Trust Access

​

Overview

Trust Access enables secure, controlled access to your compliance documentation for external users. This system manages the complete access lifecycle—from initial requests through NDA signing, access grants, and ongoing management—while maintaining full audit trails for compliance purposes.

​

1. Key Concepts

Trust Access consists of four core components:

• Access Request: An external user’s initial request to access your compliance documentation.
• NDA Agreement: A legally binding document that must be digitally signed before access is granted.
• Access Grant: A time-limited authorization window (configurable, default 30 days) during which the user has access.
• Access Link: A secure link that authenticates the user and grants portal access. It is emailed to the user, and administrators can also copy it from the dashboard to send it themselves.

​

Time Limits and Expiration

Each component has specific time constraints:

---

​

2. Prerequisites

Before using Trust Access, ensure the following is configured:

1. Published Trust Portal: The portal must be published and publicly accessible for users to submit access requests.

---

​

3. Workflow: Step-by-Step

​

Step 1: Access Request Submission

When external visitors access your public Trust Portal, they see a Request Access button. Clicking this button opens a form where they provide:

• Full name and email address
• Company name and job title
• Reason for requesting access

New access requests appear in the Trust Access Management dashboard with Pending status. If the user already has an active access grant, a fresh access link is sent to their email. If a pending request exists, no duplicate request is created. The requester sees the same confirmation in every case, so the form does not reveal who already has access.

​

Step 2: Administrative Review and Decision

Access the Trust Access Management dashboard to view all pending access requests. Each request displays the requester’s information, purpose, submission timestamp, and current status.

​

Option A: Approve Access Request

1. Click on the request to view complete details
2. Configure the access grant period (7-365 days, default 30 days)
3. Click Approve & Send NDA to proceed

Request status changes to Approved, a pending NDA agreement is generated, and an email is sent to the requester with an NDA signing link (valid for 7 days). The requester receives an email notification: “NDA Signature Required” with a secure link to review and sign the NDA.

​

Skipping the NDA for Trusted Domains and Emails

The NDA Bypass lists in your Trust settings hold email domains and individual email addresses that do not need to sign an NDA. When you approve a request from one of them, access is granted straight away and the requester receives the “Access Granted” email instead of an NDA. Saving a domain or email allow list also applies to requests you approved earlier that are still waiting on an NDA: they are granted access immediately (for the duration approved), their pending NDA link stops working, and the requester is emailed their access link. Re-save the list to retry a failed waiver, including for entries that were already present before this feature was deployed. Deployment alone does not change existing requests. Removing an entry does not affect access that has already been granted.

​

Option B: Deny Access Request

1. Provide a reason for denial
2. Click Deny to reject the request

Request status changes to Denied and the denial reason is logged in the audit trail. No email notification is sent to the requester.

​

Step 3: NDA Signing Process

1. The requester receives an email with subject “NDA Signature Required” containing a secure signing link
2. Clicking the link opens a secure page displaying the complete NDA document: the default NDA generated by Comp AI, or your own NDA if you uploaded one (see Using Your Own NDA)
3. They provide their digital signature to accept the agreement
4. After signing, they receive confirmation that the NDA has been completed

NDA status updates to Signed in the dashboard, the signed NDA PDF is available for download, and the access grant is automatically activated. The audit log captures the signing timestamp, signer’s IP address, User Agent information, and the final signed PDF document. If the 7-day signing window expires, administrators see NDA Link Expired status and can use Resend NDA to email the signing link again, valid for another 7 days. If the requester never receives the email (for example, their mail filter blocks it), use Get NDA link on the request instead. It shows the same signing link, valid for another 7 days, so you can copy it and send it to the requester yourself. No email is sent. If users open an NDA link that has already been signed, they are shown a button that takes them into the portal.

