RFC-133: Evolving the Marketplace Trust Program (follow up to RFC-124) - Trust program requirement updates and validation steps

General Request for Comments (RFC)
, , , ,
36

Hi all,

I will not hook into the naming discussion, you all got that covered already :smiley:

I am very happy that the Migration requirement has been removed!

But the "3.1 - Public trust centre available" introduces another 4K of costs when used from e.g. Vanta. So for “smaller” vendors, would it be possible to use a trust center e.g. generated by a static site generator and hosted publicly? Could you for example simply define an XML or any other form of machine readable requirement one can fulfill.

That would be great. Otherwise we would have very high costs just for the trust center.

For our Vanta I think the costs are around:

  • 10K per year for Vanta itself including SOC 2 Type II and Audit
  • 3K per year for 1 App PenTesting in BugCrowd
  • 4K per year for the public Vanta Trust Center alone.

I am not a big fan of the throwing additional 4K at Vanta just so customers can download some PDF documents. (And yes there is also other stuff available, but the NDA-protected download functionality for example can also be implemented with Jira Service Management).

Thanks