01
Connect what you already run
Read-only connections to your cloud, identity provider, laptops, code and HR system. Fifteen minutes, mostly spent finding who has the admin password.
Built, hosted and audited in the EU
Compliance, minus the dread.
Trusterio watches the systems you already run, so your evidence collects itself. Your controls get tested against what your cloud actually reports — and your customers stop emailing you spreadsheets.
Fourteen days of the whole product. No card, no sales call.
Reads fourteen systems you already pay for. Read-only, always. It never writes to any of them.
- AWS
- Azure
- Entra ID
- Google Workspace
- GitHub
- Okta
- Intune
- Jamf
- Kandji
- Jira
- Slack
- Personio
- HiBob
- BambooHR
How it works
Four steps, and three of them are ours
Most compliance tools ask you to describe your security in a form. This one goes and looks at it, and keeps looking.
02
Let the evidence collect itself
Every control is tested against what those systems actually report — every day, not every audit. A control nobody has checked recently says so, right beside its own status.
03
Fix the handful that need a person
What is left is a short list with names and dates on it. A risk you reduced on paper stays at its full score until something actually backs it up.
04
Let customers check for themselves
Publish a Trust Center. Approve document requests in one click, watermark what you send, and see who read what — without a questionnaire round trip.
Why anyone believes it
The good bit: it will tell you no
Anybody can generate a policy. What a security reviewer actually wants to know is whether you would notice if it were wrong. Four things Trusterio will not let you do:
A claim your systems contradict cannot be published
Say your data never leaves the EU while a bucket in us-east-1 is being read, and the publish is refused — not warned about.
A control nobody tested does not count as passing
Untested is unknown. It lowers your score and says why, rather than quietly rounding up to something nicer.
Answers are quoted, never invented
Your Trust Center answers a visitor only with sentences you have published. The drafting assistant is checked against its own sources before anybody sees a word.
Removing access is confirmed by observing it
Every adapter is read-only, so pressing “revoke” has revoked nothing. The task stays open until a later reading reports the account gone.
Trust Center
The page that ends the security review
Give customers, their auditors and their procurement teams one place to check your security — and to ask for the documents that are not public. Most of them never email you at all.
- Certifications, policies, subprocessors and security statements on one page.
- Gated documents released per request, watermarked, with every download recorded.
- A changelog derived from what was actually published — including what was withdrawn.
- Answers quoted from what you have published, never generated.
trust.northwind.com
trust.northwind.com
Coverage
Do the work once. Count it everywhere.
One set of controls, mapped across every framework you need. The second certification is not a second year of work — it is mostly the same evidence, already collected.
- ISO/IEC 27001
- ISO/IEC 42001
- SOC 2
- GDPR
- NIS2
- DORA
- EU AI Act
And the rest of it
Not just a checklist with a logo
The parts of compliance that usually live in three different spreadsheets, in the same place as the evidence that backs them.
A risk register that argues back
Reduce a risk on paper and it stays at its inherent score until the control behind it is actually passing.
Your Article 30 record, kept honest
The GDPR record of processing, checked against what your Trust Center claims you hold.
Leavers who are actually gone
Read from your HR system, checked against every account, and not closed until a later reading agrees.
Pricing
One package. One price.
The whole product for one business, and a price for every business after it. Everything is included from day one — there is no tier where the useful feature lives.
Running more than one company? Each extra business has a price of its own, and you see the amount before you press anything.
Included, always
- Unlimited people
- Every framework
- Trust Center on your own domain
- Every adapter
- Questionnaire drafting
What does Trusterio do?
Trusterio is a compliance platform for European companies. It connects to the systems you already run, collects evidence from them continuously, tracks your controls against frameworks like ISO 27001 and NIS2, and publishes a Trust Center where your customers can review your security and request your documents.
What is a Trust Center?
A Trust Center is a public page where a company publishes its security, privacy and compliance information — certifications, policies, subprocessors, and the documents a prospective customer asks for during a security review. It replaces the spreadsheet-and-email cycle that a procurement review usually becomes.
Where is our data stored?
In the European Union. Trusterio runs on EU infrastructure and the data residency policy is enforced in the database rather than promised in a document: a residency claim that the running configuration contradicts cannot be published.
Which frameworks does it cover?
ISO/IEC 27001, ISO/IEC 42001, SOC 2, the GDPR, NIS2, DORA and the EU AI Act. Controls map to requirements across frameworks, so evidence collected once counts everywhere it applies.
How is evidence collected?
Through read-only connections to the systems you already use — AWS, Azure, Entra ID, Google Workspace, GitHub, Okta, Intune, Jamf, Kandji, Jira, Slack and your HR system. Trusterio reads; it never changes anything in them.
Does Trusterio use our data to train models?
No. The assistant that drafts policies and questionnaire answers runs locally against your own records, and every draft is checked against its sources before anybody sees it. Nothing leaves the deployment to train anything.
What does it cost?
One package at one price, covering one business. Every additional business you add — a subsidiary, a second brand, a separate legal entity — is charged separately, and the price is shown before you add it.
Fourteen days. The whole thing.
No card, no sales call, no demo you have to sit through. Your data stays in the EU.