Software trust signals are public, verifiable evidence that lowers a buyer's risk. They include a dated trust page with a security owner, certifications with scope and period, a security.txt file, a current privacy notice, a status page with incident history and named customer proof.
Most buyers decide whether to shortlist you before they speak to you. The evidence they use sits on your public website, or it is missing.
Before booking a new doctor, most people look up the clinic. They check that qualifications are listed and that the address is real. Nobody rings to ask; they look for signs that someone has already checked. Software buyers treat your website in the same way. This guide explains which software trust signals buyers check, how to audit your own in 30 minutes and which gaps to fix first.
Buyers judge you before the first call
The shortlist now forms quietly. In a Gartner survey of 645 B2B buyers, presented in May 2026, buyers used an average of seven information sources in a recent purchase. Some 45% used generative AI, mainly to research suppliers and products. Gartner also reports that 67% prefer a buying experience without a sales representative.
That research is sceptical. In the same survey, 51% of buyers said they were more likely to meet misleading information from generative AI, and 49% from a sales representative. Buyers therefore lean on what they can verify for themselves.
The cost of weak signals is invisible. Nobody sends a rejection explaining that your trust page was two years old. The pipeline simply runs thinner than your traffic suggests it should.
Six signals buyers check first
A trust signal is public evidence that lowers a buyer's perceived risk. Strong signals are specific, dated and verifiable by someone other than you. Weak signals are adjectives.
| Signal | Weak version | Strong version |
|---|---|---|
| Trust or security page | “We take security seriously” | Controls summary, named security contact, last-updated date |
| Certifications | A badge image with no detail | Standard, scope, period and how to request the report |
| Vulnerability disclosure | No reporting route at all | A security.txt file with a contact and future expiry |
| Privacy notice | An old template | Dated notice naming sub-processors and data locations |
| Service status | No status page, or only green lights | Public incident history with follow-up notes |
| Customer proof | Anonymous quotes and a logo wall | Named customers in the buyer's sector; references on request |
A weak signal can do more harm than a missing one. A badge without scope prompts the buyer to ask which product and which period it covers. If the honest answer is an old platform, the buyer begins to doubt the rest of the page.
State certification facts plainly. A SOC 2 Type II report is an independent CPA firm's attestation on how controls operated over a period. ISO/IEC 27001 certification is issued by an accredited body for a defined scope. Name the standard, the scope, the period and how to request the report.
Some of the strongest signals take an hour. RFC 9116 defines security.txt, a small file that tells researchers how to report a flaw. It must contain a Contact field and an Expires field. An expired date shows that nobody maintains it.
Run the Stranger Test in 30 minutes
You cannot see your own site as a stranger does. Ask a colleague who did not build it to act as a procurement analyst. They start from a search result in a private browser window, with no help from you.
- Find: locate the trust page from the homepage. More than two clicks is a fail.
- Verify: for each certification, find the standard, scope, period and issuer without emailing anyone.
- Report: open /.well-known/security.txt and check its expiry date.
- Date: flag any trust page, privacy notice or status page older than 12 months.
- Ask AI: ask an assistant whether your company suits a regulated buyer, and note any errors.
- Score: rate each signal 0 (missing), 1 (unverifiable) or 2 (specific, dated and verifiable).
The maximum is 12. A run of ones usually means the content exists but reads as marketing, which is the cheapest problem to fix. Where the AI answer is wrong, correct the old page or listing it draws on.
Fix the cheapest gaps first
Consider a hypothetical 40-person HR software company that scored 4 out of 12. The founders assumed they needed a new audit. In fact, most of the gaps were editorial.
| Signal | Fix | Effort | Score |
|---|---|---|---|
| Trust page | Add a named owner, controls summary and date | Half a day | 1 to 2 |
| Certifications | Replace the badge with scope, period and request route | One hour | 0 to 2 |
| Vulnerability disclosure | Publish security.txt with a contact and expiry | Under an hour | 0 to 2 |
| Privacy notice | Update sub-processors and data locations with counsel | One to two days | 1 to 2 |
| Service status | Publish incident history with follow-up notes | One day | 1 to 2 |
| Customer proof | Request two named, sector-relevant quotes | Two to four weeks | 1, pending |
Five of the six fixes took less than two days. Where an audit is genuinely missing, say so. A line such as “SOC 2 Type II audit in progress” is more credible than an implied badge, and it gives the buyer a date to plan around.
Keep the signals current
Buyers increasingly research through AI assistants, which repeat whatever your public footprint says, accurate or not. Gartner projects that AI agents will intermediate more than USD 15 trillion of B2B purchases by 2028. Name one owner, and re-run the Stranger Test every quarter.
The bottom line
Conclusion
Patients choose the clinic whose qualifications they can see, not the one that merely claims to be excellent. Buyers shortlist software in the same way, favouring companies whose claims they can verify in a few clicks. Most of the gaps that cost meetings are editorial rather than technical.
Signals decay, and an expired security.txt says more about your operations than any slogan. This week, run the Stranger Test with one colleague who did not build your website, score the six signals and fix the two cheapest gaps before Friday.
Frequently asked questions
What are common red flags on a software company's website?
Certification badges without scope or dates, vague security claims, an outdated privacy notice, no named security contact and no incident history all lead buyers to doubt the rest of the site.
How can a company check its own trust signals?
Ask a colleague who did not build the site to start from a search result in a private window. They score six signals from 0 to 2 in 30 minutes, and you fix the cheapest gaps first.
Why do certification badges alone not convince buyers?
A badge shows a claim but not its scope, period or issuer. Careful buyers therefore ask for the SOC 2 report or ISO/IEC 27001 certificate before relying on it.
What is a security.txt file?
Defined in RFC 9116, it is a plain text file at /.well-known/security.txt that tells researchers how to report vulnerabilities. It must include a Contact field and an Expires field.
Should a trust page be gated behind a form?
Keep the summary public, so buyers who research alone can find it. Share detailed reports, such as a SOC 2 report, under NDA on request.
References
- Gartner, Survey finds 69% of B2B buyers turn to sales reps to validate AI-generated insights (20 May 2026)
- Secureframe, SOC 2 Trust Services Criteria explained
- ISO, ISO/IEC 27001 Information security management
- IETF, RFC 9116: A File Format to Aid in Security Vulnerability Disclosure (April 2022)
- Digital Commerce 360, Gartner: AI agents and $15 trillion in B2B purchases by 2028
Disclaimer: General information only, not legal, security, compliance or financial advice. Check the cited sources and seek professional advice. Names belong to their owners; no endorsement implied.