Trust center benchmark
86 of 132 trust centers put the SOC 2 report behind a request form.
Your trust center
Trust centers in the census
| Access level | All trust centers | Cloud 100 | BVP index |
|---|---|---|---|
| Open to any visitor | 128 | 78 | 50 |
| Login only | 4 | 1 | 3 |
| Trust centers | 132 | 79 | 53 |
Data as of 2 October 2026.
What trust centers show, by peer group
SOC 2 report
Most open first: Public download, then NDA click-through, then Request form, Login and Contact us at the same level, then Not listed.
| Value | All trust centers | Cloud 100 | BVP index |
|---|---|---|---|
| Public download | 5 | 3 | 2 |
| NDA click-through | 7 | 4 | 3 |
| Request form | 86 | 56 | 30 |
| Login | 9 | 1 | 8 |
| Contact us | 7 | 3 | 4 |
| Not listed | 9 | 4 | 5 |
| Recorded | 123 | 71 | 52 |
| Not recorded | 9 | 8 | 1 |
Subprocessor list
Most open first: Public, then Gated and Login at the same level, then Not listed.
| Value | All trust centers | Cloud 100 | BVP index |
|---|---|---|---|
| Public | 48 | 36 | 12 |
| Gated | 28 | 16 | 12 |
| Login | 1 | 0 | 1 |
| Not listed | 39 | 19 | 20 |
| Recorded | 116 | 71 | 45 |
| Not recorded | 16 | 8 | 8 |
Pen test results
Most open first: Public, then Public summary, then Gated and Login at the same level, then Not listed.
| Value | All trust centers | Cloud 100 | BVP index |
|---|---|---|---|
| Public | 1 | 0 | 1 |
| Public summary | 5 | 2 | 3 |
| Gated | 65 | 42 | 23 |
| Login | 1 | 0 | 1 |
| Not listed | 46 | 27 | 19 |
| Recorded | 118 | 71 | 47 |
| Not recorded | 14 | 8 | 6 |
Security questionnaire
Most open first: Public, then Gated and Login at the same level, then Not listed.
| Value | All trust centers | Cloud 100 | BVP index |
|---|---|---|---|
| Public | 6 | 3 | 3 |
| Gated | 56 | 34 | 22 |
| Login | 1 | 0 | 1 |
| Not listed | 50 | 31 | 19 |
| Recorded | 113 | 68 | 45 |
| Not recorded | 19 | 11 | 8 |
AI section
Most open first: Yes, then No.
| Value | All trust centers | Cloud 100 | BVP index |
|---|---|---|---|
| Yes | 72 | 46 | 26 |
| No | 57 | 31 | 26 |
| Recorded | 129 | 77 | 52 |
| Not recorded | 3 | 2 | 1 |
Frameworks named by 5 or more trust centers
| Framework | All trust centers | Cloud 100 | BVP index |
|---|---|---|---|
| SOC 2 (any type) | 120 | 73 | 47 |
| ISO 27001 | 109 | 67 | 42 |
| GDPR | 75 | 51 | 24 |
| CCPA | 60 | 41 | 19 |
| HIPAA | 55 | 33 | 22 |
| PCI DSS | 54 | 29 | 25 |
| ISO 27017 | 51 | 22 | 29 |
| ISO 27018 | 44 | 19 | 25 |
| CSA STAR | 43 | 19 | 24 |
| ISO 27701 | 43 | 27 | 16 |
| SOC 1 | 39 | 18 | 21 |
| ISO 42001 | 38 | 26 | 12 |
| SOC 3 | 38 | 18 | 20 |
| FedRAMP (any level) | 33 | 11 | 22 |
| TISAX | 25 | 8 | 17 |
| Cyber Essentials | 24 | 11 | 13 |
| C5 | 20 | 7 | 13 |
| IRAP | 18 | 4 | 14 |
| DORA | 14 | 7 | 7 |
| ISO 9001 | 12 | 6 | 6 |
| GovRAMP | 11 | 3 | 8 |
| HITRUST | 10 | 3 | 7 |
| EU AI Act | 9 | 6 | 3 |
| CMMC | 5 | 1 | 4 |
Trust centers with open items
What each item is
SOC 2 report
A SOC 2 report is the audit report a CPA firm issues on a company's security controls. Buyers ask for it first because it shows what the auditor tested. A framework badge on a trust center is the company's own statement.
Subprocessor list
A subprocessor list names the third parties that handle customer data on the company's behalf. Privacy teams check it against the data processing agreement.
Pen test results
Pen test results show what an outside tester found and what the company fixed. A trust center can show the full report or a short summary.
Security questionnaire
A security questionnaire such as the CAIQ or SIG is a standard set of questions about a company's controls. A completed copy on the trust center saves the buyer's team a round of back and forth.
AI section
An AI section describes how the company uses AI and how customer data is handled in it. It is the newest item buyers ask about.
Frequently asked questions
-
Should the SOC 2 report be public?
A public download is rare. 5 of the 114 trust centers that show SOC 2 access offer one, and 86 use a request form. The report shows what the auditor tested, so buyers ask for it either way.
-
What is a subprocessor list?
It names the third parties that handle customer data for the company. 48 of 132 trust centers show it openly, 29 put it behind a request or a login, and 39 do not list one.
-
Do Cloud 100 companies gate more than BVP index companies?
On subprocessor lists they gate less. 36 of 71 Cloud 100 trust centers with a recorded subprocessor value show the list openly, against 12 of 45 in the BVP index. For SOC 2 reports the two groups look alike: 3 of 71 Cloud 100 trust centers with a recorded SOC 2 value offer a public download, and 2 of 52 in the BVP index.
-
Which frameworks do trust centers name most?
SOC 2 in any type is named on 120 of 132 trust centers and ISO 27001 on 109. HIPAA follows on 55 and PCI DSS on 54.
Trust center census of 161 cloud companies · Download the data as CSV