Trust Exchange
Publish your security posture once, share it with every buyer who asks — the public vendor graph reframed from a monitoring tool into a distribution channel for vendor trust.
What it is
Trust Exchange — in detail.
Trust Exchange inverts the TPRM questionnaire problem. Instead of answering the same 300-question spreadsheet for every customer who asks, vendors claim their TrustVendor profile, upload their security posture documents once, and control who sees what. A vendor can make their SOC 2 summary and subprocessor list publicly accessible on the graph, while requiring NDA acceptance before releasing the full Type II report. Buyers who have accepted the NDA access the report directly from the vendor's Trust Exchange profile — no email thread, no shared Dropbox folder, no manual version tracking.
The vendor graph underneath Trust Exchange is not a questionnaire database — it is an agent-produced evidence graph. When a vendor claims their profile, TrustVendor's Extractor agents have typically already assembled it from public sources: trust centre, subprocessor list, certificate transparency logs, and regulatory disclosures. The vendor's job is to verify what the agents found, correct what they got wrong, and layer on NDA-gated materials the agents could not reach. Corrections feed back into the extraction eval harness — improving accuracy for every future extraction of similar content.
For buyers, Trust Exchange means less time chasing vendors for documents and more time on the evidence those documents contain. When a vendor uploads a new SOC 2, the Extractor agent processes it within hours, produces span-cited claims, and propagates score updates to every workspace that monitors that vendor. The buyer does not need to manually review the report — they review the agent-produced diff: what changed, what the agent found, and whether any exceptions surfaced.
How it works
Three steps,
fully auditable.
Vendors claim their profile by verifying domain ownership via DNS TXT record or email confirmation to a registrant address. The identity resolver matches the claim against the existing agent-produced profile — vendors can see what the agents already know before they upload anything.
Upload documents and configure visibility: public (anyone), authenticated (TrustVendor account), or NDA-gated (buyers who have accepted your DPA or NDA template). Uploaded documents run through the same extraction pipeline as public sources — every claim is span-cited with the agent version that produced it.
Buyers in your customers' workspaces access gated materials directly from the Trust Exchange profile. When you publish an updated SOC 2, every workspace monitoring you receives an agent-produced diff within hours — no manual notification required.
What you get
Built for teams that
have to prove things.
Publish once, share many
One upload satisfies every inbound due-diligence request. Visibility controls let you make some documents public and restrict others to buyers who have accepted your NDA — all managed from the vendor portal without involving your sales or legal team for each request.
Agent-verified profile baseline
Before you upload anything, TrustVendor's agents have typically already assembled your profile from public sources. Verify what they found, correct errors, and layer on gated materials — you start from evidence, not a blank form.
Automatic diff propagation
When you publish a new document, agent-produced diffs propagate to every workspace monitoring you within hours. Your customers see what changed and whether any exceptions surfaced — without any manual notification from you.
What the agents will never do
Agent guarantees,
in plain terms.
Agents produce claims, never numbers. Scoring is deterministic Go arithmetic over those claims — models never run in the scoring path.
Every claim cites a hashed, immutable snapshot span. No claim is written to the database without an artifact_id and a validated quote hash.
Extractor agents are prompt-versioned. Every claim records the prompt file, model, and schema version that produced it. A regression is a rollback, not a data loss.
The Analyst agent's system prompt forbids it from asserting a fact it cannot cite. Warnings surface in the response envelope when tool results are incomplete — the answer is never silently filtered.
Sample
What it looks
like in practice.
Common questions
Answered plainly.
Is Trust Exchange free for vendors?
How does the NDA gating work technically?
What happens to the agent-produced profile we had before claiming it?
Can we restrict which of our customers can see our profile?
How does Trust Exchange help with questionnaire fatigue?
See it live
Trust Exchange
on your vendors.
Book a 30-minute demo. We’ll run it live on vendors from your register — not demo data.