Example, not our own posture. This page shows the kind of public trust center Taj builds for customers working toward SOC 2 and ISO 27001. Every status, score, document and finding below is sample data for Contoso Labs, a fictional company.

Example trust center

Example trust center: what Taj builds for you

A buyer-safe posture page for your company, backed by the evidence ledger and security command system Taj runs for you. Shown here with sample data for Contoso Labs.

Sample readiness 78%Internal security command

Trust posture is backed by verified technical facts, active security checks, and explicit evidence gaps rather than a static questionnaire library.

Framework Coverage

SOC 2partially covered

Core controls are mapped, but the bridge letter and pentest summary still need refresh.

Updated June 30, 2026

ISO 27001in progress

Policies and risk treatment are mapped; vendor and network evidence are still being tightened.

Updated June 29, 2026

GDPRpartially covered

RoPA and retention work are underway, but final owner approvals are still open.

Updated June 28, 2026

AI Governancecovered

Prompt review, model access, and answer-library controls are now tracked from one place.

Updated June 30, 2026

Available Documents

overviewpublicfresh

Public trust center snapshot

Designed to replace static trust pages with evidence-backed posture updates.

Updated June 30, 2026

architecturegatedfresh

Buyer-safe architecture packet

Sensitive topology is abstracted while still showing control ownership and network boundaries.

Updated June 29, 2026

securityinternalunknown

Pentest and attack-surface summary

Blocked on the refreshed summary letter from the latest testing cycle.

Updated Pending refresh

privacypublicstale

Privacy and retention summary

Needs the final 180-day support log decision.

Updated June 18, 2026

Current Security Notes

Staging admin host is reachable from the public internet

A public admin surface undercuts trust-center claims and creates unnecessary takeover exposure.

Reachable dependency flaw is present in the support reply worker

This path is reachable through the production job runtime, so patch priority is real rather than theoretical.

Verified Security Facts

Quarterly access review is incomplete for one former contractor

GitHub admin access remains active after engagement end, so the quarter cannot be marked fully complete.

The external attack-surface sweep found one public staging admin route

That finding is verified and maps to both active security work and trust-center accuracy, so it should drive immediate remediation rather than sit in a separate AppSec queue.

Build your trust center with Taj