ZIPdownload bundle
Trust pack download
Architecture summary, checklist, and questionnaire pre-fill for procurement binders.
Govern trust & evidence
Shipped vs Gap for script orchestration
Govern trust for MSP script orchestration. See what's built, what's not, and export audit proof yourself in Govern early access. We do not hold SOC 2 Type I or Type II. We do not claim an observation period on this site.
Verify it yourself
Download the trust pack or open Shipped vs. Gap tables. Then reproduce audit export in Govern early access.
This page describes product capabilities for your control matrix. Trustholm does not hold SOC 2, ISO 27001, IRAP, Essential Eight, CMMC, Cyber Essentials, NIS2, or framework certification badges.
This is the Govern evidence surface on www. Tables cover script signing, tenant isolation, and audit export. Company legal and subprocessors stay on the company trust hub. For Migrate, ShareSight, and Bridge, start from each product page and request access from that product's trial page (/migrate/trial, /sharesight/trial, /bridge/trial).
What Govern has shipped vs backlog, and how to verify claims in a Govern early access tenant:
Vendor origin: Trustholm is a founder-led software business based in Brisbane, Australia. The contracting party is confirmed in writing before any paid agreement. Contact security@trustholm.com for procurement questions.
Start here: - Security and evidence: Shipped vs. Gap tables mapped to common audit controls - Tenant isolation: How MSP customer data stays separated - Audit and logging: Script execution export vs.
HTTP logs - Script signing: Signing policy before run - Trust downloads: Architecture summary, checklist, questionnaire pre-fill - Governance outcome stories: Illustrative evaluation walkthroughs (not customer results)
What we do not claim: Vendor SOC 2 Type I or Type II, ISO 27001, IRAP, Essential Eight achievement for your estate, or other certifications. We supply technical artifacts for *your* control matrix. We do not automate your SOC 2 Trust Services Criteria like a GRC tool. You verify artifacts; your assessor owns certification outcomes.
Contact security@trustholm.com for the full trust pack during evaluation.
Trust Centre
Privacy, legal agreements, security evidence, and how to verify claims in Govern early access.
Privacy
Privacy policy, data handling, and DPA contact for procurement.
Legal
Terms of service, cookies policy, and enterprise contract schedules.
Security
CIA mapping, Shipped/Gap evidence, operational FAQs, and procurement pack.
Verify in Govern early access
Export audit JSON/CSV yourself in Govern early access - self-serve proof vs gated vendor PDFs.
Govern trust topics
Security, isolation, audit, and data handling evidence pages.
Security & Evidence
Shipped capabilities and honest gaps for assessor review-privileged action audit, signing policy, tenant isolation, and rate limiting with explicit non-certification framing for enterprise and government diligence.
Tenant Isolation
Schema-per-tenant PostgreSQL architecture, JWT tenant binding for portal users, agent polling credentials, and dedicated database profiles-with honest limits on application-layer defense for MSP SaaS procurement.
Audit & Logging
Security audit plane versus HTTP request logs, export APIs, tenant opt-out, correlation enrichment, and SIEM integration gaps stated honestly for SOC 2, ISM, and enterprise security questionnaire reviewers evaluating remote management evidence.
Identity & Access
OIDC/SAML SSO, MFA flows, RBAC with module feature gates, JWT sessions, and Super Admin step-up-with customer IdP lifecycle responsibilities stated clearly.
Script Signing
PowerShell code signing policy enforcement, platform script catalog, built-in operation tags, audit attribution, and PKI deployment variations described without overclaiming HSM coverage or application-control certification.
Procurement artifacts
- Subprocessor list - published for questionnaires
- Trust downloads - starter pack, SIG Lite, diligence script
- Security for MSPs · Enterprise · Government
- DPA summary - contact security@trustholm.com
Frequently asked questions
- Does Trustholm provide a SOC 2 report?
No. We do not hold SOC 2 Type I or Type II. We do not claim an observation period on this site. We publish Shipped vs Gap and Govern early access export so your assessor can verify artifacts.
- How do I verify claims in a Govern early access tenant?
Sign in to Govern early access, open Security Center, export audit JSON or CSV, and inspect tenant settings. Each trust page lists the UI path or API endpoint to check.
- What gaps should I document in our SSP?
Common gaps include WORM audit immutability and vendor SOC 2 (we do not hold Type I or Type II). Splunk/Datadog native sink templates remain backlog. Limitations blocks on each trust page name these explicitly.
- Is data hosted in Australia?
Australia is the planned first region. EU hosting is by enterprise arrangement. Your region is agreed in writing during onboarding. See /govern/resources/digital-sovereignty-eu-msp-saas for EU buyers.
- Is Trustholm a European vendor?
No. Trustholm is based in Australia. EU hosting is available only by enterprise arrangement.
- Can we use this hub for government procurement?
Yes as technical reference material. We provide consumer responsibility framing without claiming IRAP or government vendor certification.