Truth Systems sells software that reads lawyers' prompts, and its buyers include information governance and security teams. The homepage says "Our security is enterprise-grade" and lists SSO, IP allow-listing, on-premise and single-tenant deployment, but the section links to no page and names no audit or certification. There is no security, trust, privacy or terms page at all: /security, /trust, /privacy, /privacy-policy and /terms all return 404. A reviewer who wants to start a vendor assessment has nothing to forward, while Harmonic Security's law-firm page lists its certifications and a public Trust Center.
First action
Write the deployment, data-flow and data-retention section from what the homepage already lists, and publish it as /security.
How to measure it
Demo-to-security-approval time
- Now
- –
- Target
- -30%
- By
- 90 days
Steps
Collect the answers
Pull the last five security questionnaires and list the questions every firm asked.
Co-founder & COO 1 day
Write the page
Deployment options, data flow, retention, access controls, sub-processors, audits held, security contact.
Founding Engineer 2 days
Add legal pages
Privacy policy and terms of service, reviewed by counsel.
Co-founder & COO 3 days
Link it everywhere
Footer, the homepage security section and demo follow-up emails.
Co-founder & CEO 1 hour
Add a security-pack request
A short form for firm, role and NDA, routed to the founders.
Co-founder & COO 1 day
Track the effect
Days from demo to security approval, before and after.
Co-founder & COO monthly
Why it works
Publish /security (or a hosted trust center) this week: the deployment options (on-premise, single-tenant, the customer's own AWS or Azure for Gateway), where prompt data goes and for how long, sub-processors, SSO and access controls, the audits or certifications you actually hold and how to request reports under NDA, and a security contact. Add a privacy policy and terms, link all three from the homepage footer and from the security section, and add a "Request our security pack" button next to "Book a demo" that captures firm name and role. Send the link in every demo follow-up so the security review starts before the second call.
At law firms the security questionnaire is usually the slowest step between a good demo and a signed pilot. A page that answers the first twenty questions lets the innovation sponsor forward one link instead of waiting for a call, makes Truth Systems look like the vendor a large firm can approve, and removes an easy reason for a competitor with a trust center to be shortlisted instead.
Ready to use
ChecklistTrust page launch list
[ ] /security with deployment options: on-premise, single-tenant, customer cloud [ ] What data Charter sees, where it is stored, how long it is kept [ ] SSO, IP allow-listing, role-based access, geolocation control [ ] Audits and certifications held, with how to request reports [ ] Sub-processor list [ ] Privacy policy and terms of service [ ] Security contact address [ ] Footer links on every page [ ] "Request our security pack" button next to "Book a demo"
Risks and how to handle them
Claiming a certification that is not current
List only audits with a report you can send today; mark others as in progress with a date.
Too much detail helps attackers
Describe controls and process, never hostnames or architecture specifics; share detail under NDA.
Evidence
- Your websiteSecurity section: "Our security is enterprise-grade" lists SAML SSO, IP allow-listing, role-based access controls, data lifecycle management, on-premise and single-tenant deployment, custom retention and geolocation control, but links to no page and names no audit report or certification. The homepage links to no security, trust, privacy, terms, careers, blog or case-study page, and /security, /trust, /privacy, /privacy-policy and /terms all return 404 (checked twice on November 9, 2026).Source
- Your websiteHomepage: H1 "Truth Systems. Govern everything, unlock anything."; products Charter (a browser and desktop agent that checks prompts against firm and client rules), Alexandria (an MCP gateway that connects Intapp, iManage, Aderant and Microsoft 365 and enforces agent identity and ethical walls) and Charter Insights (AI use "down to the client and the matter"); one call to action, "Book a demo" (a Typeform), plus an info@ email and LinkedIn; testimonials from three leaders at Arnall Golden Gregory (Managing Partner, Chief Knowledge and Innovation Officer, Director of Information Governance), one saying clients want to know which tools were used, what they did and how much time they saved; "We raised $4M", led by Gradient with Lightspeed, F-Prime and Y Combinator.Source
- Competitor researchHarmonic Security's law-firm page: "helps legal teams securely adopt AI"; lists SOC 2 Type 2, ISO 27001, HIPAA attestation and a public Trust Center; offers a self-paced demo and an "AI Policy Generator" tool; claims deployment "in minutes via Intune or JAMF".Source
- Y CombinatorLaunch post: "working with two law firms with $2 billion in revenue combined", helping "nearly 1,500 attorneys", "live and onboarding new law firms daily"; clients impose conflicting AI rules (approval requirements, data-location limits, outright bans) that are hard to enforce by hand; the ask is introductions to Big Law innovation, governance and infosec teams.Source