Trust center

A Legal space's register (/legal/{org}) grows into a trust center the way Vanta's, Drata's or SafeBase's do: compliance badges over the documents, a library of reports some of which are gated behind an NDA or your approval, a controls catalogue, a sub-processor list procurement tools can poll, a privacy-request form, and a security.txt. All of it is settings on the Legal space's theme, under theme.legal.trust, plus a few queues in the studio. Nothing here is generated: every band draws nothing until you give it something to say, so turning the bands on costs a plain register nothing.

How documents themselves work (pages, editions, acceptance) is in Legal spaces.

The bands

A Legal space's front page is a composed document. Until you edit it, it is generated as the intro band, then compliance, documents, access and status. These bands are offered but never generated, so you place them yourself: subscribe, controls, faq, updates, locations, contacts and dsar.

Set the bands' content with the space theme:

curl -X PATCH "https://forumulate.com/api/orgs/$ORG/spaces/$LEGAL/theme" \
  -H "Authorization: Bearer $FORUMULATE_TOKEN" -H "Content-Type: application/json" \
  -d '{ "legal": { "trust": {
        "compliance": { "heading": "Compliance", "style": "tiles", "columns": 4,
          "items": [
            { "name": "SOC 2 Type II", "status": "certified", "auditPeriod": "1 Jan – 31 Dec 2026",
              "validUntil": "2027-03-31", "href": "/legal/acme/soc2" },
            { "name": "ISO 27001", "status": "in-progress", "progress": 72 } ] },
        "status": "uptime" } } }'

Like every theme key, a misspelt one is a 422 that names its path.

Compliance badges

trust.compliance: heading, style (tiles or list, unset tiles), columns (2–6 tiles to a row from 640px, unset the grid's own fill), card (a tile's surface: surface flat / outline / raised, radius, pad, shadow), and up to 24 items:

Controls catalogue

trust.controls: heading, style (grid, a card per category, or list, ruled sections), and up to 12 categories, each with name, description and up to 40 items of { name, status, note }. status is passing, monitoring or planned.

The catalogue is what you write. Nothing connects it to a monitoring tool for you; see What you need to set up.

Status

trust.status: pill (one line), card (a titled box with the link), uptime (the card with the status page's 90-day uptime figure) or none. Unset is none: a register does not start reporting outages by itself.

The band reads your organization's status page only when the organization has exactly one public Status space; with none or several it draws nothing, because a wrong status is worse than none. GET /public/orgs/{orgId}/legal/trust.json answers which status space and which contact space the trust center uses.

Security FAQ, notices, locations, contacts

Every link in these bands is a /path on your site, an https:// address or mailto:.

The trust words in other languages

The headings and the NDA are yours, so they do not translate themselves. trust.translations holds them per locale (de, pt-BR, up to 20), and the reader's path locale picks one:

{ "legal": { "trust": { "translations": {
  "de": { "complianceHeading": "Zertifizierungen", "accessHeading": "Dokumente",
          "nda": "Mit dem Absenden stimmen Sie zu …" } } } } }

The words you can translate: complianceHeading, accessHeading, controlsHeading, faqHeading, updatesHeading, locationsHeading, contactsHeading, dsarHeading, dsarIntro and nda.

The document library and gated access

trust.access lists up to 24 documents. Each is public (a plain link) or request, and a request document has a gate:

{ "legal": { "trust": { "access": {
  "heading": "Reports",
  "nda": "By requesting this document you agree to keep it confidential …",
  "linkDays": 14,
  "autoApproveDomains": ["bigcustomer.com"],
  "items": [
    { "title": "Penetration test summary", "access": "public", "href": "/legal/acme/pentest" },
    { "title": "SOC 2 Type II report", "access": "request", "gate": "nda",
      "watermark": true, "pageId": "3f6c…" },
    { "title": "Architecture overview", "access": "request", "gate": "approve",
      "href": "/p/acme/internal/architecture?share=…" } ] } } } }

What the reader gets is a link to /legal/{org}/access/{token}. The token is stored only as a hash. Each time the link is opened, a view is counted, so the queue shows how often each requester opened it and when they last did (the viewer log). An expired, denied or withdrawn link answers 404. A watermarked item answers with its PDF from GET /public/orgs/{orgId}/trust/access/{token}/document.pdf, which is never kept by a shared cache.

The request call is public, and it never tells you whether an address has asked before:

curl -X POST "https://forumulate.com/api/public/orgs/$ORG/trust/access-requests" \
  -H "Content-Type: application/json" \
  -d '{ "document": "SOC 2 Type II report", "name": "Ada", "email": "ada@bigcustomer.com",
        "company": "BigCustomer", "ndaAccepted": true }'
# → { "ok": true, "status": "granted" }   or "pending" for an approval

document is the item's title. A title whose gate is not nda or approve is refused with a 422. A nda request without ndaAccepted: true is also a 422. When your organization has a CAPTCHA configured, the request must carry captchaToken.

