01
Connect what you already run
Read-only connections to your cloud, identity provider, laptops, code and HR system. Fifteen minutes, mostly spent finding who has the admin password.
Built and hosted in the EU
Compliance, minus the dread.
Trusterio reads the systems you already run, on the schedule you set, so your evidence collects itself. Your controls get tested against what your cloud actually reports — and your customers stop emailing you spreadsheets.
The whole product for €500 a month, billed yearly, excluding VAT. We set your account up with you, personally.
Reads thirteen systems you already pay for, and never writes to them. Jira and Slack are the two it writes to: an issue for each fix, a notice in a channel.
- AWS
- Azure
- Google Cloud
- Entra ID
- Google Workspace
- GitHub
- Okta
- Intune
- Jamf
- Kandji
- Personio
- HiBob
- BambooHR
- Jira
- Slack
And your own AI app, over MCP. See how it connects
How it works
Four steps, and the tedious one is ours
Most compliance tools ask you to describe your security in a form. This one goes and looks at it, and keeps looking.
02
Let the evidence collect itself
Every control with a check is tested each time those systems are read — hourly, daily or weekly, as you choose, not once an audit. A control nobody has checked recently says so, right beside its own status.
03
Fix the handful that need a person
What is left is a short list you put names and dates on. A risk you reduced on paper stays at its full score until something actually backs it up.
04
Let customers check for themselves
Publish a Trust Center. Approve document requests in one click, watermark the PDFs you send, and see who downloaded what — without a questionnaire round trip.
Connect your AI
Work in Trusterio from your AI app, over MCP
MCP is the open standard that AI apps such as Claude use to connect to other tools. Trusterio has one: connect Claude, or another AI app that supports MCP with OAuth sign-in, to one of your businesses, and it works there with your rights and no more.
What it can do
- Read your controls, risks, findings, policies and questionnaires
- Draft questionnaire answers, which stay drafts until a person approves them
- Add evidence to a control
- Add a risk, and update one
- Move a finding to open, in remediation or resolved
What it never does
- Delete anything
- Do more than you may, or reach another business
- Touch members, billing or security settings
Every change it makes is in the audit log under your name, with the app it came through.
Connect it in three steps
- 01In your AI app, add a connector or MCP server.
- 02Paste this address:
https:// trusterio. app/ mcp - 03Sign in to Trusterio, choose the business, and press Allow.
Some apps offer this only on certain plans, or with a developer setting switched on.
Why anyone believes it
The good bit: it will tell you no
Anybody can generate a policy. What a security reviewer actually wants to know is whether you would notice if it were wrong. Four things Trusterio will not let you do:
A claim your systems contradict cannot be published
Publish a data residency statement while a connected AWS account has resources in us-east-1, and the publish is refused — not warned about.
A control nobody tested does not count as passing
Untested is unknown. It lowers your score and says why, rather than quietly rounding up to something nicer.
Drafts are checked, never invented
Trusterio AI Assist drafts only from your own records. A questionnaire answer its sources do not support is thrown away before anybody sees it; a drafted policy comes with a list of the promises no control backs. Nothing is used until a person approves it.
Removing access is confirmed by observing it
The connections to your accounts are read-only, so pressing “revoke” has revoked nothing. The task stays open until a later reading reports the account gone.
Trust Center
The page that ends the security review
Give customers, their auditors and their procurement teams one place to check your security — and to ask for the documents that are not public. Most of them never email you at all.
- Certifications, policies, subprocessors and security statements on one page.
- Gated documents released per request, each PDF watermarked to the recipient, every download recorded.
- A changelog derived from what was actually published — including what was withdrawn.
- Nothing new appears until somebody publishes it, and every version is kept.
trust.example.com
trust.example.com
Coverage
Do the work once. Count it everywhere.
One set of controls, mapped across every framework you need. The second certification is not a second year of work — it is mostly the same evidence, already collected.
- ISO/IEC 27001
- ISO/IEC 42001
- SOC 2
- GDPR
- NIS2
- DORA
- EU AI Act
And the rest of it
Not just a checklist with a logo
The parts of compliance that usually live in three different spreadsheets, in the same place as the evidence that backs them.
A risk register that argues back
Reduce a risk on paper and it stays at its inherent score until a completed treatment or a passing, recently tested control backs it up.
Your Article 30 record, kept honest
The GDPR record of processing, checked against what your Trust Center claims you hold.
Leavers who are actually gone
Read from your HR system, checked against every account your connected systems report, and not closed until a later reading agrees.
Pricing
One package. One price.
The whole product for one business, and a price for every business after it. Everything is included from day one — there is no tier where the useful feature lives.
€500a month for one business, billed yearly, excluding VAT
Running more than one company? Each business you add is €250 a month, and you see what it costs before you add it.
Included, always
- Unlimited people
- Every framework
- Trust Center on your own domain
- Every adapter
- Trusterio AI Assist
What does Trusterio do?
Trusterio is a compliance platform for European companies. It connects to the systems you already run, collects evidence from them continuously, tracks your controls against ISO 27001, ISO 42001, SOC 2, GDPR, NIS2, DORA and the EU AI Act, and publishes a Trust Center where your customers can review your security and request your documents.
What is a Trust Center?
A Trust Center is a public page where a company publishes its security, privacy and compliance information — certifications, policies, subprocessors, and the documents a prospective customer asks for during a security review. It replaces the spreadsheet-and-email cycle that a procurement review usually becomes.
Where is our data stored?
In the European Union: Trusterio runs on EU infrastructure, and its subprocessor list names each company and country. For your own Trust Center, a data residency statement that your connected systems contradict cannot be published — the check runs in the database, not in a form.
Which frameworks does it cover?
ISO 27001, ISO 42001, SOC 2, GDPR, NIS2, DORA and the EU AI Act. Controls map to requirements across frameworks, so evidence collected once counts everywhere it applies.
How is evidence collected?
Through read-only connections to the systems you already use — AWS, Azure, Google Cloud, Entra ID, Google Workspace, GitHub, Okta, Intune, Jamf, Kandji, and Personio, HiBob or BambooHR. Trusterio reads them and never changes anything in them. Jira and Slack are different: they carry work out rather than evidence in, so Trusterio creates an issue in Jira for each fix you send there, and posts the notices you choose to Slack.
Does Trusterio use our data to train models?
No. Trusterio AI Assist drafts from your own records — policies, questionnaire answers, and your privacy policy and DPA among them — and every questionnaire answer is checked against its sources before anybody sees it; a drafted policy lists the promises no control backs. To write a draft, the text it needs is sent to a model hosted in the EU; for a privacy policy or DPA that includes the contact details the document must name. The AI Assist page in your business says exactly what each draft sends and where it goes. We do not train models on your data.
Can I connect our own AI assistant?
Yes. A member can connect an AI app such as Claude to one business over MCP, after approving it, and the app gets no more rights than that member has. It can read controls, risks, findings, policies and questionnaires; it can draft questionnaire answers, add evidence, add and update risks, and move a finding to open, in remediation or resolved. A drafted answer stays a draft until a person approves it. It cannot delete anything or touch members, billing or security settings, and every change it makes is recorded in the audit log under the member’s name, with the app it came through.
What does it cost?
One package at one price, covering one business. Every additional business you add — a subsidiary, a second brand, a separate legal entity — is charged separately, and the price is shown before you add it.
One price. The whole thing.
€500 a month for one business, billed yearly, excluding VAT. Tell us about your company, and we set your account up with you, personally. Your data is stored in the EU.