Trust Center - Documentation & Security Controls
Use this section to provide a clear, concise summary of your organisation’s security practices. Sprinto generates an initial overview that you can keep or replace with your own text.
Each time you edit and save the overview, Sprinto creates a new version. You can assign different versions to different Trust Center profiles as needed.
Compliance
List all compliance standards your organisation has achieved or is currently pursuing. This helps customers verify your alignment with recognised global security frameworks.
Trusted By
Showcase key customers who use your products or services. This strengthens trust by demonstrating that reputable organisations rely on your security and controls.
Policies
Policies formalise your organisation’s information security practices. They are a core component of your Trust Center and are often required for security audits.
Sprinto automatically imports relevant security policies from your account. You can also upload additional policies that sit outside Sprinto’s compliance modules.
Documents
Upload any security-related documents that support your Trust Center. These help customers understand your security posture and processes.
Network Diagram
Shows how components in your infrastructure interact. Used for maintenance, security review, and compliance.
Penetration Test Report (Pentest Report)
Provides findings from penetration testing activities. Always upload the most recent report.
Security Whitepaper
A high-level document explaining your security model, threat landscape, and mitigation strategies.
Vulnerability Assessment Report
Lists vulnerabilities identified during a scan, their severity, and recommended remediation steps. Demonstrates diligence in vulnerability management.
Legal Requirements
Upload or link to documentation required for legal, contractual, or regulatory purposes.
Terms of Service
Defines the agreement between your organisation and its users.
Master Services Agreement (MSA)
Provides the framework that governs all current and future engagements.
Privacy Policy
Explains how customer data is collected, used, stored, and protected.
Business Associate Agreement (BAA)
Required when working with Protected Health Information (PHI) under frameworks such as HIPAA.
Data Processing Agreement (DPA)
Defines the relationship between a data controller and a data processor. Required under several compliance frameworks.
Product Security
Describe the processes and controls used to build and maintain a secure product.
Role-Based Access Control (RBAC)
Assigns permissions based on a user’s role. Example roles include: Administrator, Information Security Officer, and Employee.
Audit Logging
Records user and system activity to support anomaly detection and forensic analysis. Logs are centralised in a SIEM and monitored regularly.
Data Security
Provide an overview of how your organisation safeguards data throughout its lifecycle.
Typical measures include:
Annual independent audits
Internal risk and privacy assessments
Regular penetration testing and vulnerability scanning
Encryption of sensitive data at rest and in transit
Firewalls with a deny-all default
MFA and RBAC for all sensitive systems
Centralised logging with alerting
Timely patching and updates
Integrations
List the integrations your organisation supports to help users streamline workflows across systems. Examples: Zoho, HubSpot, Salesforce.
Service Level Agreement (SLA)
Explain your service commitments, including availability and responsibilities. Include a link to your SLA if available.
Single Sign-On (SSO)
List all SSO mechanisms your product supports (for example, OAuth and SAML). SSO improves security and simplifies user access.
Team Management
Describe how your product manages internal teams, permissions, and administrative roles.
Data Security — Operational Controls
Explain the operational controls that protect customer data.
Access Monitoring
Describe the systems used to monitor access and enforce least-privilege principles. Examples include AWS GuardDuty, CloudTrail, CloudWatch, and Kibana.
Backups Enabled
Explain your backup frequency, retention, and recovery processes.
Encryption at Rest
Describe encryption standards, such as AES-256, and key management via services like AWS KMS.
Encryption in Transit
Describe encryption protocols used for data transmission, such as HTTPS with TLS/SSL.
Physical Security
Outline the physical protections applied by your cloud provider and your organisation.
Network Security
List the controls used to protect systems from network-based threats.
Data Loss Prevention (DLP)
Protects data from unauthorised exfiltration.
Firewall
Describe the firewall used and how it filters traffic.
IDS/IPS
Detail the intrusion detection and prevention capabilities in place.
Spoofing Protection
Describe email and network spoofing controls, such as SPF, DKIM, and anti-DDoS.
Virtual Private Cloud (VPC)
Explain your hosting architecture, including cloud regions.
Wireless Security
Describe VPN or secure wireless policies.
Application Security
Explain the processes and tools used to ensure secure software development.
Bug Bounty / Responsible Disclosure
Describe your policy for reporting vulnerabilities.
Code Analysis (SAST)
Explain tools and processes used for static code analysis.
Secure Software Development Life Cycle (SDLC)
Describe how secure coding and testing practices are embedded into development workflows.
Credential Management
Explain how secrets are stored and rotated securely (for example, AWS KMS).
Vulnerability and Patch Management
Describe how vulnerabilities are identified, prioritised, and resolved.
Web Application Firewall (WAF)
Explain how your WAF filters and blocks malicious traffic.
Endpoint Security
Outline the controls applied to endpoint devices used by employees.
Disk Encryption
Describe the encryption tools and standards used for employee devices.
Mobile Device Management (MDM)
Explain how devices are provisioned, secured, and remotely managed.
DNS Filtering
Describe tools used to block malicious domains.
Threat Detection
Outline endpoint detection capabilities and threat classification.
Endpoint Detection and Response (EDR)
Explain how devices are monitored continuously for malicious behaviour.
Corporate Security
Describe internal controls, employee responsibilities, and organisational safeguards.
Email Protection
List email protections such as spam filtering, phishing analysis, SPF/DKIM/DMARC.
Employee Training
Describe mandatory security and privacy training requirements.
Incident Response
Outline your incident response framework, including identification, containment, and remediation.
Internal Assessments
Describe periodic risk assessments and their ownership.
Mobile Device Management (Admin)
Explain administrative controls for issuing and managing devices.
Single Sign-On (Internal)
Detail internal SSO requirements for employee access to systems.
Trust Center Updates
Use this section to publish updates on security changes, incidents, remediation actions, or general trust communications. Regular updates demonstrate transparency and strengthen customer trust.
Last updated