What Is a Security Trust Center? A Guide for Crypto Firms
Quick answer. A security trust center is a public page showing your security and compliance posture, with sensitive reports like SOC 2 released on request. Crypto firms selling to institutions should have one: it answers the same diligence questions once.
Video transcript
Every bank, fund and exchange that onboards you will ask for security evidence. A trust center answers it once, in one place.
A trust center shows your security and compliance posture in two layers. Certifications and control summaries are public. Sensitive reports are gated, often behind an NDA.
Institutions want evidence they can file. US banks may review SOC reports, and under DORA, EU firms look for independent audit reports, so publish scope with every report.
Crypto buyers ask more. Link each audit to the auditor's copy, with its date and commit. Show pentest retest status, your custody model, and what onchain monitoring watches.
Attackers read it too. Keep full pentest reports private, never name signers, hold back network diagrams and the SOC 2 report itself. And aligned is not certified.
A stale page signals an unmaintained program. Date every item, update on triggers like a new audit or chain, track expiry, and list open risks with an owner.
Some platforms show live control status. For crypto, live should reach onchain: is monitoring running, and does deployed code still match its audits?
Guardian's Managed Security includes a hosted trust center. Behind it, Guardian monitors your contracts on every block, runs Helix across your stack and manages your bug bounty.
Read the full guide, or talk to Guardian at guardian.security about a trust center buyers can verify.
Every bank, fund and exchange that onboards you will ask for security evidence, usually through a questionnaire.
A trust center answers once, in one place. Buyers see your posture before they ask, and request the sensitive documents through a controlled process.
For a crypto firm, the page also has to cover what generic templates skip: keys, contracts and onchain monitoring.
What a Trust Center Is
A trust center is a page, often run on a dedicated platform, that publishes your security and compliance posture. It has two layers:
- Public: an overview, the certifications held and summaries of your controls.
- Gated: reports a buyer requests, often after signing an NDA.
Vendors describe their products this way:
| Vendor | How it describes its trust center |
|---|---|
| Vanta | "A branded, always-current home for your security docs, live controls, and AI-powered answers" |
| Drata (SafeBase) | "One secure place to review your security posture, request documents" and get answers |
| Conveyor | "The Agentic Trust Center", for customer self-service |
Vanta says its product "automates access approvals and NDAs." That gate is the core feature: public by default, sensitive on request.
Two crypto examples: Fireblocks' and Kraken's trust centers are both built on SafeBase by Drata. Both list SOC 2 Type 2, ISO/IEC 27001:2022 and CCSS, and put reports behind a "Get access" request.
What Institutions Look For
Institutions want evidence they can file, not claims. Their guidance names the kinds they may rely on.
- US banks: 2023 interagency guidance says a bank "may consider reviewing" SOC reports and independent certifications.
- EU financial firms: DORA's Delegated Regulation 2024/1773 lists "independent audit reports" and "appropriate third-party certifications" for due diligence on ICT providers.
The US guidance adds a test: whether "the scope and the results" are relevant to the activity. So publish scope with every report.
Crypto buyers then ask who can move assets, how keys are recovered and which audits match deployed code. Our vendor due diligence questionnaire lists those questions.
What to Publish
Split each section into what anyone can see and what a vetted buyer can request.
| Section | Public | Gated, on request |
|---|---|---|
| Compliance status | SOC 2 type and period, ISO 27001 scope and expiry, CCSS level | The SOC 2 report, the certificate |
| Smart contract audits | Each audit, its date and commit, linked to the auditor's copy | Fix review notes, if not public |
| Pentests | Scope, test date, retest status | The full report |
| Bug bounty and disclosure | Program link, rewards, security.txt | Nothing; keep it open |
| Key management | Custody model, signing thresholds, timelocks | Ceremony records, a dated recovery test |
| Onchain monitoring | What is watched, response commitment | Detection coverage map |
| Incident history | Past incidents, linked post-mortems, status page | Full incident timelines |
| Subprocessors | The current list | Contract terms |
Three sections need care.
Audits
Link each audit to the auditor's own copy, not a PDF on your site. Buyers will check it against deployed code; see how to check if a contract is really audited.
Disclosure
RFC 9116 defines security.txt, a file at /.well-known/ that helps researchers report vulnerabilities. It must carry a Contact and an Expires field.
