# Trust Center Benchmark **URL:** https://theauditrail.com/tools/trust-center-benchmark/ **Published:** 2026-11-12 **Modified:** 2026-10-02 **Author:** The Audit Trail editorial desk > Tick what your trust center shows and see how it compares with named Cloud 100 and BVP index trust centers, item by item. --- # Trust center benchmark 86 of 132 trust centers put the SOC 2 report behind a request form. ## Your trust center The benchmark needs JavaScript. The full census is in the table below. Compare with All trust centers (132) Cloud 100 (79) BVP index (53) SOC 2 report Skip Public download NDA click-through Request form Login Contact us Not listed Subprocessor list Skip Public Gated Login Not listed Pen test results Skip Public Public summary Gated Login Not listed Security questionnaire Skip Public Gated Login Not listed AI section Skip Yes No Frameworks held SOC 2 (any type) ISO 27001 GDPR CCPA HIPAA PCI DSS ISO 27017 ISO 27018 CSA STAR ISO 27701 SOC 1 ISO 42001 SOC 3 FedRAMP (any level) TISAX Cyber Essentials C5 IRAP DORA ISO 9001 GovRAMP HITRUST EU AI Act CMMC ## Trust centers in the census Access level All trust centers Cloud 100 BVP index Open to any visitor 128 78 50 Login only 4 1 3 Trust centers 132 79 53 Data as of 2 October 2026. ## What trust centers show, by peer group ### SOC 2 report Most open first: Public download, then NDA click-through, then Request form, Login and Contact us at the same level, then Not listed. Value All trust centers Cloud 100 BVP index Public download 5 3 2 NDA click-through 7 4 3 Request form 86 56 30 Login 9 1 8 Contact us 7 3 4 Not listed 9 4 5 Recorded 123 71 52 Not recorded 9 8 1 ### Subprocessor list Most open first: Public, then Gated and Login at the same level, then Not listed. Value All trust centers Cloud 100 BVP index Public 48 36 12 Gated 28 16 12 Login 1 0 1 Not listed 39 19 20 Recorded 116 71 45 Not recorded 16 8 8 ### Pen test results Most open first: Public, then Public summary, then Gated and Login at the same level, then Not listed. Value All trust centers Cloud 100 BVP index Public 1 0 1 Public summary 5 2 3 Gated 65 42 23 Login 1 0 1 Not listed 46 27 19 Recorded 118 71 47 Not recorded 14 8 6 ### Security questionnaire Most open first: Public, then Gated and Login at the same level, then Not listed. Value All trust centers Cloud 100 BVP index Public 6 3 3 Gated 56 34 22 Login 1 0 1 Not listed 50 31 19 Recorded 113 68 45 Not recorded 19 11 8 ### AI section Most open first: Yes, then No. Value All trust centers Cloud 100 BVP index Yes 72 46 26 No 57 31 26 Recorded 129 77 52 Not recorded 3 2 1 ## Frameworks named by 5 or more trust centers Framework All trust centers Cloud 100 BVP index SOC 2 (any type) 120 73 47 ISO 27001 109 67 42 GDPR 75 51 24 CCPA 60 41 19 HIPAA 55 33 22 PCI DSS 54 29 25 ISO 27017 51 22 29 ISO 27018 44 19 25 CSA STAR 43 19 24 ISO 27701 43 27 16 SOC 1 39 18 21 ISO 42001 38 26 12 SOC 3 38 18 20 FedRAMP (any level) 33 11 22 TISAX 25 8 17 Cyber Essentials 24 11 13 C5 20 7 13 IRAP 18 4 14 DORA 14 7 7 ISO 9001 12 6 6 GovRAMP 11 3 8 HITRUST 10 3 7 EU AI Act 9 6 3 CMMC 5 1 4 ## Trust centers with open items ### Public SOC 2 download (5) - [BrowserStack](https://www.browserstack.com/trust) - [Dynatrace](https://trust.dynatrace.com/) - [OneTrust](https://www.onetrust.com/trust/) - [Rippling](https://trust.rippling.com/) - [SPS Commerce](https://trust.spscommerce.com/) ### Pen test results, full report (1) - [HubSpot](https://trust.hubspot.com/) ### Pen test results, public summary (5) - [Atlassian](https://customertrust.atlassian.com/) - [Gitlab](https://trust.gitlab.com/) - [OneTrust](https://www.onetrust.com/trust/) - [Rippling](https://trust.rippling.com/) - [SPS Commerce](https://trust.spscommerce.com/) ### Public security questionnaire (6) - [Calendly](https://public-profile.whistic.com/761120cf-454b-4c02-9483-f079882608a0) - [Figma](https://compliance.figma.com/) - [HubSpot](https://trust.hubspot.com/) - [OneTrust](https://www.onetrust.com/trust/) - [Workiva](https://www.workiva.com/security) - [Zapier](https://trust.zapier.com/) ## What each item is ### SOC 2 report A SOC 2 report is the audit report a CPA firm issues on a company's security controls. Buyers ask for it first because it shows what the auditor tested. A framework badge on a trust center is the company's own statement. ### Subprocessor list A subprocessor list names the third parties that handle customer data on the company's behalf. Privacy teams check it against the data processing agreement. ### Pen test results Pen test results show what an outside tester found and what the company fixed. A trust center can show the full report or a short summary. ### Security questionnaire A security questionnaire such as the CAIQ or SIG is a standard set of questions about a company's controls. A completed copy on the trust center saves the buyer's team a round of back and forth. ### AI section An AI section describes how the company uses AI and how customer data is handled in it. It is the newest item buyers ask about. ## Frequently asked questions - Should the SOC 2 report be public? A public download is rare. 5 of the 114 trust centers that show SOC 2 access offer one, and 86 use a request form. The report shows what the auditor tested, so buyers ask for it either way. - What is a subprocessor list? It names the third parties that handle customer data for the company. 48 of 132 trust centers show it openly, 29 put it behind a request or a login, and 39 do not list one. - Do Cloud 100 companies gate more than BVP index companies? On subprocessor lists they gate less. 36 of 71 Cloud 100 trust centers with a recorded subprocessor value show the list openly, against 12 of 45 in the BVP index. For SOC 2 reports the two groups look alike: 3 of 71 Cloud 100 trust centers with a recorded SOC 2 value offer a public download, and 2 of 52 in the BVP index. - Which frameworks do trust centers name most? SOC 2 in any type is named on 120 of 132 trust centers and ISO 27001 on 109. HIPAA follows on 55 and PCI DSS on 54. [Trust center census of 161 cloud companies](https://theauditrail.com/research/trust-centers/) ยท [Download the data as CSV](https://theauditrail.com/research/trust-centers.csv)