A maintained trust centre for suppliers who are not software companies. Host your policies and standards, show what your documents cover, and keep it current, so you answer the same questions once.
Free tier with an uncapped standard NDA flow. No card required.
Documented controls covering our people, systems and suppliers.
How it works
Upload the policies, standards and certificates that show your posture. Your documents stay your own.
Map your documents to the areas buyers expect. Each area is covered by a named document or it is not.
Send buyers a maintained page instead of answering each questionnaire from scratch.
Coverage is a named document or a gap. Never a percentage, grade or rating.
We present what your documents establish. We do not monitor live systems or imply we do.
Uncovered areas are shown neutrally, never hidden and never alarmed.
Data held in the EU (Ireland), with defined retention and deletion.
How approvals work
A contributor adds or updates a document. It stays in draft and is never visible on your trust page.
The document is reviewed and approved before it can be published. A single admin can do this, or you can require a different person to approve, whichever suits your team.
Only after approval does the document appear on your public page, with a full audit trail of who did what and when.
You choose whether a distinct approver is required (separation of duties). Recommended for regulated teams; a single admin can approve and publish when you prefer.
When they ask anyway
A page answers most of it. For the rest, a buyer sends their questions from your trust centre instead of a spreadsheet, and you answer once.
Each question comes back with a proposed answer and the document it rests on. A question your published evidence cannot support comes back marked not answered, with the reason. Never a guess that reads well.
You approve, rewrite or refuse each answer, and release the set when you are ready. The draft is a starting point; the answer is yours.
Publish an answer you are happy with and the next buyer reads it on the page instead of asking. The pile shrinks rather than repeating.
What the buyer takes away
A reviewer’s job does not end on your page. It ends in their third-party register, their report, or their own tooling.
A buyer who has signed can take a dated snapshot of your posture: what is covered, what is not, your certifications and subprocessors. It comes as a readable summary or as data. Every document listed with a fingerprint they can check against the file they hold.
Buyers increasingly send software, not people. Your public posture is machine-readable as it stands; for anything gated, an agent asks, you approve, and it gets a key with an expiry date that you can revoke. Every use lands on your trail like any other visitor.
Evaluations are a moment, not a standing arrangement, so agent access expires by default rather than lasting until somebody remembers to remove it.
Multi-user with roles: admins, contributors and reviewers, so the right people do the right things. Admin actions are recorded.
Who accepted which NDA version, when and from where; who viewed and downloaded what. The part a buyer's reviewer actually inspects, and we never tier it away.
Turn on a requirement for the actions that change what the world can see: publishing, access, the team, deletion. Turn it on when your people are ready for it. Your organisation decides; we do not decide for you.
Pricing
Prices in GBP, exclude VAT. Plus and Managed are billed annually.
Sign up with your work email. A trust page represents a company, so personal addresses (gmail, outlook, icloud…) aren't supported.
Pricing
Anything software-only and static is free or cheap. Anything requiring curation, judgement or ongoing maintenance is paid.
| Free | Plus | Managed | |
|---|---|---|---|
| Your page | |||
| A real trust page, publicly readable | Included | Included | Included |
| Your own domain | Not included | Included | Included |
| Confidentiality agreement, ready to use We provide the standard text, so your gate works from the first minute. | Included | Included | Included |
| Buyers accepting it Never metered. Being read is the point of the page. | Unlimited | Unlimited | Unlimited |
| Agreements in your own wording Managed can hold several, so different material can carry different terms. | Not included | 1 | 5 |
| Access requests and grants | Included | Included | Included |
| Subprocessor list | Included | Included | Included |
| Full audit trail Never tiered away. It is the part a reviewer inspects. | Included | Included | Included |
| What a buyer can do | |||
| Send you questions from the page, and read your answers | Included | Included | Included |
| Take a dated evidence record for their register | Included | Included | Included |
| Read your published posture with their AI agent What you publish openly is open to anyone, and to any agent. That is what publishing means. | Included | Included | Included |
| A key that opens your gated evidence to their AI agent You approve each one, it expires, and you can revoke it. Managed, because a standing key needs a queue behind it. | Not included | Not included | Included |
| Running it as a team | |||
| Colleagues, with roles | Included | Included | Included |
| Require two-factor for privileged actions A security control should not be behind a paywall. | Included | Included | Included |
| A second person must approve before publishing Separation of duties. Optional per page. | Not included | Not included | Included |
| Coverage and currency | |||
| Coverage checklist you map yourself Declared: taken on your word. | Not included | Included | Included |
| Coverage checked against your own documents Assessed: each area names the document behind it. | Not included | Not included | Included |
| Kept-current mark, and prompts when something is due | Not included | Not included | Included |
| Answers drafted from your published evidence You approve, rewrite or refuse each one. Nothing goes back until you release it. | Not included | Included | Included |
A buyer’s real question is not whether you have a policy. It is who checked. Your page says which of these each area rests on, so nobody has to guess, and so you are never credited with more than you asked for.
You say it, and your page says plainly that it was you. Honest, immediate, and worth what a supplier’s own word is worth. Every plan.
Each area names the document behind it, and that document is on the page. A buyer can follow the claim to the paper without asking you for anything. Managed.
We ask for proof that the thing your documents describe actually happens, and we report what we saw. An annual engagement, quoted below.
A full internal audit of your management system. Separate work, separate scope, separate report, under its own agreement.
Levels 3 and 4 are people’s time rather than a setting, so they are scoped, quoted and scheduled, and they run under an agreement of their own.
Available with any plan. Each one is work done by people, so each starts with a conversation rather than a checkout.
Level 3
We ask for proof that what your documents describe actually happens: the last four access reviews, not the policy that promises them.
Annual engagement, scoped and quoted. Talk to us
Level 3, larger scope
Larger document sets are validated on the same basis, priced for the size of the set.
Quoted per engagement. Talk to us
Level 4
A full internal audit of your management system, which for most organisations is an obligation they already carry and often postpone.
Quoted per engagement. Talk to us
Prices in GBP, exclude VAT. Plus and Managed are billed annually. Paid plans complete payment right after you create your account. Plan content is illustrative and will be confirmed.
Contact
Questions about VitroVault, or a concern about a trust page hosted with us? Email our team and we will respond promptly. If your message is about a specific page, please include its address.