Public Trust Page

A trust page turns your resilience posture into subject-owned disclosure. Instead of answering the same security questionnaire for every counterparty, you publish a verifiable, continuously updated attestation of your current score, pillars, grade, and trend. Counterparties who need more can be issued their own scoped credentials to verify independently against the API.

Overspace’s own trust page runs this pattern in production.

How it works

The key property: your credential never reaches the browser. A scheduled job holds the credential, composes the snapshot, and publishes a static JSON artifact that the page fetches.

1. Keep the credential server-side. Store the Client ID and API key in your scheduler’s secret store (CI environment secrets, cron worker config) or your enterprise secrets vault. The public page only ever fetches the composed output.
2. Refresh on a schedule. Scores are calculated daily, so a periodic pull (every 6 hours, say) keeps the published number continuously re-attested.
3. Compose and validate before publishing. Pull /score, /pillars, and /trend, assemble the snapshot, and validate every field. A malformed artifact fails the refresh; it never reaches the public page.
4. Strip the Client ID from anything world-readable. The snapshot is public; the credential identifiers that produced it are not.
5. Publish only on change. If the composed snapshot matches the last one, skip the publish. Your artifact history then reads as a change log of the score itself.

The published artifact

The snapshot is the composed report from Building a Complete Report, minus the Client ID:

{
  "score": 84,
  "grade": "Optimize",
  "scoreDate": "2026-03-18",
  "pillarScores": {
    "structuralIntegrity": 84,
    "failureResistance": 82,
    "deviceHealth": 86,
    "recoveryCapability": 84
  },
  "trend": [
    { "scoreDate": "2026-03-18", "score": 84 },
    { "scoreDate": "2026-03-17", "score": 84 },
    { "scoreDate": "2026-03-16", "score": 83 }
  ]
}

One artifact, every audience

The same snapshot serves everyone at once: the trust page renders it, the board deck cites it, a prospect’s security review links to it. A counterparty who needs verified data, an underwriter at renewal or a diligence team in a deal, is issued its own credential and reads the same numbers straight from the API.

That’s the end of the questionnaire. The subject controls the disclosure, the number is continuously re-attested against the live environment, and every audience reads the same score.