NIST CSF 2.0 has a matching outcome, ID.RA-08: "Processes for receiving, analyzing, and responding to vulnerability disclosures are established."
Subprocessors
Under GDPR Article 28(2), a processor needs the controller's prior specific or general written authorization to engage another processor.
Under a general authorization, it must inform the controller of intended changes, so the controller can object.
A published, dated list is one way to keep customers informed. Fireblocks' trust center lists its subprocessors.
What Not to Publish
Attackers read your trust center too. Keep these off the public page:
- Full pentest reports, and any finding not yet fixed.
- Signer names, their devices, and where key shares or backups are stored.
- Network diagrams, internal hostnames and incident runbooks.
- The SOC 2 report itself. Its use is "generally" restricted; a SOC 3's is not.
- Status claims you cannot back. "Aligned" is not "certified".
Signers are a target in their own right. See social engineering of multisig signers.
Keeping It Current
A stale trust center tells a buyer the program is not maintained.
- Date every item, and state its scope and period.
- Update on triggers: a new audit, an upgrade, a new chain, an incident or a new vendor.
- Track expiry: the SOC 2 period end and the ISO certificate date.
- List open risks with an owner, not only closed ones.
Some platforms show live control status. Vanta, for example, offers "continuous, real-time evidence of your active controls."
For a crypto firm, "live" should also reach onchain: whether monitoring is running and whether deployed code still matches its audits.
How Guardian Helps
Guardian's Managed Security comes with a hosted trust center and the technical evidence regulators ask for under DORA, MiCA, the GENIUS Act, VARA and NYDFS.
The trust center shows the status of your controls, monitoring, audits and disclosures.
Behind it, Guardian monitors your contracts on every block, runs Helix across your stack and manages your bug bounty.
Guardian's Technical Evidence is delivered "as a pack or a trust center page, scoped to its reader": a supervisor, an exchange listing team, a bank partner or an allocator.
Every artifact carries its scope and the commit or date it was produced at. Questionnaires are answered from the same evidence, so every answer agrees.
Frequently Asked Questions
What is a security trust center?
A page where a company shows its security and compliance posture and lets buyers request gated documents, such as a SOC 2 report. Vendors including Vanta, Drata (SafeBase) and Conveyor sell platforms to run one.
Does my crypto company need a trust center?
If you sell to banks, funds or enterprises, yes: it answers the same diligence once, with dated evidence. Before that, a security page with your audits, a disclosure contact and your compliance status covers the basics.
Should a SOC 2 report be public?
No. Use of a SOC 2 report is generally restricted, so firms release it on request, often under NDA. A SOC 3 is not restricted. State the SOC 2 type and period publicly.
What should a crypto trust center include beyond SOC 2?
Smart contract audits linked to the auditor's copy, pentest summaries with retest status, a bug bounty and disclosure contact, a key management statement, onchain monitoring scope, incident history and subprocessors.
Sources
- Vanta: Trust Center software (accessed November 6, 2026)
- Drata: Trust Center, home page (accessed November 6, 2026)
- Conveyor: The Agentic Trust Center, home page (accessed November 6, 2026)
- Fireblocks: Security and Trust Center (accessed November 6, 2026)
- Kraken: Trust Center (accessed November 6, 2026)
- Federal Register: Interagency Guidance on Third-Party Relationships: Risk Management, 88 FR 37920 (June 9, 2023)
- EUR-Lex: Commission Delegated Regulation (EU) 2024/1773, policy on ICT services supporting critical or important functions (March 13, 2024)
- Journal of Accountancy: Explaining the 3 faces of SOC (June 13, 2016, archived)
- IETF: RFC 9116, A File Format to Aid in Security Vulnerability Disclosure (April 2022)
- NIST: The NIST Cybersecurity Framework (CSF) 2.0, CSWP 29 (February 26, 2024)
- EUR-Lex: Regulation (EU) 2016/679, General Data Protection Regulation, Article 28 (April 27, 2016)
- Guardian: Managed Security
- Guardian: Regulatory & Compliance
Publish a trust center buyers can verify
Guardian Managed Security comes with a hosted trust center, backed by 24/7 monitoring, current audits and evidence scoped to each reader.