Tell customers how you use AI. Before they have to ask.
Customers now ask every supplier the same questions: which AI tools do you use, does our data go into them, is anyone in charge. A GhostAudit trust center answers them on one public page, written from your own governance records and published only when you say so.
Interactive example with fictional records. Try it. Switch sections on and publish: the public page changes only then.
- How we govern AI
- Approved AI tools
- Customer data and AI
- Monitoring and controls
- Documents on request
- AI acceptable use policy
- In place, approved 10 Oct 2026
- AI inventory
- Maintained
- Address
- ghostaudit.ai/trust/your-company
- What the page runs
- No script. Sets no cookie
- Published
- When you press Publish, as a version
- Plans
- Govern and Enterprise
A complete example is live.
The fastest way to judge this feature is to read a page it produced. The trust center of Demo Corporation is a fictional company's page, served by the same code that serves a customer's.
It shows the sections a page can carry:
- How we govern AI. Whether an AI acceptable use policy is in place and when it was approved, how often it is reviewed, who is accountable, and whether an inventory is kept.
- Approved AI tools. The tools you have approved for company work, by name, with what each is used for.
- Customer data and AI. Five direct questions: is customer data entered into AI tools, which tools, under what contract terms, is it used to train models, and is output reviewed by a person.
- Monitoring and controls. What is monitored and what never is, whether prohibited tools are blocked, how long usage records are kept.
- Frameworks and assessments. Which frameworks you have assessed yourself against, and when, stated as self-assessments and not as certifications.
- Documents available on request, a contact, and a change log.
- You choose which sections appear. A section with nothing to say is left out
- A PDF summary of the page for people who need a file
- The page footer reads "AI governance by GhostAudit"
Read from your records at the moment you publish.
A trust page is only worth having if it is true. Most of this one is not typed by anyone: it is read from the workspace. The approved tools are the tools marked as sanctioned in your policy. The policy date is the approval date of the document. The assessment dates are the dates assessments were completed.
Three rules keep the page honest:
Nothing is public until you publish. Editing the settings, approving a new tool or finishing an assessment changes nothing on the public page. Publishing takes a snapshot and gives it a version number. The editor shows when the published page has fallen behind the records, and what would change.
Statements about customer data need the owner. The five answers in "Customer data and AI" are commitments, so they appear only after the workspace owner has confirmed each one. The page shows the date of that confirmation. A partner working in your workspace cannot confirm them for you.
Only named fields leave the workspace. The public page is built by a serializer that lists every field it copies. Risk tiers, owners' names, internal comments, usage figures and anything about an individual employee are not on that list, and a test puts a marker in every table to prove none of it reaches the page.
HTTP/1.1 200 OK Content-Type: text/html; charset=utf-8 Cache-Control: no-cache <!doctype html> <title>How Northwind uses AI</title> ... <p>Published 9 Nov 2026 · Version 3</p>
Share the policy without posting it on the internet.
Some documents should be available to a customer and not to everyone. List them on the page as available on request. A visitor fills in a short form with their name, work email, company and reason. You approve or decline each request in the console.
An approved requester receives a link that expires. Each file they download is a PDF with their name on every page, so a copy that travels further can be traced to the person it was given to. Only a keyed hash of the link's token is stored.
The request form has a honeypot field and accepts five requests an hour from one network.
- Approving a request needs the owner or an admin, and a verified email address
- Requests and decisions are in the audit log
Your statements, not our certification.
The page is published by your company, which is responsible for what it says. GhostAudit supplies the software and reads the facts from your records. It does not audit you, and the page says so in its footer.
The frameworks section lists self-assessments. It will never display a badge, a seal or the word "certified", because the product cannot know that.
If your plan stops including the feature, or the workspace lapses, the public address answers "not found" until it is restored. A page that can no longer be kept current should not stay up.
Trust center details
- Sections
- How we govern AI, approved AI tools, customer data and AI (five questions), monitoring and controls, frameworks and assessments, employee training, documents on request, contact, change log.
- Publishing
- Owner or admin, with a verified email address. Each publication is a numbered snapshot; the change log on the page is written from the difference between snapshots.
- Owner confirmation
- Each answer about customer data is public only after the workspace owner confirms it. Partner staff cannot.
- Search engines
- You decide whether the page asks to be indexed. A preview and document links are never indexed.
- Limits
- 90 page views a minute and 5 document requests an hour from one network, by default.
- Address
- A path under the service's own domain: /trust/your-company. A custom domain is not supported.
- Plans
- Govern and Enterprise. Included in the 14-day trial. Pricing
Questions
- Can I see a real one before I sign up?
Yes. The trust center of Demo Corporation is a fictional company's page served by the same code. Nothing on it is a mock-up.
- Does the page update itself when our records change?
No, on purpose. The page shows the last published snapshot. The editor tells you when the records have moved on and shows what would change; you publish when you are satisfied. A public commitment should not change because someone edited a field.
- What stops internal information from appearing on it?
The page is produced by an allow-list: code that names each field it copies from each record. Risk tiers, owners, comments, usage data and employee identities are not among them. A test seeds a marker into every organization table and fails if any marker appears in the public output.
- Can we use our own domain?
Not today. The page lives at a path under the service's domain. If you self-host the server, it is served from your own installation's address.
- Is this a replacement for answering questionnaires?
It removes many of them and shortens the rest. For the questionnaires that still arrive, GhostAudit drafts the AI answers from the same records.
Publish the answer once.
Start a 14-day trial with every Govern feature. Record the tools you have approved, confirm how customer data is handled, and publish your page. No card is needed to start.