Why a security page speeds up procurement
When a larger company decides to buy your software, its security team usually has to approve you first. That review often starts with a long questionnaire. If your website says nothing about security, every question lands on your desk as new work, and the deal waits while you answer it.
A public security page changes where that review starts. The reviewer can read your answers before they send the questionnaire, and many of the basic questions are already settled by the time they do. Some reviewers will accept the page and a few documents in place of a full questionnaire. Others will still send one, but it comes back shorter and with fewer follow-ups.
The page only helps if the reviewer believes it. Security teams read vague promises like "bank-grade security" as a sign that the real answer is missing, so they ask anyway. Specific, plain answers do the opposite. "Customer data is stored in AWS in the United States and encrypted at rest" settles a question. So does "We don't offer single sign-on yet," because the reviewer can note it and move on.
Building the page well takes three kinds of work:
- collecting the facts your company can actually stand behind
- choosing the questions buyers ask most and answering each one plainly
- publishing the page where buyers will find it and keeping it accurate as things change
That's a good job for an AI marketer, because most of it is reading, sorting, and careful writing. Kite is an AI marketer. It researches your business, builds a growth strategy, and ships the work that brings you new customers. Here's how it builds a security page.
How Kite builds a security and trust page
Kite starts with what your company can prove. It reads the material you give it, such as past questionnaires, policies, and your certification details, and it saves the confirmed facts to your team's knowledge base. From there, it works out which questions buyers ask most often and plans a page that answers them in that order.
Kite then writes the page in plain language, builds it from your site's own sections, and saves it as a draft you can preview. Anything it couldn't confirm is marked for you to fill in. Once you approve the page, Kite publishes it, links it from your footer and other pages buyers visit, and starts measuring how it's used.
- Gather the facts you can stand behind
- Choose the questions buyers actually ask
- Write answers that don't overstate your compliance
- Build the page and publish it where buyers look
- Keep the page accurate and see whether buyers use it
Gather the facts you can stand behind
A security page is only as good as the facts behind it, so Kite collects those first. The fastest way to start is to give Kite the documents you already have. In the Kite web app, you can upload PDFs such as a completed security questionnaire, your privacy policy, an information security policy, or the summary letter from your SOC 2 audit. You can also share files with Kite in Slack.
Kite reads each document and pulls out the facts a buyer would care about. Those include where your data is hosted, how it's encrypted, how employees get access to customer data, how long you keep data after a customer leaves, and which outside companies process data on your behalf. It saves these facts to your knowledge base so the security page, your sales emails, and any future page all draw on the same answers.
Kite also reads your public website. It can see which analytics and marketing tools load on your pages, which helps when you list the third-party services a visitor's browser connects to. If it finds a fact on your site that conflicts with your documents, such as an old privacy policy that names a hosting provider you've since left, it asks you which one is correct.
Choose the questions buyers actually ask
A security page should answer the questions that come up in real reviews, in roughly the order a reviewer thinks about them. Kite looks at the questions that repeat across the questionnaires you've shared. If three different buyers asked whether you run annual penetration tests, that question belongs near the top of the page.
Kite can also read the security pages of your competitors and other companies that sell to the same buyers. That shows which topics your buyers have learned to expect and how much detail is normal for a company your size.
For most software companies, a useful security page covers these topics:
- certifications and audits, such as SOC 2 Type II or ISO 27001, with dates
- where customer data is hosted and in which regions
- encryption for data in transit and at rest
- how access to customer data is controlled, including single sign-on and two-factor login for your own staff
- the outside companies that process customer data, often called subprocessors
- how long data is kept and how a customer can have it deleted
- how you handle security incidents and how customers are told about one
- penetration testing and how outside researchers can report a vulnerability
- who to contact with security questions
Kite adapts that list to your business. A company that handles health records needs a section on how it treats that data. A small team selling to other startups may need a much shorter page. Kite explains which topics it chose and why, and you can add or remove any of them before it writes.
Write answers that don't overstate your compliance
A security page has to be accurate, because buyers treat it as a statement your company made. Kite names a compliance certification, such as SOC 2, HIPAA, ISO 27001, GDPR, or PCI DSS, only when you've told it you hold that certification or it appears in a document you provided. It doesn't add a badge or a certification name because similar companies show one.
When a fact is missing, Kite writes around it with language that stays true, or it leaves a clearly named placeholder in the text, such as "[Name of your cloud hosting provider]". It lists every placeholder in its message to you so nothing goes live unfinished. If your site already shows a compliance badge or customer logo that no document supports, Kite flags it and offers to remove it.
Kite also writes plainly about work in progress. If your SOC 2 audit is underway, the page can say so and say when you expect the report. A reviewer can work with "We expect our SOC 2 Type II report in March 2027." They can't work with a badge that implies you already have it.
The writing style matters too. Kite uses calm, specific sentences and keeps marketing language out of the security answers. Each answer starts with the direct response and then adds the detail a reviewer would want next.
Build the page and publish it where buyers look
Kite builds the security page from your website's own sections, so it matches the rest of the site. A typical page opens with a short summary of how you protect customer data, then answers each topic in its own section, and closes with a question-and-answer list for the smaller questions. On a site Kite hosts, it can store those questions in a list your team can edit in the site's content editor.
