the counts work

The sample comes from Forbes’ own list data and the BVP index page as of 2 October 2026. A company’s trust center is the page at a trust subdomain, /trust or /security, or the top result of one search when none of those answer. The platform comes from the calls the page makes to its host, and from a “Powered by” line when the calls do not show it.

Counts reflect what each trust center shows a visitor without a login, form or NDA.

Limits

• Counts are as of 2 October 2026. Trust centers change.
• Framework counts are as each trust center states them.
• “None found” means no page at the usual addresses and none in one search. It does not prove a company has no trust center.
• Document gating is exact for Vanta and Conveyor only. SOC 2 access on SafeBase trust centers comes from the visible page.
• Three AI labs from the Cloud 100 count in every figure on this page and are left out of the table and the CSV.

What it means for a buyer

Plan to request the SOC 2 report. 109 of the 114 trust centers that show access put it behind a form, a login, an NDA click or an email. The frameworks on a trust center are the company’s own list. The report shows what the auditor tested.

Expect to request pen test results and security questionnaires as well. Subprocessor lists are the document you are most likely to find in the open.

Vanta, Drata and Secureframe host trust centers for other companies. We also score all three as compliance platforms in the SOC 2 software ranking and the compliance management ranking.

What it means for a company building one

A request form for the SOC 2 report is the common choice, used by 89 of the 114. A public download would put you with 5 companies in this sample.

82% of trust centers list SOC 2 and ISO 27001 side by side. If your buyers ask about AI, 56% of trust centers already carry an AI section and 31% name ISO 42001.

Self-built pages are as common as Vanta pages, 26 each. SafeBase hosts close to 2 in 5.

The data

The charts and table below come from the same check. The CSV adds columns for subprocessor lists, pen test results, questionnaires, the AI section and the Vanta and Conveyor document counts.