​

Step 4: Portal Access Granted

After successfully signing the NDA, users receive an email notification: “Access Granted”. This email contains their Access Link, valid until their access grant expires, unless the grant is revoked. If the email never arrives, find the grant in the Grants list and use Get access link to copy the link and send it to the user yourself (no email is sent), or Resend Access to email it again. Anyone holding the link can open your Trust Center documents until the grant expires or is revoked, so share it only with the grantee. Once authenticated via the access link, users are presented with a tabbed interface providing access to different features:

​

Documents Tab (Default)

The Documents tab is selected by default and provides access to compliance documentation:

• Compliance Resources Section: Browse and read all published, non-archived compliance policies organized by category

• PDF Bundle Generation: Generate a single PDF bundle containing all accessible policies
  • The downloaded PDF bundle is watermarked with the user’s full name, email address, and a unique document identifier

​

Security Questionnaire Tab

The Security Questionnaire tab enables external users to automatically parse and answer security questionnaires using the organization’s compliance documentation. Questionnaire Upload Interface:

1. File Upload Field: Upload your security questionnaire file
   • Supported formats: PDF, CSV, Excel (.xlsx, .xls)
   • File must be readable and not corrupted
   • Maximum file size: 10MB
2. Output Format Selection: Choose the format for the processed questionnaire
   • Excel (.xlsx) - Default format, editable in Excel
   • PDF - Final submission format
   • CSV - Simple data exchange format
3. Upload & Process Button: Submit the questionnaire for processing
   • The system automatically extracts questions from your file
   • Answers are generated based on the organization’s published policies
   • Processing typically takes 5-30 seconds depending on file type and size

After processing, the completed questionnaire is automatically downloaded with all questions answered based on the organization’s compliance documentation. Users can review and edit answers before final submission. Access grant status shows as Active in the dashboard, the grant expiration date is visible, and all activity (document downloads and questionnaire submissions) is logged for audit purposes.

---

​

4. Managing Active Access

​

Reclaiming Access (Lost Access Links)

Access links stay valid until the access grant expires or is revoked. If a user loses their link, they can get it again without administrator intervention:

1. Navigate to the Trust Portal
2. Click Reclaim Access
3. Enter their email address

The response is the same for every email address: “If this email has active access, a link has been sent to it.” If their access grant is still active, the system emails a new access link. If no email arrives within a few minutes, check spam and try again. If it still does not arrive, contact the organization’s trust portal contact, or submit a new access request if the grant may have expired.

​

Revoking Access

Access can be revoked at any time through the Grants section of the dashboard:

1. Navigate to the Grants list in the dashboard
2. Locate the active grant for the user
3. Click Revoke
4. Enter a reason for revocation

Grant status immediately changes to Revoked, the signed NDA is marked as Void, all active access links are immediately invalidated, and the revocation action is logged in the audit trail. Any active access links stop working immediately, and users must submit a new access request if access is needed again.

---

​

5. Using Your Own NDA

By default, requesters sign an NDA generated by Comp AI. To have them sign your organization’s own NDA instead, open Trust → Settings and use the Custom NDA card.

• Upload NDA (PDF): Upload your NDA as a PDF up to 10MB. It must not be encrypted or password-protected, and it is checked on upload so that a PDF that cannot be prepared for signing is rejected with the reason.
• Replace: Upload a new version. It replaces the previous one.
• Download: Download the NDA currently in use, for example to edit it and upload it again.
• Remove: After confirmation, requesters approved from then on sign the default NDA again.

Uploading, replacing, and removing require permission to update Trust settings (the Owner and Admin roles by default). Users with read access, such as Auditors, can only download it. What requesters sign:

• Your NDA’s pages, followed by a signature page that Comp AI adds at the end with the requester’s name, email address, and signing time. The requester (Receiving Party) is the only signer.
• The whole document is watermarked the same way as the default NDA.

Which version applies:

• Your NDA applies to access requests approved after you upload it.
• Each approved request keeps the version that was in use when it was approved. Replacing or removing your NDA does not change NDAs that were already sent, including ones you resend with Resend NDA.