figma guide
Designing trust center and security documentation UI in Figma: certifications, policies, and request workflows
Design trust center and security documentation UI in Figma with certification badges, policy libraries, NDA-gated downloads, security questionnaire responses, and subprocessors lists.
- Published
- Updated
- Jul 28, 2026
- Read time
- 10 min
- Level
- Intermediate
Quick answer
Trust center and security documentation UI is how B2B SaaS proves credibility before the sales security review—certifications, policies, subprocessors, and gated document access without email ping-pong. Design a public trust hub with certification badges and high-level security narrative; a document library with NDA-gated downloads (SOC 2, pen test summaries); a subprocessor registry with change notifications; and a security questionnaire response portal for enterprise prospects. Start from the Figma guides hub and pair with security posture dashboard, SLA reporting, privacy settings, vendor risk, and Dev Mode handoff.
Who this is for
- Product designers building public trust centers, security portals, and sales-enablement compliance pages.
- Design system teams aligning certification badges, document cards, and gated-access modals with badges, cards, and forms.
- Security, legal, and sales engineering teams implementing NDA workflows, document versioning, and questionnaire automation.
Trust center hub (public)
TrustCenter — trust.acme.com · Last updated 2026-07-15
├── Hero: Security at Acme · SOC 2 Type II · ISO 27001 · GDPR · HIPAA ready
├── Quick links: [ Request docs ] [ View subprocessors ] [ Status page ] [ SLA portal ]
├── Sections: Certifications · Policies · Infrastructure · Privacy · Contact
├── Certifications row: SOC 2 badge · ISO badge · PCI DSS · FedRAMP in progress
├── CTA: Enterprise security review · [ Start questionnaire ] [ Request SOC 2 report ]
└── Footer: security@acme.com · Bug bounty link · [security posture internal link hidden]| Section | Purpose |
|---|---|
| Certifications | Current attestations with issue/expiry dates |
| Policies | Public summaries; full PDFs gated |
| Infrastructure | High-level architecture diagram (sanitized) |
| Privacy | DPA, subprocessor policy, data residency |
| Contact | Security inbox, escalation for active incidents |
| Live status | Link to customer status page |
Verdict: Trust center is marketing-safe truth—every badge and date must sync with internal security posture dashboard or Legal will block publish.
Certification badges and attestation cards
Certifications — Current attestations
├── SOC 2 Type II · Issued 2026-03-01 · Period Oct 2025–Sep 2026 · [ Request report ]
├── ISO 27001 · Issued 2025-11-20 · Surveillance due 2026-11 · [ View certificate PDF ]
├── PCI DSS SAQ-A · Valid 2026-06-30 · [ Summary only — no full AOC public ]
├── HIPAA · BAA available · Not a certification badge — link to BAA request
├── FedRAMP · In progress · Status: 3PAO assessment scheduled Q4 2026
└── Expired hidden: SOC 2 Type I (2024) · Archive only in admin| Badge state | UI treatment |
|---|---|
| Active | Full-color badge; issue and expiry dates |
| In progress | Outlined badge; “In progress” chip; no false claim |
| Expired | Removed from public; admin archive with redirect note |
| Summary only | Public one-pager; full report behind NDA |
| BAA / contractual | Not a cert badge—separate “Available on request” card |
Use badge components with variants: active, in-progress, summary-only.
Never show expired certifications on public hub—design admin publish gate that blocks stale dates.
Document library (public + gated)
DocumentLibrary — Security documentation
├── Public (no login):
│ ├── Security whitepaper v4.2 · PDF · Updated 2026-05-01
│ ├── Pen test executive summary · PDF · Updated 2026-04-10
│ └── Architecture overview · PDF · Sanitized · Updated 2026-06-01
├── Gated (NDA required):
│ ├── SOC 2 Type II report · PDF · Oct 2025–Sep 2026 period
│ ├── Full pen test report · PDF · Redacted findings
│ ├── SIG Lite questionnaire (pre-filled) · XLSX
│ └── Data processing agreement template · DOCX
├── Request flow: [ Select documents ] → NDA e-sign → Instant download link (72h)
└── Admin: Version history · Download audit · Revoke link| Document type | Access tier |
|---|---|
| Whitepaper / summary | Public download |
| SOC 2 / ISO full reports | NDA + verified email domain |
| Pen test full report | NDA + sales opportunity ID optional |
| Pre-filled questionnaire | NDA + account executive approval |
| DPA / BAA | Contract stage; may require login |
Gated flow uses modals for NDA acceptance and forms for company name, role, and intended use.
