Blog · Website claims · Problem 7 of 93
The website promises more than the policies say. A buyer just noticed.
· 2 min read · By Case Jones
Marketing wrote the security page two years ago. Since then the product, the hosting and the team have changed, and nobody checked the page against the policies. Now a buyer’s security reviewer has both open side by side.
What it costs to leave it
A claim on your website is a promise. When it doesn’t match your policies or your questionnaire answers, reviewers stop trusting the rest, and a claim you can’t back up can become a contract or legal problem later.
How to make the site and the policies agree
This is usually a few hours of careful reading, not a rewrite. The goal is one story, told the same way everywhere.
- 1
List every security claim the site makes
Read the security page, the trust page, the FAQ, the footer and the sales decks. Copy every sentence that promises something: encryption, uptime, certifications, data location, backups, who can see data.
- 2
Find the policy behind each one
For each claim, find the sentence in a written policy that says the same thing. If you can’t find one, the claim is resting on memory or marketing.
- 3
Decide: change the practice, the policy or the page
Some claims are true and just need writing down. Some practices fell behind and need fixing. Some claims should simply go. Vague words like “military-grade” and “fully compliant” almost always belong in the last group.
- 4
Be careful with certifications
Never imply a certification you don’t hold. Your cloud provider’s SOC 2 report is theirs, not yours. “Hosted on AWS, which is SOC 2 audited” is accurate; “SOC 2 compliant” is not, unless your own audit says so.
- 5
Check again whenever a policy changes
Put a date on the security page and give one person the job of checking it when policies change. Drift comes back quickly when nobody owns the page.
Example
One claim, fixed
Before: “Your data is protected with bank-level security and is never accessible to our staff.” After: “Customer data is encrypted in transit and at rest. Two engineers can access production, with multi-factor authentication, and every access is logged.”
Or let 93 Compliance compare them
Discovery reads your website and compares what it claims with what your policies say, and shows where they disagree. You decide whether to fix the page, the policy or the practice.
Missing policies can be written in the policy builder, where an AI policy assistant drafts and customises them as tracked changes for an owner to accept. Then test the documents against SOC 2, HIPAA, ISO 27001 or a customer’s questionnaire.
All of this is free, with no card.
- Website claims compared with your policies
- Missing policies drafted in the policy builder
- Documents tested against the standards you name
- Word downloads of every policy
Compare my website
The policies, the questionnaire check, procedures and audits are free. Training records are $10 per employee per year.
Start freeWritten by Case Jones, who built 93 Compliance. Former VP of Information Security who took doxy.me from zero to SOC 2 Type 2, through a SOC 2 Type 1 audit, two Type 2 audits and a positive HIPAA assessment. doxy.me is not affiliated with 93 Compliance and has not endorsed it.
Questions
Should marketing or security own the security page?
Marketing can write it, but security should approve every claim before it goes live and whenever a policy changes. The page is a promise about practice, not a slogan.
What words should we avoid?
“Bank-level”, “military-grade”, “unhackable”, “fully compliant” and any certification you don’t hold. Say what you do, in plain words.
Do we need to take the page down while we fix it?
Usually not. Remove or soften the claims you can’t back up today, and add the specific ones as the policies catch up.