Proof for the security reviewer
Testimonials on Security and Trust Pages
A trust center is read by a different person from your homepage. It is the security analyst, the IT lead or the procurement manager working through a vendor questionnaire, and a quote about how easy you were to use means nothing to them. What they want is a peer who already ran the review and signed off. Use the checklist below to decide which voices belong on the page and where each one sits.
- Quotes from reviewers, not end users
- Each quote beside the control it speaks to
- Approval rules for named security staff
The problem, solved
Why trust pages carry no customer voice, and how to add one
Most trust centers are written by the security team for auditors. These are the gaps a buyer notices.
Our quotes are all from happy end users
A security reviewer skips praise for the interface. They want to hear from someone who did their job at another company.
With StoryProof: Keep the contacts who signed off your security review in their own list, then send the request link to that list only.
Nobody ever asked about the vendor review
Customers talk about results because that is what they were asked. The questionnaire, the pen test report and the follow up calls never come up.
With StoryProof: From Pro, a multi-step form can ask several questions in one sitting, so one step can ask how your review went compared with other vendors.
Their security team must approve every word
A CISO quoted by name on a vendor page is a statement on behalf of their company, and their own comms team usually wants to read it first.
With StoryProof: Nothing goes public until you approve it, so a submitted quote can wait in the queue while the customer gets internal sign off.
The right quote is buried among hundreds
One sentence about how quickly you answered a questionnaire is worth more here than fifty five star reviews, but it is hard to find again.
With StoryProof: Tag quotes by the trust topic they mention, such as access control, data handling or the review process, and pick from those tags.
Marketing quotes leak onto the security page
If the trust center shows the same carousel as the homepage, the reviewer sees marketing and stops reading.
With StoryProof: Build a separate widget for the trust page and choose only the reviewer quotes for it. It embeds with a div and the embed.js script.
Flip the switch to see how StoryProof handles each one.
Trust page checklist
Plan the customer voice on your trust page
Tick what is already true. The open items are the gaps a security reviewer is likely to notice.
Ticks stay in your browser. Nothing is sent or stored.
Which trust page section takes which quote
Match the quote to the question the section answers.
Prompts
Questions to send a customer’s security contact
Ask about the review they ran, not about your product in general.
After their vendor review is complete
- How did our security review compare with other vendors you assessed?
- Was there a point where our answers saved you time?
- What would you tell a peer who is about to review us?
Leave out
- Would you say we are secure? (asks them to vouch for something they cannot)
After a security question was raised and resolved
- What did you need from us, and how did we handle it?
- How long did it take to close the question?
In StoryProof
Add reviewer quotes to your trust page with StoryProof
Step 1 of 5
Put the reviewers in their own list
Add the security, IT and procurement contacts as contacts and group them, so this request never goes to end users.
Step 2 of 5
Ask about the review
From Pro, use a multi-step form with the questions above. They can answer in writing, by audio note or on video.
Step 3 of 5
Hold for their sign off
Leave each answer unapproved until the customer confirms their company is happy with the wording and the placement.
Step 4 of 5
Tag by trust topic and build the widget
Tag each approved quote with its section, then choose those quotes for a widget that lives only on the trust page.
Step 5 of 5
Embed beside the sections
Place the widget div where the matching section sits and add the embed.js script to the page.
Before you start
What this plan cannot do
What this does not cover, and what to check on your side. Better to know now than after launch.
- 01
A quote is not a certification
A customer saying they approved you does not stand in for an audit report. Keep the documents on the page and use quotes beside them.
- 02
Many security staff will say no
Some companies forbid staff from endorsing vendors. A role and industry without a name is often the most you will get.
- 03
StoryProof does not hold your security documents
It collects and shows testimonials. Questionnaires, reports and policies stay wherever your trust center keeps them.
- 04
Old reviews describe an old setup
A quote about a review two years ago may describe controls you have changed. Date check them as you would the documents.
FAQ
Questions people ask
Short answers to what usually comes up next.
Should a trust page have testimonials at all?
A few, yes. The reader is deciding whether to trust you, and a peer who already did the same review is the closest thing they have to a reference.
Can I use a quote without the person’s name?
Yes, if the customer prefers. Show the role and the kind of company, such as “Head of IT, regional bank”, so the reviewer can judge how relevant it is.
Should I use quotes from end users on the trust page?
Rarely. Keep them for the homepage and product pages. On a trust page they read as marketing and can make the page feel less serious.
Is it fine for a quote to mention a certification?
Only if you hold it and the customer actually checked it. If the certification lapses, take the quote down with it.
Still have a question? Ask the StoryProof team or book a demo.
Give security reviewers a peer to listen to
Collect quotes from the people who vetted you and show them only on your trust page.
Last updated 2026-11-11.