Fewer questionnaires, more measured trust.
The management statement, the security grade and the availability of the platform on one page your CISO can consult directly. The figures come from checks that run every night. Your auditor downloads the evidence as a file set, and your organisation publishes its own trust page for its customers from the same environment.
From now to next
From a questionnaire by email to a page that is always current
The usual routine in vendor assessment: a spreadsheet with a hundred questions, an answer that is months old, and a report that gets requested all over again the following year. And your own customers send you exactly the same list.
The questionnaire is filled in and sent
The answer describes the situation on the day it was written. Whatever happens afterwards surfaces at the next round.
The status is there, refreshed every day
The checks run automatically, the outcome is on the page, and the date of the latest assessment sits next to it.
A pass rate without weight
Ninety-nine percent sounds reassuring, even when the single open finding happens to be the serious one.
A grade weighted by severity
The grade starts at a hundred and deducts points by the severity of what is open. One serious finding weighs more than ten small ones, and the arithmetic is shown underneath.
The auditor copies evidence off the screen
Expanding the script per control, copying the output and building a report by hand. Weeks of work for a file nobody can verify.
One ZIP with the whole evidence file
The auditor selects controls and components and downloads scripts, output, results and a run report, with a checksum per file.
Your own customers ask you the same thing
What you have set up for ISO 27001 and NIS2 goes out as an attachment to every customer who asks. Every attachment starts ageing the day it is sent.
A trust page you publish yourself
You choose which components are visible and publish a dated snapshot, behind a link or an access code. A card can be embedded on your own website.
This is what it looks like
A selection from Trust Center
Click a thumbnail for that screen, or the image itself for the full-size view.
The domains
What the platform is checked on, continuously
The controls are grouped into domains that follow the ISAE 3000 criteria, extended with the requirements that apply to AI functionality.
Security
Access, hardening, encryption and the monitoring around them, with their own grade and trend.
Privacy and integrity
Data protection, the separation between organisations, and the accuracy of what is processed.
Availability
Uptime per service, backups and recovery, measured rather than promised.
AI governance
The requirements of the AI Act for the AI functionality in the suite, including the sub-processors involved.
What the Trust Center offers
Transparency you can verify
A transparency portal is only worth something when the reader can see where a figure comes from, what it does not say, and can take the evidence away.
A statement from management, with its scope
What management states about the design and operation of the controls, and which applications and shared services do and do not fall under that statement.
A grade that explains itself
The security grade starts at a hundred and deducts points by severity. Beneath the card sit the unweighted pass rate of the same run, what could not be measured and which risk management has knowingly accepted.
Every assessment round a point on the graph
A dip is visible, and so is the recovery after it. You read the development over the months rather than a single snapshot.
Controls per domain
From AI governance and privacy to confidentiality, data integrity and availability, each control showing the measure and the type of check. Searchable, and printable.
Availability per app
Measured uptime over ninety days, broken down per service, from the same monitoring that raises the outage alerts.
Release governance
Which gate an app passes before it may reach production, who takes that decision, and how the chain is recorded.
The evidence file as a ZIP
Your auditor selects controls and components and downloads one ZIP: per control the description, the verification script, the raw output and the results, with a run report that keeps passed, failed, not tested and accepted risk apart.
Your own trust page
Publish a snapshot of your ISO 27001 and NIS2 status, your policies and statements at your own address. Behind a link or an access code, with an authenticity check and an embeddable card for your website.
How it works
From question to evidence in six steps
Start with the statement
What management states about the controls, the control environment they operate in, and which applications the statement covers.
Read the security grade
The grade with its passed and failed checks, the unweighted pass rate next to it, what could not be measured and which risk was knowingly accepted.
Walk through the controls per domain
The status per domain, and the measure behind each control. An auditor also sees the test method, the evidence and the source script.
Check availability and release governance
Uptime per app over ninety days, and the gate a change passes before it reaches you.
Download the evidence file
The auditor sets the scope, everything or one domain or a custom selection, and receives one ZIP with a run report and checksums.
Publish your own trust page
Your organisation's administrator chooses components, address and access, reviews a preview and confirms. Before the expiry date a reminder prompts republishing.
Frequently asked questions
What you want to know about the Trust Center in advance
What is the Trust Center?
The Trust Center is Audirium's transparency portal. It shows the management statement on the controls, a risk-weighted security grade, the controls per domain, uptime per application and the release governance of the platform. The data comes from automated checks that run every night, with the date of the latest assessment shown alongside.
Who is the Trust Center for?
For the CISO, the buyer and the auditor of an organisation that needs to establish whether Audirium is in control as a vendor. A reader sees the description and status per control, an auditor additionally sees the test results and the evidence. Administrators of a customer organisation also use the Trust Center to publish their own trust page.
What does the Trust Center actually do?
It shows the management statement with its scope, calculates a security grade weighted by severity and explains that arithmetic, gives the status of the controls per domain, measures uptime per application over ninety days, and lets an auditor download the evidence file as a ZIP. Customers publish a snapshot of their own framework status from it.
How does the Trust Center differ from a security questionnaire or a pdf report?
A questionnaire describes the day it was completed and a report the day it was exported. The Trust Center shows the outcome of checks that run again every night, with the date attached and the arithmetic under the grade. An open finding weighs more the more serious it is, and whatever could not be measured is listed separately.
How do I request a data processing agreement, penetration test report or security questionnaire?
At the bottom of the Trust Center sits a request form with the options data processing agreement, penetration test report, security questionnaire, architecture question and other. The request is recorded and handled by an Audirium administrator; you receive a confirmation. Documents covered by confidentiality are shared once the request has been assessed.
What about data and hosting?
The platform runs on an Audirium server in the European Union (Hetzner), with a separate database per organisation. The Trust Center only reads the monitoring data and never writes to it. A trust page published by your organisation is a frozen snapshot: the public page never reads live from your organisation's database.
Who it is for
For the CISO, the buyer and the auditor in your organisation
For everyone who has to establish whether a vendor is in control, and would rather look for themselves than wait for a report. And for the organisation that wants to offer its own customers the same.
Read only: the Trust Center writes nowhere. The platform status comes from monitoring, your own trust page from a frozen snapshot you publish yourself.
Portable: the controls are printable, and an auditor downloads the complete evidence file as a ZIP with checksums for their own file.
Bilingual: the page, the request form and the explanations follow your language choice, Dutch or English.
Alongside Docs: the Trust Center shows the evidence, the documentation environment describes the design behind it.
The Trust Center at a glance
Would you like to see the platform status yourself?
Customers and their assessors are granted access on request. If you want a trust page of your own for your customers, we set it up together with you.