Some security documents should not be public, and buyers still need to read them. Your SOC 2 report, your penetration test summary, and your full policies fall into that gap. The usual answer is to share them under a non-disclosure agreement. The usual result is a week of email while two legal teams exchange redlines on a document neither of them cares much about.
Gating is a trade between friction and control. Too much friction and reviewers give up and send a questionnaire instead. Too little control and a restricted-use report ends up in places it should not. Which documents belong behind the gate is covered in what to put on a Trust Center. This article covers the mechanics: the NDA itself, the approval rules, how long access lasts, and the record you keep.
Why gate at all
There are three good reasons, and it helps to know which one applies to each document.
Distribution terms. A SOC 2 report is a restricted-use report. The auditor's opinion includes a paragraph saying who the report is intended for, typically the service organization, its user entities, and prospective user entities with enough understanding to read it. Read that paragraph in your own report and confirm with your auditor how they expect you to distribute it.
Attack surface. A penetration test summary, an architecture overview, or a detailed questionnaire response describes how your systems work. That is useful to a reviewer and to an attacker.
Commercial confidentiality. Some details, such as your full subprocessor arrangements or internal policy text, you may prefer to keep from competitors.
Be honest about the limits. An NDA does not stop a recipient from forwarding a PDF. It gives you a contractual remedy and a record of who agreed to what. Both matter, but neither is a technical control.
Choosing the NDA mechanism
You have four broad options. Most companies use two or three of them, depending on who is asking.
A click-through NDA on your Trust Center. The reviewer reads the terms, enters their name and company, and accepts. It is the fastest option and suits most routine requests.
Your standard mutual NDA, signed electronically. Slower, but some buyers' policies require a signed agreement rather than a click-through.
The buyer's NDA. The slowest path, since it needs your legal review. Use it when the buyer insists and the deal justifies the time.
An existing agreement. A current customer's contract usually has a confidentiality clause already. Do not make them sign a new NDA to download this year's report.
Whether a click-through agreement binds the reviewer's employer, and on what terms, depends on how it is presented and on the governing law. Confirm the wording and the acceptance flow with counsel before you rely on it. Points worth raising with them: whether the person accepting has authority to bind their company, whether the agreement covers the buyer's own auditors and advisers, and how long the confidentiality obligation lasts.
Telling reviewers what is behind the gate
A gate with no description forces a reviewer to request everything to find out what they need. List each gated document on the public side with a one-line description, its date, and what it covers. "SOC 2 Type II report, security and availability criteria, 12-month period ending March" tells the reviewer whether to request it. So does "Penetration test summary letter, application and external infrastructure, tested in February."
This also cuts the number of requests you approve. Reviewers who can see that the penetration test is recent and the report is current often request only the report.
Setting approval rules
Decide in advance which requests are approved automatically and which need a person. Writing the rules down keeps approvals consistent and fast.
A common pattern:
Approve automatically when the NDA is accepted, the email domain belongs to an identifiable company, and that company is a current customer or has an open opportunity.
Route to a person when the email domain is a free mail provider, the company cannot be identified, or the company competes with you.
Require security approval for the most sensitive documents, such as a penetration test summary, even when the requester qualifies otherwise.
Name the approvers and give them a response target. A gate that takes three days to open is a gate reviewers learn to route around, usually by asking your account executive to email the PDF directly. Once that habit forms, your log stops meaning anything.
Controlling access after approval
Approval is the start of access, not the end of the decision. Four settings shape what happens next.
Expiry. Grant access for a set number of days rather than indefinitely. A reviewer who needs the report again can ask, and the second request costs less than an open-ended grant you cannot track.
View or download. Viewing in the browser keeps the file off the recipient's drive, which is some protection against casual forwarding. It is not protection against screenshots. Offer download where reviewers need it for their file, which is often.
Watermarking. Stamping each copy with the recipient's name, company, and date discourages forwarding and helps you trace a copy that turns up somewhere it should not.
Versioning. When a new report replaces the old one, retire access to the old version. Buyers should review the current period, and you should not have superseded reports in circulation without a reason.
Keeping a log you can use
The access log is what turns gating from a ritual into a control. For each access, record:
- Not done:
The person and their company
- Not done:
The document and its version
- Not done:
The NDA version they accepted, or the agreement that covers them
- Not done:
Who approved the request, or which rule approved it
- Not done:
When access was granted, used, and expired
That record answers questions you will eventually be asked. Who has seen our penetration test summary? Which prospects received last year's report? If a document leaks, which copy was it? It also gives your own auditor something to inspect if your confidentiality controls are in scope, as they often are when the confidentiality criterion is included.
Requests that do not fit the process
Some requests will not match your rules. Decide how to handle the common ones before they arrive.
The buyer cannot sign your NDA. Some organizations, including many in the public sector, have constraints on what agreements they can accept. Options include a supervised screen-share walkthrough of the document, a redacted version, or their own confidentiality terms reviewed by your counsel.
The buyer wants to share with a consultant. Many buyers outsource vendor reviews. Check that your NDA covers representatives and advisers, or ask the consultant to accept it directly.
The buyer wants the full penetration test report. Offer the summary first, and a call with your security lead to discuss scope and findings. If they still need more, decide case by case, with redaction.
Someone asks for a document that is not on the Trust Center. Treat it as a new gating decision, not a favor. Assign it a tier, then share it through the same process so it appears in the log.
How TrustLynce helps
A TrustLynce Trust Center gates documents behind an approval step and keeps an access log of who viewed which document and when. Reviewers who still need more can be answered from the same reviewed library used for questionnaire automation.