What Is a Trust Centre? Vendor Evidence vs Office Settings

Search for "trust center" and you get two unrelated things sitting on the same results page. One is a dialog box inside Microsoft Word or Excel where you manage macro settings and privacy options. The other is a public web page, often hosted on Vanta, SAP's own domain, or Microsoft's compliance properties, where a company lists its SOC 2 reports, ISO certificates, subprocessors and data residency. A buyer doing vendor due diligence who lands on the wrong one wastes an afternoon. This article separates the two uses, then shows what a well-built vendor trust centre actually links to versus what is just copy written by marketing.

The Microsoft Office Trust Center is a settings menu inside desktop applications. It controls macro security, add-in permissions, privacy options and protected view. It has nothing to do with whether Microsoft as a company holds a SOC 2 report or an ISO 27001 certificate. The confusion exists because Microsoft used the same phrase for an internal settings panel and, separately, for a public-facing compliance hub that documents the company's own certifications and audits. The second one is what buyers mean when they ask a vendor "do you have a trust centre" during a security review.

What a vendor trust centre is built to do

A vendor trust centre, in the B2B security sense, is a page or set of pages that collects a company's compliance posture in one place: framework badges, downloadable reports behind an NDA gate, subprocessor lists, data residency notes and sometimes a status page link. The intent is to reduce the back-and-forth of a security questionnaire by publishing what can be published and gating what cannot. Done well, it saves both sides days. Done badly, it is a single page of logos with no way to confirm any of them, which is worse than no page at all because it looks like evidence.

What is Microsoft trust center

Microsoft runs a genuine compliance hub, distinct from the Office settings dialog, that documents certifications, audit reports and regulatory commitments across its cloud services. It links out to the Microsoft Service Trust Portal for downloadable audit reports under NDA, and to separate pages for specific frameworks. The useful test for any page calling itself a trust centre, Microsoft's included, is whether a given claim resolves to a primary source: a certificate number you can check with the issuing body, a report you can actually request, or a registry entry with a status and a date.

Microsoft Trust Center is your destination for information about Microsoft's approach to security, privacy, compliance, and transparency across our cloud products and services.
— Microsoft Trust Center

That sentence is accurate and also entirely marketing language. It describes intent, not evidence. The evidence sits one or two clicks deeper, in the certification lists, the audit report requests and the regional compliance pages. The same pattern repeats on almost every vendor trust centre: a front page of positioning text, and a second layer where the checkable material actually lives.

Diagram contrasting a vendor trust centre evidence hub with the Microsoft Office Trust Center settings menu — Two unrelated things share a name: a settings dialog in Office apps, and a vendor's public compliance hub.

What is Vanta trust center

Vanta is a compliance automation platform that, among other things, hosts trust centre pages on behalf of its customers. When a company's trust centre sits on a Vanta subdomain or is clearly Vanta-branded, it usually follows a predictable layout: a row of framework badges across the top, a request-access flow for gated reports such as SOC 2, and a subprocessor table lower down. The structure is consistent because Vanta built it, which is genuinely useful for buyers who review many vendors, since the second trust centre you read is much faster than the first. For more on how the platform itself works, see the Vanta compliance platform profile.

Consistency of layout is not the same as consistency of evidence quality. A Vanta-hosted page can show eleven frameworks across the top row and still have several of them resting on a badge with no linked document behind it. The platform renders what the vendor has uploaded or connected; it does not independently verify that a HIPAA claim has a signed Business Associate Agreement behind it, or that a Data Privacy Framework listing is still active rather than lapsed. Reading the page structure correctly matters more than reading the badges.

What is SAP trust center

SAP's trust centre is a vendor-built page rather than a platform template, and it covers a wide product portfolio, which makes it structurally different from a single-product SaaS trust centre. It groups information by product line and region because SAP's certifications vary by which cloud service and data centre a customer actually uses. A certificate that applies to SAP S/4HANA Cloud in one region does not automatically apply to a different SAP product hosted elsewhere. The practical lesson for buyers is to check which specific product and region a badge covers before assuming it applies to the contract being signed, a problem that is less common on single-product trust centres but still worth confirming.

Marketing text versus verifiable evidence

Every trust centre mixes two kinds of content: statements about intent and links to primary sources. The table below is a rough guide to which sections of a typical trust centre usually fall into which category, and what to do about each one.

Trust centre section	What it typically shows	How to verify it
SOC 2 badge or logo	A mark implying the vendor holds a SOC 2 report	Request the actual report and check the report type, period and auditor opinion
ISO 27001 certificate	A PDF or scan from the certification body	Confirm the edition is 2022 and the certificate is within its three year cycle
HIPAA badge	A shield or tick with no linked document	Ask for the signed Business Associate Agreement, not the badge
DPF listing	A logo linking to the vendor's own marketing page	Check the live entry on the Data Privacy Framework registry
FedRAMP badge	A logo, sometimes left over from an older status	Check the FedRAMP Marketplace for the current label
Subprocessor list	A table of sub-vendors, locations and purposes	Compare the list date against the data processing agreement
Pentest summary	A paragraph describing a test with no date or scope	Ask for the test date, methodology and remediation status

Trust centre sections rated by how easily a claim can be checked against a primary source.