Log every download in audit log—enterprise customers ask who accessed their data room.
Subprocessor registry
Subprocessors — Last updated 2026-07-01 · Subscribe to changes
├── Table: Name · Purpose · Location · DPA status · Added date
├── Row: AWS · Cloud hosting · US, EU · DPA ✓ · 2019-01-01
├── Row: Stripe · Payments · US · DPA ✓ · 2020-06-15
├── Row: SendGrid · Email delivery · US · DPA ✓ · 2021-03-01
├── Row: NewCo Analytics · Product analytics · US · DPA pending · 2026-06-28 · NEW badge
├── Change log: 2026-06-28 Added NewCo Analytics · 30-day notice policy
└── [ Download CSV ] [ RSS/Atom feed ] [ Email subscribe ]| Column | Handoff detail |
|---|---|
| Name | Legal entity; link to vendor site |
| Purpose | Data categories processed |
| Location | Primary processing region |
| DPA status | Signed / pending / not required |
| Added date | Triggers customer notification if policy requires |
| Change type | Added, removed, purpose change |
Cross-link internal vendor risk assessments—public list is a subset of approved vendors only.
Design change notification subscribe using notification preferences patterns.
Security questionnaire response portal
QuestionnairePortal — Enterprise prospect workflow
├── Start: [ Upload customer questionnaire ] [ Use pre-filled SIG Lite ] [ Answer custom form ]
├── Upload: vendor-security-questionnaire.xlsx · 847 questions detected
├── Auto-fill: 612 matched from knowledge base · 235 need human review
├── Review queue:
│ ├── Q14 Encryption at rest · Auto: AES-256 · Source: whitepaper v4.2 · [ Edit ]
│ ├── Q89 Subprocessor list · Auto: link to registry · [ Edit ]
│ └── Q401 Custom integration security · Needs review · Assigned: security@acme.com
├── Export: [ Download completed XLSX ] [ PDF summary for customer ]
└── SLA: Standard 5 business days · Expedited 48h (sales approved)| Feature | UI pattern |
|---|---|
| Upload parser | Drag-drop file upload; format detection |
| Knowledge base match | Confidence score; source document link |
| Human review queue | Assignee, due date, tables sort |
| Answer versioning | When whitepaper updates, flag stale answers |
| Export formats | Customer’s original template filled |
| Access control | Sales + security roles; prospect never sees internal queue |
Pair with security questionnaires vendor onboarding for symmetric UX when Acme is the vendor under review.
Policy library and acceptance tracking
PolicyLibrary — Public summaries · Full docs gated or in-app
├── Information Security Policy · Summary public · Full PDF gated
├── Acceptable Use Policy · Public PDF
├── Incident Response Policy · Summary only · Detail in SOC 2 report
├── Data Retention Policy · Public summary · Links [data retention admin](/designing-data-retention-policies-and-auto-deletion-ui-in-figma/)
├── Privacy Policy · Public · Link [privacy settings UI](/designing-privacy-settings-and-data-management-ui-in-figma/)
└── Employee acceptance (internal): 98% current · Not shown on public trust center| Policy type | Public visibility |
|---|---|
| Privacy / Terms | Fully public; version date prominent |
| Security policy | Summary public; detail gated |
| Internal-only | Never on trust center; employee portal only |
| Version history | Public “last updated” date; archive on request |
Design policy version bump workflow—when Legal publishes v5, trust center admin gets review task before go-live.
Enterprise security review request form
SecurityReviewRequest — Start enterprise review
├── Company: Globex Corp · Domain: globex.com · Verified ✓
├── Contact: Jane Doe · CISO · jane@globex.com
├── Request type: [ ] SOC 2 report [x] Questionnaire help [ ] Architecture call [ ] Custom
├── Documents needed: SOC 2, pen test summary, subprocessor list
├── NDA: [ ] Use Acme standard [x] Upload customer paper NDA (Legal review)
├── Timeline: Standard · Notes: RFP due 2026-08-15
├── Assignment: Auto-route to security@ + AE Sarah Chen
└── Status tracker (customer view): Submitted → NDA signed → In progress → DeliveredUse progress stepper for customer-facing status—reduces “just checking in” emails to sales.
