Current public security, privacy, governance and accessibility evidence is available here directly. Controlled and customer-specific artifacts may require an approved access process — but public evidence is never withheld to capture a lead.
Every record answers the same five questions before it asks anything of you: what is this, what does it cover, how current is it, who owns it, and what does it not prove?
Control summary · Security
Describes approved control domains and their status. It is not a certification, a penetration-test result, or evidence about your configuration.
Architecture summary · Security
Topology, addresses, credentials, and tenant-level configuration are excluded by policy. A public-safe summary only.
Policy / principle · Privacy
States a binding product boundary. It is not a legal compliance conclusion for your jurisdiction.
Assurance artifact · Security
Currency and scope are being re-evaluated. No exploitable detail is published, and no current test result is implied.
Assurance artifact · Security
Contains detail that is not approved for public disclosure. No preview of restricted content is shown, and no issuer name or logo appears without current verified evidence.
Accessibility artifact · Accessibility
Conformance is stated per journey and platform, with known limitations published. It is not a platform-wide claim.
Contractual resource · Procurement
Questionnaire responses are engagement-specific and are never published as a searchable answer set. Routed through the approved procurement pathway.
Correction notice · Security
The positive claim has been removed from evidence listings, search, and structured data. This neutral withdrawal notice remains for transparency.
Operational record · Reliability
System Status is authoritative for live operational state. It is not a substitute for security evidence, and security evidence never overrides it.
Default results prioritize current public items. Superseded and withdrawn records are excluded from current listings and from structured data. Search covers approved public metadata only — search terms are never captured in analytics or routed to sales.
Access level and status are different axes. A record can be Public and Under Review at the same time, and neither implies the other.
| Status | Meaning | Required public behaviour |
|---|---|---|
| Current | Approved evidence is current for the displayed scope. | Show scope, owner, relevant dates, and limitations. |
| Under review | Currency or scope is being re-evaluated. | Do not present as current. Explain that review is ongoing. |
| Superseded | A newer approved version replaces this one. | Show the replacement; remove from default current results. |
| Withdrawn | The artifact or claim is no longer public or current. | Remove the positive claim; show a neutral withdrawal notice where approved. |
| Expired | The validity or effective period has ended. | Never usable as current assurance. |
| Unavailable / cannot verify | The current state cannot be verified. | Say so, or suppress the claim. Never default to a positive status. |
A public evidence record proves only what its stated type, scope, period, method or authority, status, and limitations support. “Current” does not mean globally secure, compliant with every law, suitable for every deployment, or effective in every customer configuration.
Not withheld to create friction — withheld because publishing it would itself create risk, or because it belongs to a specific engagement.
| Evidence class | Public treatment | What must never happen |
|---|---|---|
| Security overview | Open public summary with scope and review date. | Turning a summary into a certification or penetration-test claim. |
| High-level control domains | Approved descriptions and status only. | Exposing sensitive configurations, rules, thresholds, or secrets. |
| Independent assurance | Exact verified name, scope, period, and status — only when current. | A logo without evidence, or a scope broader than the report supports. |
| Penetration / security testing | Approved approach or public summary only. | Exploitable detail, or implying a current test when the summary is stale. |
| Architecture / data flow | Public-safe summary. | Restricted topology, addresses, credentials, tenant or customer data. |
| Internal policies | Public only where specifically approved. | Accidental document indexing. |
| Questionnaire responses | Not public — engagement-specific. | A searchable public answer dump. |
| Incident-specific evidence | Governed through status and support. | Routing live incident detail through a marketing Trust Center. |
| DPA / subprocessors | Routed to their existing legal and privacy authorities. | Duplicating a stale legal list on Security or the Trust Center. |
The governing rule: never a blank directory, never a default-green card, and never a fallback to a sales form.
“Public evidence is temporarily unavailable. Security information and related Trust pages remain available.” With retry, plus Security, Status, and Help routes.
Never a blank directory or default-green cards.
Explain that the item is unavailable or moved, and show the current replacement where one is approved.
Never a bare 404, and never an unrelated substitute document.
Show the review-due or under-review status and the current limitation.
Never a “Current” badge held indefinitely.
Show the replacement and preserve history where governance permits; remove withdrawn claims from positive listings.
Never let a stale claim persist in cache or schema.
Public evidence stays usable; the request route shows as unavailable with existing support and procurement fallbacks.
Never email confidential files as an insecure workaround.
Trust content, evidence metadata, links, and public files are server-rendered and remain usable.
Public evidence is never hidden behind a client-only application.
The Trust Center points at these rather than restating them, so a claim has exactly one home.
Control domains, shared responsibility, and the review route.
Categories, purposes, retention, and worker rights.
Where consequential decision authority sits.
Authority classes and the deterministic boundary.
Tested scope, methods, and known limitations.
Authoritative live operational state.
Contractual resources and evaluation support.
For existing customers. Sales never substitutes for support.
Controlled and customer-specific artifacts require an approved access process — identity, purpose, and entitlement — because of what they contain, not because of the sales opportunity. Public evidence above stays open either way.
Get Demo
No. Public evidence is available in the Trust Center without submitting a security-review form, and without an account, login, or chat gate. Controlled and customer-specific artifacts may require an approved access process — but public evidence is never withheld to capture a lead.
