What is a Trust Surface?

Digital systems are now the primary interface between organisations and their stakeholders.

Customers, partners, regulators, and the public interact with organisations through digital channels such as:

• email communications
• websites and online services
• domain names
• application platforms
• third-party services

These systems collectively shape how trustworthy an organisation appears in the digital environment.

The Trust Surface describes the digital systems and signals through which this trust is experienced.

Definition

Trust Surface

The collection of digital systems and observable signals through which stakeholders assess the trustworthiness of an organisation’s digital presence.

The Trust Surface includes both the systems an organisation operates and the signals those systems emit.

Examples include:

• domain ownership and DNS configuration
• email authentication policies
• encryption and certificate posture
• reliability of digital services
• vendor platforms connected to organisational systems

Together, these elements create a digital environment that stakeholders interact with and interpret.

Why the Trust Surface Matters

When stakeholders interact with an organisation digitally, they rarely see internal systems or governance processes.

Instead, they experience signals such as:

• whether an email appears authentic
• whether a website connection is secure
• whether a digital service functions reliably
• whether a third-party platform behaves appropriately

These signals shape perceptions of organisational competence, reliability, and integrity.

Failures at the Trust Surface often lead stakeholders to question the organisation itself.

Trust Surface vs Attack Surface

The Trust Surface concept is related to, but distinct from, the well-known concept of an Attack Surface.

Attack Surface Management focuses on identifying vulnerabilities that attackers may exploit.

Trust Surface management focuses on identifying signals that influence stakeholder confidence.

While the two concepts are related, the Trust Surface is concerned with trust perception and governance, not only technical vulnerability.

Components of a Trust Surface

An organisation’s Trust Surface is typically composed of several layers of digital interaction.

These commonly include:

Identity

Systems that establish and verify digital identity, including authentication and user access.

Domains and DNS

Domain ownership, DNS configuration, and related infrastructure that enable digital communication and service access.

Email Systems

Infrastructure and policies that ensure email communications are authentic and resistant to impersonation.

Digital Services

Websites, portals, APIs, and applications through which stakeholders interact with the organisation.

Infrastructure and Platforms

The technical environments hosting services and applications, including cloud platforms and hosting infrastructure.

Third-Party Services

External vendors, SaaS platforms, and integrations that influence the organisation’s digital interactions.

Together these layers create a network of signals that stakeholders interpret when engaging with the organisation.

The Signals Emitted by the Trust Surface

Every component of the Trust Surface emits observable signals.

Examples include:

• DNS records and domain integrity indicators
• email authentication policies such as SPF, DKIM, and DMARC
• TLS certificates and encryption configurations
• uptime and service availability signals
• vendor security attestations

These signals provide evidence about how well digital systems are governed and maintained.

They are often publicly observable and therefore influence external perceptions of trust.

Why Trust Surface Governance Is Necessary

In many organisations, components of the Trust Surface are managed by different teams.

Examples include:

• technology teams managing infrastructure
• marketing teams registering domains
• procurement teams selecting SaaS platforms
• communications teams operating digital channels

Because responsibility is distributed, organisations may lack a unified understanding of how these systems collectively influence digital trust.

Trust Surface governance provides a structured approach to understanding and managing this environment.

Trust Surface and Digital Trust Posture

The signals emitted by the Trust Surface collectively determine an organisation’s Digital Trust Posture.

Digital Trust Posture reflects the overall confidence stakeholders may have in the organisation’s digital systems.

It is influenced by factors such as:

• authenticity of communications
• integrity of digital infrastructure
• reliability of digital services
• governance of third-party platforms

By observing and measuring Trust Surface signals, organisations can better understand their digital trust posture and identify areas where improvement is needed.

The Role of the Trust Surface Framework

The Trust Surface Framework provides a model for understanding and managing the Trust Surface through three key concepts:

• identifying the Trust Surface
• measuring Trust Signals
• governing digital trust through a structured lifecycle

This approach allows organisations to move beyond purely technical security considerations and focus on the broader challenge of maintaining digital trust.

Status of This Document

This document forms part of the Trust Surface Framework draft, published for consultation and discussion.

The framework continues to evolve as organisations explore practical ways to measure and govern digital trust.