The owner's side:

GET  /orgs/{orgId}/trust/access-requests                 # newest first, with views
POST /orgs/{orgId}/trust/access-requests/{id}/decision   { "decision": "approve" }   # or "deny"

Approving emails the link (the legal.access-link email template); denying closes the request. Every request also fires the legal.access_requested webhook with the document, gate, status, name, email and company. That webhook is how a request reaches your CRM.

Sub-processors as data

A document with a table in its Sub-processors section (the subprocessors slot) publishes that table as rows. The columns are found by their headings (entity, purpose, location, transfer mechanism, added), not by their order:

GET /public/orgs/{orgId}/legal/{kind}/subprocessors
# → { kind, title, version, rows: [...], since: { version, added, removed, changed }, upcoming: {..., effectiveAt} }

The same data is at /legal/{org}/{kind}/subprocessors.json on the reader. A procurement tool can poll that address instead of scraping the page. It is 404 when the document has no such table.

Readers who subscribe to the register hear which rows an edition adds or removes.

Privacy requests

trust.dsar turns on the dsar band: a form where anyone can file a privacy request.

POST /public/orgs/{orgId}/trust/privacy-requests
  { "kind": "delete", "name": "Ada", "email": "ada@example.com", "details": "…" }

A kind the form does not offer is refused with a 422 that lists the kinds it does offer. Each request:

• is due 30 days after it arrives (dueAt, by the database's clock);

• is mailed to your support address (the legal.privacy-request template), when you have set one;

• fires the legal.privacy_requested webhook;

• waits in the studio's Privacy requests queue, sorted by deadline, until you close it as done or declined.

GET  /orgs/{orgId}/trust/privacy-requests
POST /orgs/{orgId}/trust/privacy-requests/{id}/close   { "status": "done" }

Privacy requests are filed with the organization's main trust center.

security.txt

trust.security writes your organization's RFC 9116 file and the "Report a vulnerability" line:

{ "legal": { "trust": { "security": {
  "contact": "mailto:security@acme.com",
  "policy": "/legal/acme/vulnerability-disclosure",
  "encryption": "https://acme.com/pgp.txt",
  "acknowledgments": "/legal/acme/hall-of-fame",
  "hiring": "/jobs/acme/careers",
  "preferredLanguages": "en, de" } } } }

It is served at GET /public/orgs/{orgId}/trust/security.txt, and the Expires date is renewed each time the file is read. Without a contact there is no file (404), because the RFC requires one. The /.well-known/security.txt of an address we host is still Forumulate's own platform file. If you want researchers to reach yours, link the file from your security page.

More than one trust center

The org's main register is its first public Legal space, at /legal/{org}. Any other Legal space is a trust center of its own, at /legal/{org}/s/{space}. It shows that space's documents, its theme, its intro and its bands. Access requests made there name the space (spaceId on the request), so a grant opens that library's document and uses that space's linkDays.

A private Legal space at that address is a members-only trust center. It is opened with the space's share link (?share=…) and kept out of search.

Security questionnaires

The studio's Security questionnaires panel drafts answers to a questionnaire from what you have published: the trust bands, the access library, the hosting locations and your live legal documents. Paste the questions, twenty at a time. Each answer lists the sections it drew on, and a question your material does not cover says "Not covered by our published material." Export the answers as CSV. They are drafts for a person to check.

POST /orgs/{orgId}/trust/questionnaire  { "questions": ["Do you encrypt data at rest?", "…"] }

Policies from the generator

The privacy, cookie and terms documents a trust center lists can be drafted with the policy generator. They are a template, not legal advice: review them with counsel. Forumulate maintains the clauses, reviews them every quarter, and tells you (in the app and by email) with a diff when a clause you published changes, so you can update your policy in one click. See Legal spaces.

Studio controls

In the Legal space's studio:

• Design: every theme.legal.trust key, with link fields checked as you type and logo fields that upload into the space's library.

• Access requests: who asked for what, NDA acceptance time, expiry, views; approve or deny.

• Privacy requests: the requests by deadline; close as done or declined.

• Security questionnaires: the drafting panel above.

What you need to set up

In the API

Every operation below is also reachable from the other surfaces without a dedicated command. forumulate api <Operation> calls it from the CLI, the JavaScript SDK has a typed method for each one (the last column names it; the Python and Go clients are generated from the same spec), and an agent reaches the organization-scoped ones through the MCP call_api tool. Where a CLI command or MCP tool exists too, the last column names it. Operation names link to the API reference.

Legal Trust

Public Legal Trust