Prepare your Trust Profile for buyers

How to fill in your Trust Profile so a buyer's security, privacy and procurement review can rely on it, by hand or with your AI agent.

Before you start

• Open your own public pages: security or trust page, privacy policy, sub-processor list, terms, pricing and status page. Everything on the profile should be something one of them says.
• Decide who answers what. Security answers belong to whoever owns security; privacy answers to whoever owns privacy.
• If you will use an AI agent, create an agent key first (below). It can do every step except proving your domain.

Fill it in the order buyers read it

1. Who you are: name, what you do in one line, website, headquarters, founding date, founders and team size.
2. Security: where to report a vulnerability, sign-in methods, encryption, penetration tests and their dates, and the certifications you hold.
3. Privacy: your privacy notice, who your privacy contact is, the data you process and the legal bases.
4. Sub-processors: every service that touches customer data, what for and where.
5. AI: the AI features you ship, the models behind them and whether customer data trains them.
6. Commercial terms: pricing, contracts, procurement contacts and the documents a buyer asks for.
7. Links and pictures: logo, cover, status page, documentation and social profiles.

Say what you do not publish

A blank reads as an omission. When you do not publish something, or it does not apply to you, say so with a short reason. Buyers trust an honest "not published" far more than a guess, and Trooth never shows one as the other.

Let your AI agent do it

1. In your workspace, open API keys, Agent keys and create an agent key. Choose Read and write, or Read, write and publish to let it put the page live.
2. Give the key to your agent (Claude, ChatGPT, Codex or your own) and paste the request shown with it.
3. The agent follows the agent guide: it reads your pages, sets each field with the page it came from, answers what you do not publish, and tells you what only you can do.
4. Every change it makes is in your workspace's activity record, with its source. You can revoke the key at any time.

Prove your domain, then publish

A page goes on the Network only for a domain someone has proved they control. Publish the DNS record Trooth gives you, press Check now, then publish (or let your agent publish).

Keep it current

When a policy, a sub-processor or a certification changes, change the profile the same day, or ask your agent to re-read your pages and update it. Buyers who follow your profile see each change with its date.