Many buyers want documents you don't want to post publicly, such as your full SOC 2 report or your latest penetration test summary. Kite can add a short request form to the page. On a site Kite hosts, each request is emailed to the addresses you choose and counted in your site analytics, so you can reply with the documents and see how often buyers ask.
Placement decides whether reviewers find the page at all. Kite adds a link in your site's footer, where buyers expect to find security and legal pages. It can also link the page from your pricing page and any enterprise or sales pages, because those are where a buyer starts to think about procurement. Kite adds a page title, description, and structured data, which helps search engines and AI answer engines understand what the page covers.
Kite saves the finished page as an unpublished change. You open a preview, check every answer, and fill in anything marked for you. When you approve it, Kite publishes the page and shares the live link. If your website runs on Webflow or Contentful, Kite builds the page through your connected account. For a site stored in your own GitHub repository, Kite commits the change, or opens a pull request if your main branch is protected.
For a broader look at what a trust center is and when a small software company needs one, see What Is a Trust Center? A Guide for Small SaaS Teams Coming soon .
Keep the page accurate and see whether buyers use it
A security page goes stale quietly. You change hosting regions, add a new subprocessor, or finish an audit, and the page still says what was true last year. Because Kite keeps the facts in your knowledge base, you can tell it about a change once and it updates the page to match.
You can also ask Kite to review the page on a schedule, such as once a quarter. Each time, it sends you the facts the page currently states and asks you to confirm or correct them. When something has changed, it prepares the update as a draft for you to approve.
On a site Kite hosts, the built-in analytics show how many people visit the security page, which pages they came from, and how many submit the document request form. If the page gets steady visits from your pricing page but few requests, it's probably answering the questions well. If buyers keep requesting documents or sending the same follow-up question, Kite suggests adding that answer to the page.
What you get
A list of your confirmed security facts
The hosting, encryption, access, retention, and certification details Kite pulled from your documents, saved in your knowledge base for every future page and email.
A published security and trust page
Plain answers to the questions buyers ask most, built in your site's design and linked from your footer and sales pages.
A clear list of anything left to confirm
Every placeholder and unsupported claim Kite found, so the page goes live only with answers you've checked.
A document request form
A simple way for buyers to ask for your private reports, with each request sent to your inbox.
A view of how buyers use the page
Visits, the pages that send visitors to it, and the number of document requests, along with Kite's suggestions for what to add.
How to get started
Start a conversation with Kite in your browser or in Slack and tell it what you need. You might say, "Build a security page for our website that answers the questions in these questionnaires," and attach two or three that you've completed recently.
Kite reads the documents and replies with the topics it plans to cover, the facts it found for each one, and the questions it still needs you to answer. Correct anything that's wrong and fill in the gaps in the same conversation. Kite then writes the page and saves it as a draft so you can preview it.
Approve the page with the Publish button or a reply, and Kite puts it live. Kite asks before publishing by default, which suits a page where every sentence is a statement your company makes. You don't need to connect anything if Kite hosts your website. If your site runs elsewhere, connect your content system or GitHub repository so Kite can publish there.
Integrations used to build a security and trust page
Kite builds and hosts the page directly on a website it runs for you, so most teams need no other product for this job. If your website lives somewhere else, connect the system it runs on so Kite can create the page there.
Publish the page through your content system
Publish the page to a site stored in GitHub
Common questions
What's the difference between a security page and a trust center?
A security page is usually one page that describes how you protect customer data. A trust center is a larger hub that adds downloadable reports, a live list of subprocessors, policy documents, and sometimes a system status page. Most small software companies start with a security page and a document request form, then grow it into a trust center as larger buyers ask for more. Kite can build either one, and it can add pages to the hub as your program grows.
Can a security page replace a security questionnaire?
Sometimes. Some buyers will accept a clear security page plus your SOC 2 report instead of a full questionnaire, especially for smaller contracts. Larger companies usually still send their own questionnaire, but a good page lets you answer it faster because the answers are already written and approved. Kite can also use the facts in your knowledge base to draft answers to a new questionnaire when one arrives.
Should we publish our SOC 2 report on the page?
Usually not. A SOC 2 report contains detail about your controls that auditors expect you to share only with customers and prospects, typically under a nondisclosure agreement. The common approach is to state on the page that you hold the report, give its date, and offer it on request. Kite builds the page that way unless you tell it otherwise.
What should we say if we don't have any certifications yet?
Say so, and describe what you do have. Many early buyers care more about specific practices than about a badge. You can explain that data is encrypted, that staff access is limited and logged, and that you use a cloud provider that holds its own certifications. If you've started an audit, give the expected date. Kite writes that version of the page from the practices you confirm.
Is it safe to share our security documents with Kite?
Kite is built by Appsmith, which is SOC 2 Type II certified. Files you upload in the Kite web app are part of your team's conversation with Kite, so everyone on your team can see them. If a document contains detail you'd rather keep to a smaller group, you can describe the relevant facts to Kite in a message instead.