Comparison: trust center vs internal posture dashboard
| Dimension | Public trust center | Internal posture dashboard |
|---|---|---|
| Audience | Prospects, customers, auditors (limited) | Security, GRC, leadership |
| Detail level | Sanitized summaries | Full control status, gaps |
| Certifications | Active badges only | Including in-progress, expired, gaps |
| Documents | Gated downloads | All evidence, raw findings |
| Updates | Marketing + Legal approval | Real-time from control tests |
| Subprocessors | Published list | Full vendor risk scores |
One content management admin should push approved snippets from internal to public—avoid duplicate manual entry.
Handoff checklist (Dev Mode)
- Certification object — type, issuer, issue date, expiry, public visibility enum.
- Document object — version, access tier, file hash, watermark template.
- NDA flow — e-sign provider webhook; link expiry (72h default).
- Subprocessor row — notification trigger on add/change/remove.
- Questionnaire parser — supported formats; max file size; PII warning.
- Knowledge base answer — source doc ID, last verified date, confidence.
- Download audit — user, IP, document version, timestamp.
- Publish gate — Legal approval flag before trust center changes go live.
- Accessibility — badge images have alt text; document list keyboard navigable.
Common mistakes
| Mistake | Why it hurts | Fix |
|---|---|---|
| Expired SOC 2 badge still public | False advertising; deal loss | Auto-hide on expiry; admin alert 60 days prior |
| SOC 2 full report public | Confidentiality breach | NDA gate + watermark + download audit |
| Stale subprocessor list | Customer contract violation | Sync from vendor registry; change notifications |
| Trust center ≠ posture dashboard | Sales quotes wrong control | CMS sync from internal source |
| Questionnaire answers without source | Wrong RFP response | Require source doc link on every auto-fill |
| No customer status link | Prospects check uptime separately | Prominent link to status page |
| HIPAA shown as “certified” | Legal exposure | ”BAA available” wording, not badge |
| Missing pen test date | Customers assume annual | Show assessment date and scope summary |
| NDA paper upload with no SLA | Deal stalls | Legal review queue with 48h internal SLA |
| Architecture diagram too detailed | Attack surface leak | Sanitized template; security review before publish |
Recommended workflow
- Design public trust hub with certification cards, policy summaries, and clear CTAs.
- Build document library with public/gated tiers and NDA e-sign flow.
- Create subprocessor registry with change log and subscribe notifications.
- Spec questionnaire portal with upload, auto-fill, review queue, and export.
- Add enterprise review request form with customer-visible status stepper.
- Wire admin publish gate syncing from security posture dashboard.
FAQ
Trust center vs security posture dashboard?
Trust center is the customer-facing storefront for security credibility. Posture dashboard is internal control health—design a one-way publish flow from internal to public.
Link to SLA portal?
Yes—enterprise buyers expect uptime commitments near security docs. Add “SLA & uptime” quick link; methodology doc lives in trust center, metrics in customer portal.
Subprocessor list vs vendor risk?
Vendor risk is internal scoring and assessments. Subprocessor registry is the legal disclosure list—subset only, no risk scores public.
During active incident?
Trust center hero can show banner link to status page—do not hide ongoing incident. Optional: pause questionnaire SLA message.
Custom customer NDAs?
Design upload + Legal queue path—do not auto-approve non-standard paper. Show “Legal review in progress” to customer.
Next steps
- Design SLA dashboard and uptime reporting UI in Figma — uptime methodology docs and customer portal
- Design security posture dashboard and compliance checklist UI in Figma — internal source for public badges
- Design customer incident status page and communication UI in Figma — live status link from trust hub
- Design vendor risk assessment and third-party security reviews UI in Figma — internal vendor data feeds subprocessors
- Design privacy settings and data management UI in Figma — privacy policy and DPA cross-links
§ Keep reading