# Answering a security review

URL: /systems/trust-and-governance/buyers · Id: `page:systems/trust-and-governance/buyers`

> How a Startup answers a security review from records it already keeps, with a trust page, live status, the scoped report, and sourced answers.

A [Startup](/business/nouns/startup) answers a [Customer](/business/nouns/customer)'s security review from records it already keeps. The reviewer, person or agent, gets in minutes the answers an auditor takes weeks to test.

## The trust page
Every [Site](/business/nouns/site) serves a trust page at `/systems/trust-and-governance`, as a page for people and as Markdown for agents. It shows:

- the frameworks the Startup is covered by, and its latest report period;
- the live result of every [Control](/business/nouns/control), from [Trust status](/systems/trust-and-governance/controls/trust-status);
- the [subprocessor list](/systems/trust-and-governance/subprocessors) and the data processing agreement;
- a request form for the full report.

## The report
A reviewer asks for the report on the trust page. The Startup's agent accepts a confidentiality [Agreement](/business/nouns/agreement) by click-through and sends the Startup's scoped SOC 2 report. Each release is recorded, with who received it and when.

## Questionnaires
Long questionnaires answer from records. The [Sales Engineer](/agents/sales/sales-engineer) reads each question, finds the Control, [Proof](/business/nouns/proof) or setting that answers it, and cites that source beside the answer.

A question no record answers goes to a [Human](/business/nouns/human) as a [Task](/business/nouns/task). The approved answer is kept, so the next questionnaire that asks it answers itself.

[Trust pack](/workflows/sales/plays/trust-pack) sends the report and prefilled answers with every enterprise [Quote](/business/nouns/quote), before the reviewer asks.

## Checking without trusting
A reviewer's agent can verify instead of trusting. It reads the [Attestation](/business/nouns/attestation) and checks the firm's [Credential](/business/nouns/credential) at the source.

It then fetches a Proof, recomputes the hash chain for its range, and compares the result with the root the platform published. A match shows the Control ran over every record in that range.

## Example
A two-person Startup sells an expense-audit agent to mid-size firms. A prospect's procurement team sends a 240-question spreadsheet. The Sales Engineer answers 231 from records in eleven minutes, and the founders answer the nine about how they work.

## Next
- [How proof works](/systems/trust-and-governance/proof): what the reviewer's agent recomputes.
- [Subprocessors](/systems/trust-and-governance/subprocessors): the list every review asks for.