Note that any badge implying a formal certification for SOC 2 is a red flag on its own. SOC 2 is a report produced by an auditor, not a certificate issued by a scheme, so that kind of language is inaccurate regardless of who writes it. If you want the mechanics of reading the real document, the companion piece on how to read a trust centre walks through the page layout, and a separate explainer covers why "SOC 2 certified" does not exist in more detail.

Anatomy of a well-built trust centre

1
A framework row with dates, not just logos
Each badge should carry an issue date or a validity window, not just an icon. A logo with no date tells you nothing about whether it still applies.
2
A request flow for gated reports
SOC 2 reports and penetration test summaries are normally restricted. A proper trust centre has a working request form that actually delivers the document, usually under NDA.
3
A subprocessor list with a visible update date
Sub-processor tables go stale. A page that cannot say when the list was last reviewed is less useful than one that can.
4
Links to primary registries, not just self-hosted pages
DPF status, FedRAMP status and PCI DSS validation all live on third-party registries. A trust centre that links to those registries rather than restating the claim in its own words is doing the harder, more honest work.
5
A change log or status history
Certificates lapse, frameworks get dropped, and audits move from Type I to Type II. A dated history of those changes is rare, and its presence is a good signal.

Intercom's trust centre, hosted on Vanta, is a useful page to study because it shows both ends of that spectrum on one screen. Look at how the HIPAA row is presented compared with the Data Privacy Framework listing and the public subprocessor list: one rests on a badge, the others resolve to a document or a registry entry you can check independently. The card below pulls the vendor's current public status rather than a description we wrote in prose, so read it as a live example of the pattern rather than a fixed snapshot.

Intercom · Trust report

Customer support · Public evidence as of 26 Oct 2026

Visit trust centre Full evidence

Framework overview

CertReports state for each framework with public evidence: 1 verified, 10 vendor-stated.

2 more frameworks on the evidence page

2Documents and agreements

Legal and review documents Intercom publishes or offers, as of 30 Sep 2026.

Subprocessor list · Public
Privacy policy · Public

1Security practices

Public statements from Intercom, shown as statements, not attestations, as of 30 Sep 2026.

Penetration testing · annual

14Subprocessors

Named on Intercom's public subprocessor list, last seen 30 Sep 2026.

Intercom's Vanta-hosted trust centre mixes badge-level claims with links to checkable sources across eleven frameworks. Every line is a dated public record from the Data Privacy Framework list and Intercom's trust centre. A framework not shown means no public evidence was found, not that Intercom lacks it.CertReports

A five-minute read before you trust the badges

Open the trust centre and list every framework badge shown, including HIPAA, GDPR and any regional scheme.
For each SOC 2 or ISO badge, find the linked document or request form. If there is none, treat the badge as a claim, not evidence.
Check the subprocessor list date against today. Anything older than a few months deserves a question in your next call.
Cross-check any DPF, FedRAMP or PCI DSS claim against the relevant public registry rather than the vendor's own restatement of it.
Note what is missing. A vendor handling health data with no HIPAA mention at all is a gap worth raising directly.

Flowchart showing which trust centre sections link to verifiable registries versus marketing copy — Badges without a linked document or registry entry should be treated as a claim, not as proof.

31 Oct 2025
ISO 27001:2013 certificates lapsed: Certificates must now cite the 2022 edition under IAF MD 26; 4 Jul 2026
FedRAMP Certified became the official label: Under the Consolidated Rules for 2026; Ready became legacy on 28 July 2026; Eleven
Frameworks shown on Intercom's Vanta-hosted trust centre: In the CertReports index on 2026-10-28

Dates matter more than logos

A trust centre badge with no date attached is close to useless. Certificates expire, DPF listings lapse, and report periods close. If the page cannot tell you when a claim was last true, request the underlying document before you rely on it in a vendor questionnaire.

The same discipline applies to subprocessor tables. A long list of sub-vendors with no review date is common, and the guide on how to check a vendor's subprocessor list covers what a current list should include and how to compare it against the contract you actually signed. The same logic applies to DPF status, which lapses without warning and without the vendor necessarily updating its own badge on the same day.

Where this leaves a buyer

A trust centre, whether built on Vanta, hosted by SAP directly, or run by Microsoft, is a starting point, not a finished answer. Treat the front page as an index of claims to check, not a substitute for checking them. The Microsoft Office Trust Center, by contrast, is an unrelated settings menu inside desktop applications and has no bearing on a vendor security review at all. If a colleague asks you to check a supplier's trust centre before a contract renewal, the fastest route is to open the page, ignore the badges for thirty seconds, and go straight to whichever links resolve to a primary source: a registry, a certificate number, or a request form that actually sends a document.