> Trust center software for product security: publish SBOMs, VEX, security advisories, compliance documents and security.txt on a branded trust portal on your own domain. - **Updated:** 2026-11-10 **See one live** [trust.sbomify.com](https://trust.sbomify.com/) # One link for every security question about your product Publish SBOMs, VEX, security advisories and certifications on a Trust Center that updates itself with every release, on your own domain. Customers serve themselves, and questionnaires take minutes instead of weeks. [Start free](https://app.sbomify.com) [See a live Trust Center](https://trust.sbomify.com/) An illustrative Trust Center for a fictional company. Self-service ## Send a link, not a call. Every answer in one place. Most trust centers stop at SOC 2 badges. Yours also answers what is inside your product, and whether the latest CVE affects it. “Do you have a SOC 2 report?” Certifications and audit reports, public or behind your NDA “What is inside your product?” An [SBOM](https://sbomify.com/what-is-sbom/) for every release, in CycloneDX or SPDX “Are we affected by CVE-2026-XXXXX?” [VEX](https://sbomify.com/faq/how-do-i-use-vex/) statements and [security advisories](https://sbomify.com/features/security-advisories/), per product and version “How do we report a vulnerability?” A [disclosure policy](https://sbomify.com/faq/what-is-a-vulnerability-disclosure-program/) and an RFC 9116 [security.txt](https://sbomify.com/faq/what-is-security-txt/) New to the idea? [What a trust center is, and what goes in one](https://sbomify.com/faq/what-is-a-trust-center/) Automated publishing ## Published from your pipeline. Never out of date. Questionnaire answers go stale. A Trust Center fed by the same pipeline that builds your software does not. ### Synced with every release New SBOMs from CI appear the moment they are uploaded. No manual uploads, and [complex product hierarchies](https://sbomify.com/features/generate-collaborate-analyze/) stay in order. ### Posture with VEX applied Release-level VEX and CBOM downloads sit next to every SBOM, with a vulnerability posture card that reflects your decisions. ### Signed and verifiable Signature and provenance badges let readers check that what they downloaded is what you published. ### Advisories when it matters A filterable index of your [security advisories](https://sbomify.com/features/security-advisories/) by product and severity, with affected and fixed versions and a dated timeline. sbomify publishes its own, from its own pipeline. [Visit trust.sbomify.com](https://trust.sbomify.com/) Access control ## Public, gated or private. Per product. Not every document belongs on the open web. Choose what visitors can see, component by component. - **Public:** listed and downloadable by anyone who visits. - **Gated:** listed, but visitors request access and accept your NDA first. You approve each request from your dashboard. - **Private:** hidden from the Trust Center entirely. Gated advisories go further: a reader who may not see one gets “not found”, so an embargo stays an embargo. [How advisories are gated](https://sbomify.com/features/security-advisories/) Illustrative visibility settings and an access request. Machine-readable ## For people. And for their tools. Your customers' scanners and CSAF aggregators can pick up what you publish without anyone sending an email. - **CSAF 2.0 advisories,** with provider metadata and a ROLIE feed that aggregators find on their own. - **The [Transparency Exchange API](https://sbomify.com/faq/how-do-i-enable-tea-in-sbomify/),** the ECMA TC54 standard for discovering SBOMs and VEX for any release. - **An RFC 9116 security.txt,** so researchers know where to report a vulnerability. TEA and your own domain come with the Business and Enterprise plans. **trust.acme.example**Served from your own domain - /.well-known/security.txtRFC 9116 - /.well-known/csaf/provider-metadata.jsonCSAF 2.0 - ROLIE feed of public advisoriesTLP:WHITE - TEA discovery for every releaseECMA TC54 - SBOM, VEX and CBOM downloadsPer release Updated with every release Plans ## Start free. Add your domain later. A public Trust Center is on the free Community plan. Business and Enterprise put it on your domain and keep sensitive documents private. CommunityFree - A public Trust Center - SBOM management - OSV scanning, rescanned weekly Business and EnterpriseEverything in Community, plus - A Trust Center on your own domain - Private documents and components - The Transparency Exchange API - Daily rescans and Dependency-Track See [pricing](https://sbomify.com/pricing/) for the details, or [how to set up a Trust Center](https://sbomify.com/faq/how-do-i-set-up-a-trust-center/) Questions ## Before you start How is this different from a compliance trust center? Compliance trust centers from GRC platforms hold SOC 2 reports and policies: they show the company is run securely. sbomify's is a product security trust center. It holds those documents too, and also answers what is in each release and whether a vulnerability affects it. [Compare the two](https://sbomify.com/faq/what-is-a-trust-center/) Can we use our own domain? Yes, on Business and Enterprise. Set a domain such as trust.yourcompany.com, add a CNAME record with your DNS provider and wait for it to validate. [Setup guide](https://sbomify.com/faq/how-do-i-set-up-a-trust-center/) Can we share penetration test reports without making them public? Yes. Mark them as gated: they stay listed, visitors request access and accept your Company NDA if you uploaded one, and you approve or deny each request from your dashboard. Do we have to upload SBOMs by hand? No. Send them from CI with the [sbomify GitHub Action or your pipeline of choice](https://sbomify.com/features/integrations/), and the Trust Center reflects each new release as soon as it is uploaded. Can we run sbomify on our own infrastructure? Yes. sbomify is open source and runs with Docker Compose. Read the [self-hosting guide](https://sbomify.com/self-hosting/), or use our cloud at app.sbomify.com. **Give your customers one link for product security** Publish SBOMs, VEX, advisories and certifications on a Trust Center that updates itself with every release. [Book a demo](https://app.sbomify.com/enterprise-contact/) or [start free](https://app.sbomify.com). --- From sbomify: https://sbomify.com/features/trust-center/