Skip to content

Trust Center

Trust center guides: publish your compliance proof as public, verifiable pages — certificates, declarations, and audit documents that buyers can check without emailing PDFs.

Scroll to the footer of any ten small-business websites and count the legal pages. You'll usually find a privacy policy. Sometimes terms. Rarely a cookie policy that matches the cookies actually loaded. Almost never a data processing agreement or an accessibility statement — the two pages that lose deals and invite complaints.

The footer is the least loved part of a website, and it's where liability quietly lives. This post covers the full set; the next four go deep on each page.

We Run Our Compliance on Our Own Platform

Case studies are usually about customers. This one is about us, and that's why we can publish it without asking anyone's permission: Sustalium's own compliance runs on Sustalium. Our public Trust Hex is live at the same address our customers use, holding the same kind of assets we sell. Seven of them, from GDPR to the EU AI Act to our accessibility statement.

The Trust Hex: A Trust Center for Everything

The trust center was invented by SaaS companies. Someone at a security startup realised that buyers kept asking for the same SOC 2 report, the same penetration test, the same data processing details — and that publishing them on one page ended the email chain before it started. The idea spread until every serious software company had one.

What never happened is the same idea reaching everyone else. A furniture maker still emails certificates. A service agency still answers the same onboarding questionnaire every quarter. The trust-center lesson stayed stuck in software, and it didn't need to.

Publishing Your First Compliance Page

Most people assume publishing a compliance document means exporting a PDF and emailing it. There's a better output: a live page with a permanent URL and a QR code that shows the current version of your declaration to anyone who scans it. The publishing part takes under half an hour. This is the walkthrough, including the parts that honestly take longer.

Compliance Is Proof, Not Paperwork

For decades, compliance meant paperwork. Fill in the form. Print the certificate. Pin it to the wall. File the PDF. Email the attachment. Repeat annually.

A new category is replacing that model. It is called the Compliance Trust Center — and it changes not just how companies manage compliance, but what compliance means.

Compliance is no longer a document you file. It is proof you publish.

5 Compliance Docs Every Manufacturer Must Publish

A buyer requests a meeting. They're evaluating your product for a major retail contract. The first 20 minutes go well — your product meets their specs, your pricing is competitive, your delivery timelines are feasible.

Then they ask: "Can you send us your compliance documentation?"

If your answer involves a pause, a forwarded email, or the phrase "I'll get that from our regulatory team" — you have already lost points. Buyers who request compliance documents and receive them instantly, in a verifiable format, move to the top of the evaluation list. Buyers who promise to send PDFs later move to the bottom.

Here are the five compliance documents every manufacturer should have published online — as live, QR-verifiable pages — before their next buyer meeting.

How to Share an ISO 14001 Certificate

Your company earned ISO 14001 certification. The audit was rigorous. The environmental management system is real. The certificate is valid.

Now every customer, every buyer, and every procurement questionnaire asks you to prove it. And every time, you email the same PDF.

The certificate lives in a folder on your shared drive. It gets attached to emails, forwarded to procurement teams, uploaded to supplier portals, printed for the office wall. Somewhere along the way, someone forwards an expired version. Someone else asks "is this the current one?" Someone prints it and pins it to a corkboard where it fades in the sun.

This is not how a world-class certification should be shared. Here's how to fix it.

The QR Code on Your Product Is Your Best Salesperson

A customer stands in a store, holding two products. Same category. Similar price. One has a QR code on the label. The other doesn't.

They scan the QR code. A page loads. It shows the product's certifications — CE Marking, OEKO-TEX Standard 100, ISO 14001. It shows the country of origin, the material composition, the carbon footprint. Every claim on the packaging is backed by a document on the page, and every document carries a hashcode proving it hasn't been altered.

The customer puts down the other product. They buy the one with the QR code.

That QR code just did what no salesperson could do in 30 seconds: it proved every claim the brand made.

How B2B Buyers Verify Supplier Compliance

Ask any procurement manager how they verify supplier compliance today, and the answer is the same across every industry: "We email them and ask for their certificates."

Then the waiting begins. The supplier finds the PDF — hopefully the current version. They email it. The buyer files it in a shared drive, or a SharePoint folder, or their inbox. Six months later, when an auditor asks for proof of supplier compliance, someone searches for the attachment. It may have the wrong date, the wrong version, or both. So they email the supplier again.

This is not a process. It is a ritual — one that every procurement team performs and that every audit exposes as insufficient.